rulesync 43.4.2 → 43.6.0

package/dist/{import-ClFasGQ6.cjs → import-C-oT_Hdp.cjs}

@@ -382,36 +382,36 @@ function formatError(error) {
 	return boundErrorMessage(String(error));
 }
 // src/constants/rulesync-paths.ts
-const { join: join$384 } = node_path.posix;
+const { join: join$385 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$384(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$385(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$384(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$384(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$385(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$385(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$384(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$385(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -895,6 +895,7 @@ const hooksProcessorToolTargetTuple = [
 	"qwencode",
 	"reasonix",
 	"tabnine",
+	"trae",
 	"grokcli",
 	"gitlabduo",
 	"lettacode",
@@ -3945,6 +3946,7 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".poolside/settings.yaml",
 	".config/poolside/settings.yaml",
 	".tabnine/agent/settings.json",
+	".trae/hooks.json",
 	".vibe/config.toml",
 	".zcode/config.json",
 	".zcode/cli/config.json",
@@ -6027,6 +6029,34 @@ const CANONICAL_TO_CORTEXCODE_EVENT_NAMES = {
 };
 const CORTEXCODE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_CORTEXCODE_EVENT_NAMES);
 /**
+* Hook events supported by TRAE.
+*
+* TRAE reads `.trae/hooks.json` (project) and `~/.trae/hooks.json` (user):
+* `{ "version"?: 1, "hooks": { "<Event>": [{ "matcher"?, "hooks": [{ "type":
+* "command", "command", "timeout"? }] }] } }` with Claude-Code-style
+* PascalCase event names. `$TRAE_PROJECT_DIR` resolves to the workspace root
+* inside commands.
+*
+* @see https://docs.trae.ai/ide/hook-configuration-reference?_lang=en
+*/
+const TRAE_HOOK_EVENTS = [
+	"sessionStart",
+	"beforeSubmitPrompt",
+	"preToolUse",
+	"postToolUse",
+	"stop",
+	"notification"
+];
+const CANONICAL_TO_TRAE_EVENT_NAMES = {
+	sessionStart: "SessionStart",
+	beforeSubmitPrompt: "UserPromptSubmit",
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	stop: "Stop",
+	notification: "Notification"
+};
+const TRAE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_TRAE_EVENT_NAMES);
+/**
 * Hook events supported by CodeBuddy Code.
 *
 * CodeBuddy Code reads hooks from the `hooks` key of `.codebuddy/settings.json`
@@ -6499,6 +6529,7 @@ const HooksConfigSchema = zod_mini.z.looseObject({
 	bob: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	codebuddy: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	cortexcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
+	trae: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	commandcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	lettacode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	continue: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
@@ -8400,17 +8431,29 @@ const CodewhalePermissionsOverrideSchema = zod_mini.z.looseObject({
 	rules: zod_mini.z.optional(zod_mini.z.array(CodewhalePermissionRuleSchema))
 });
 /**
-* The starting permission level VS Code Copilot Chat gives new chat sessions
-* (`chat.permissions.default`). Values are VS Code's own: `default` (Default
+* The values VS Code's `chat.permissions.default` setting accepts: the starting
+* permission level of new Local-harness chat sessions — `default` (Default
 * Permissions), `autoApprove` (Bypass Approvals) and `autopilot` (Autopilot).
 *
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
-const COPILOT_DEFAULT_PERMISSION_MODES = [
+const COPILOT_LOCAL_PERMISSION_LEVELS = [
 	"default",
 	"autoApprove",
 	"autopilot"
 ];
+/**
+* The starting permission level the `copilot.defaultPermissionMode` override
+* sets for new chat sessions: the {@link COPILOT_LOCAL_PERMISSION_LEVELS}, plus
+* `assisted` (Assisted permissions, GA for Copilot-harness sessions since VS
+* Code 1.144 and unavailable to Local sessions). Each value is written to both
+* `chat.permissions.default` (Local sessions) and the `approvals` / `mode` of
+* `chat.defaultConfiguration` (Copilot-harness sessions, VS Code 1.144+).
+*
+* @see https://code.visualstudio.com/updates/v1_144
+* @see https://github.com/microsoft/vscode/blob/1.144.0/src/vs/workbench/contrib/chat/browser/chat.shared.contribution.ts
+*/
+const COPILOT_DEFAULT_PERMISSION_MODES = [...COPILOT_LOCAL_PERMISSION_LEVELS, "assisted"];
 /** `chat.agent.sandbox.enabled`: `"off"` or `"on"`. */
 const CopilotSandboxEnabledSchema = zod_mini.z.enum(["off", "on"]);
 /** `chat.agent.sandbox.fileSystem.userConfiguredPaths`. */
@@ -8451,7 +8494,7 @@ const CopilotSandboxSchema = zod_mini.z.strictObject({
 /**
 * Tool-scoped override block for GitHub Copilot in VS Code.
 * `defaultPermissionMode` writes the workspace `chat.permissions.default`
-* setting, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
+* and `chat.defaultConfiguration` settings, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
 * has a canonical category.
 */
 const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
@@ -9333,6 +9376,7 @@ const TaktPermissionsOverrideSchema = zod_mini.z.looseObject({
 	})),
 	workflow_runtime_prepare: zod_mini.z.optional(zod_mini.z.object({ custom_scripts: zod_mini.z.optional(zod_mini.z.boolean()) })),
 	workflow_command_gates: zod_mini.z.optional(zod_mini.z.object({ custom_scripts: zod_mini.z.optional(zod_mini.z.boolean()) })),
+	workflow_system_commands: zod_mini.z.optional(zod_mini.z.object({ custom_scripts: zod_mini.z.optional(zod_mini.z.boolean()) })),
 	sync_conflict_resolver: zod_mini.z.optional(zod_mini.z.object({ auto_approve_tools: zod_mini.z.optional(zod_mini.z.boolean()) })),
 	allow_git_hooks: zod_mini.z.optional(zod_mini.z.boolean()),
 	allow_git_filters: zod_mini.z.optional(zod_mini.z.boolean())
@@ -9600,6 +9644,7 @@ const CodexSandboxModeSchema = zod_mini.z.enum([
 	"workspace-write",
 	"danger-full-access"
 ]);
+const CODEX_U32_MAX = 4294967295;
 /**
 * Codex CLI's reviewer for approval requests. `guardian_subagent` is a legacy
 * value Codex still accepts for backward compatibility, so it is included so
@@ -9668,6 +9713,9 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 *   | `guardian_subagent`), or a table for the richer reviewer config.
 *   Defaults to `auto_review` when neither the override nor the existing
 *   config sets it.
+* - `auto_review` — the `[auto_review]` table that configures the reviewer
+*   `approvals_reviewer = "auto_review"` selects (`policy`, `extra_policy`,
+*   `timeout_ms`, …). A loose table, shallow-merged like `apps` / `tui`.
 * - `git_write_rules` — whether the managed profile's `:workspace_roots` table
 *   emits the default `.git` carve-out (`".git/**" = "write"`). Codex's
 *   `:workspace` baseline makes `.git` read-only, which denies basic git
@@ -9681,7 +9729,8 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 * The keys written to `config.toml` are an **allowlist**, not verbatim
 * passthrough: only `CODEXCLI_OVERRIDE_KEYS`
 * (`src/constants/codexcli-paths.ts` — `approval_policy`, `sandbox_mode`,
-* `sandbox_workspace_write`, `apps`, `approvals_reviewer`) are emitted, and
+* `sandbox_workspace_write`, `apps`, `approvals_reviewer`, `auto_review`,
+* `tui`) are emitted, and
 * `computeCodexcliOverridePatch` skips anything else with a warning.
 * `base_permission_profile` and `git_write_rules` are consumed by the profile
 * builder rather than written, as described above, and `permission` is the
@@ -9713,6 +9762,26 @@ const CodexcliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	apps: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	approvals_reviewer: zod_mini.z.optional(zod_mini.z.union([CodexApprovalsReviewerSchema, zod_mini.z.looseObject({})])),
 	/**
+	* The `[auto_review]` table of `config.toml`, which configures the reviewer
+	* that `approvals_reviewer = "auto_review"` (Rulesync's default) selects:
+	* `policy` / `extra_policy` (text inserted into the reviewer prompt),
+	* `timeout_ms` (the review budget, Codex 0.165.0+; `0` waits without a
+	* deadline), `circuit_break_action` (`default` | `strict`) and
+	* `conversation_history_max_output_tokens` (a positive token cap). Codex
+	* rejects the whole config file when one of these has the wrong type or is
+	* out of range (`timeout_ms` is a `u32`, the token cap a `NonZeroUsize`), so
+	* they are checked here; every other key passes through verbatim.
+	*
+	* @see https://github.com/openai/codex/blob/rust-v0.166.0/codex-rs/config/src/config_toml.rs (`AutoReviewToml`)
+	*/
+	auto_review: zod_mini.z.optional(zod_mini.z.looseObject({
+		policy: zod_mini.z.optional(zod_mini.z.string()),
+		extra_policy: zod_mini.z.optional(zod_mini.z.string()),
+		timeout_ms: zod_mini.z.optional(zod_mini.z.int().check(zod_mini.z.nonnegative(), zod_mini.z.lte(CODEX_U32_MAX))),
+		circuit_break_action: zod_mini.z.optional(zod_mini.z.enum(["default", "strict"])),
+		conversation_history_max_output_tokens: zod_mini.z.optional(zod_mini.z.int().check(zod_mini.z.positive()))
+	})),
+	/**
 	* The `[tui]` table of `config.toml` (e.g. `vim_mode_default`, `keymap.*`).
 	* Not a permission surface, but like `apps` it is a top-level table with no
 	* canonical category, and Codex adds keys to it faster than an explicit model
@@ -12319,6 +12388,7 @@ const CODEXCLI_OVERRIDE_KEYS = [
 	"sandbox_workspace_write",
 	"apps",
 	"approvals_reviewer",
+	"auto_review",
 	"tui"
 ];
 // src/constants/takt-paths.ts
@@ -13741,6 +13811,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 					"workflow_arpeggio",
 					"workflow_runtime_prepare",
 					"workflow_command_gates",
+					"workflow_system_commands",
 					"sync_conflict_resolver",
 					"allow_git_hooks",
 					"allow_git_filters"
@@ -13882,6 +13953,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 				"chat.tools.edits.autoApprove",
 				"chat.tools.urls.autoApprove",
 				"chat.permissions.default",
+				"chat.defaultConfiguration",
 				"chat.agent.sandbox.enabled",
 				"chat.agent.sandbox.network.allowNetwork",
 				"chat.agent.sandbox.network.allowLocalNetwork",
@@ -14140,6 +14212,14 @@ const SHARED_CONFIG_OWNERSHIP = {
 			}
 		}
 	},
+	".trae/hooks.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { hooks: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["hooks"]
+		} }
+	},
 	".trae/permission/global.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -23265,10 +23345,13 @@ var TaktCommand = class TaktCommand extends ToolCommand {
 * @see https://docs.trae.ai/ide/slash-commands?_lang=en
 * @see https://docs.trae.ai/ide/ignore-files?_lang=en
 * @see https://docs.trae.ai/ide/permission-and-approval?_lang=en
+* @see https://docs.trae.ai/ide/hook-configuration-reference?_lang=en
 */
 const TRAE_DIR = ".trae";
 /** Project MCP servers (`mcpServers` object), project scope only. */
 const TRAE_MCP_FILE_NAME = "mcp.json";
+/** Hooks: `.trae/hooks.json` (project) and `~/.trae/hooks.json` (global). */
+const TRAE_HOOKS_FILE_NAME = "hooks.json";
 /** Skills: `.trae/skills/<name>/SKILL.md` (project) and `~/.trae/skills/` (global). */
 const TRAE_SKILLS_DIR_PATH = (0, node_path.join)(TRAE_DIR, "skills");
 /**
@@ -25193,12 +25276,80 @@ var AiassistantSkill = class AiassistantSkill extends ToolSkill {
 		});
 	}
 };
+// src/features/shared/amp-settings.ts
+/**
+* Parse an Amp `settings.json` / `settings.jsonc` document.
+*
+* Shared by the MCP and permissions adapters because both read the very same
+* file. Two separately maintained copies drifted once already: the permissions
+* side was hardened while the MCP side kept calling `jsonc-parser` directly,
+* which left it importing MCP servers reachable only through an injected
+* `__proto__`.
+*
+* {@link parseJsonc} is the strict, sanitizing parser: it throws on any syntax
+* error instead of returning `jsonc-parser`'s best-effort value, and it
+* rebuilds every object from its own enumerable entries, so a root `__proto__`
+* cannot swap the returned object's prototype and `constructor` / `prototype`
+* never survive as own keys, at any depth.
+*
+* Removal is silent, matching every other tool-side adapter (opencode, kilo,
+* copilot). Reporting the removed keys through `droppedPollutionKeysError` is
+* reserved for the three files a user authors under `.rulesync/`, whose whole
+* purpose is to be turned into tool config — a key that vanishes there needs
+* explaining, whereas here the surrounding settings are the user's own file
+* and are left alone.
+*
+* Note the consequence for a root `__proto__`: sanitizing runs before the
+* plain-object check, so such a document parses successfully with the key
+* stripped rather than failing that check. That is deliberate — dropping the
+* one poisoned key keeps the user's unrelated settings — and matches the
+* sanitize-before-the-root-check design the shared config gateway documents.
+*/
+function parseAmpSettings({ fileContent }) {
+	let parsed;
+	try {
+		parsed = parseJsonc$6(fileContent || "{}");
+	} catch (error) {
+		throw new Error(`Failed to parse Amp settings: ${formatError(error)}`, { cause: error });
+	}
+	if (!isPlainObject(parsed)) throw new Error("Amp settings must be a JSON object");
+	return parsed;
+}
+/**
+* Probe `<jsonDir>/settings.jsonc` first, falling back to `settings.json`, so
+* an existing user file is read-modified-written in place instead of a fresh
+* `.json` sibling being created next to a hand-authored `.jsonc`. Defaults to
+* `settings.json` when neither file exists: Amp's canonically documented
+* settings file (`.amp/settings.json`), shared by the MCP and permissions
+* adapters, so generating both on a clean repo writes a single settings file.
+*/
+async function resolveAmpSettingsFile(jsonDir) {
+	const jsoncContent = await readFileContentOrNull((0, node_path.join)(jsonDir, AMP_SETTINGS_JSONC_FILE_NAME));
+	if (jsoncContent !== null) return {
+		fileContent: jsoncContent,
+		relativeFilePath: AMP_SETTINGS_JSONC_FILE_NAME
+	};
+	const jsonContent = await readFileContentOrNull((0, node_path.join)(jsonDir, AMP_SETTINGS_FILE_NAME));
+	if (jsonContent !== null) return {
+		fileContent: jsonContent,
+		relativeFilePath: AMP_SETTINGS_FILE_NAME
+	};
+	return {
+		fileContent: null,
+		relativeFilePath: AMP_SETTINGS_FILE_NAME
+	};
+}
 // src/features/skills/amp-skill.ts
 const AmpSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string()
 });
 /**
+* Amp setting that makes it skip `~/.config/agents/skills/` and
+* `~/.agents/skills/`. https://ampcode.com/docs/cli/settings
+*/
+const AMP_DISABLE_GLOBAL_AGENTS_SKILLS_KEY = "amp.skills.disableGlobalAgentsSkills";
+/**
 * Represents an Amp Agent Skill directory.
 *
 * Amp natively reads Agent Skills following the open standard: a directory with a
@@ -25233,6 +25384,27 @@ var AmpSkill = class AmpSkill extends ToolSkill {
 			...global && { importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH, AMP_SKILLS_NATIVE_GLOBAL_DIR] }
 		};
 	}
+	/**
+	* Warn when the user's Amp settings disable the global agent-agnostic skill
+	* roots, because the global skills rulesync writes to
+	* `~/.config/agents/skills/` would then never load. Only the user settings
+	* file is checked: a workspace `.amp/settings.json(c)` depends on where Amp
+	* is started, which global generation cannot know.
+	*/
+	static async getGenerationWarnings({ outputRoot, global, logger }) {
+		if (!global) return [];
+		const { fileContent, relativeFilePath } = await resolveAmpSettingsFile((0, node_path.join)(outputRoot, AMP_GLOBAL_DIR));
+		if (fileContent === null) return [];
+		let settings;
+		try {
+			settings = parseAmpSettings({ fileContent });
+		} catch (error) {
+			logger.debug(`Skipping the Amp skills settings check for ${(0, node_path.join)(AMP_GLOBAL_DIR, relativeFilePath)}: ${formatError(error)}`);
+			return [];
+		}
+		if (settings[AMP_DISABLE_GLOBAL_AGENTS_SKILLS_KEY] !== true) return [];
+		return [`Amp will not load the global skills rulesync writes to ~/${AMP_SKILLS_GLOBAL_DIR}/: '${AMP_DISABLE_GLOBAL_AGENTS_SKILLS_KEY}' is true in ~/${(0, node_path.join)(AMP_GLOBAL_DIR, relativeFilePath)}.`];
+	}
 	getFrontmatter() {
 		return AmpSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
 	}
@@ -33209,7 +33381,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 	async convertRulesyncDirsToToolDirs(rulesyncDirs) {
 		const rulesyncSkills = rulesyncDirs.filter((dir) => dir instanceof RulesyncSkill);
 		const factory = this.getFactory(this.toolTarget);
-		return (await Promise.all(rulesyncSkills.map(async (rulesyncSkill) => {
+		const toolSkills = (await Promise.all(rulesyncSkills.map(async (rulesyncSkill) => {
 			const isClaudecodeScheduledTask = rulesyncSkill.getFrontmatter().claudecode?.["scheduled-task"] === true;
 			if (isClaudecodeScheduledTask && this.toolTarget !== "claudecode" && this.toolTarget !== "claudecode-legacy") return null;
 			if (!factory.class.isTargetedByRulesyncSkill(rulesyncSkill)) return null;
@@ -33236,6 +33408,15 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 				logger: this.logger
 			});
 		}))).filter((skill) => skill !== null);
+		if (toolSkills.length > 0 && factory.class.getGenerationWarnings) {
+			const warnings = await factory.class.getGenerationWarnings({
+				outputRoot: this.outputRoot,
+				global: this.global,
+				logger: this.logger
+			});
+			for (const warning of warnings) this.logger.warn(warning);
+		}
+		return toolSkills;
 	}
 	async convertToolDirsToRulesyncDirs(toolDirs) {
 		const toolSkills = toolDirs.filter((dir) => dir instanceof ToolSkill);
@@ -34123,7 +34304,7 @@ function normalizeAugmentcodeToolList(value) {
 	return tools.length > 0 ? tools : void 0;
 }
 const AugmentcodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
-	name: zod_mini.z.string(),
+	name: zod_mini.z.optional(zod_mini.z.string()),
 	description: zod_mini.z.optional(zod_mini.z.string()),
 	color: zod_mini.z.optional(zod_mini.z.string()),
 	model: zod_mini.z.optional(zod_mini.z.string()),
@@ -34182,7 +34363,7 @@ var AugmentcodeSubagent = class AugmentcodeSubagent extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: ["*"],
-				name,
+				name: name ?? (0, node_path.basename)(this.getRelativeFilePath(), (0, node_path.extname)(this.getRelativeFilePath())),
 				description,
 				...Object.keys(augmentcodeSection).length > 0 && { augmentcode: augmentcodeSection }
 			},
@@ -34248,7 +34429,8 @@ var AugmentcodeSubagent = class AugmentcodeSubagent extends ToolSubagent {
 		const dirPath = relativeDirPath ?? this.getSettablePaths({ global }).relativeDirPath;
 		const filePath = (0, node_path.join)(outputRoot, dirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
-		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(fileContent, filePath);
+		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}`);
 		const result = AugmentcodeSubagentFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		return new AugmentcodeSubagent({
@@ -41831,7 +42013,23 @@ function sanitizeOpencodeMcpNamePart(value) {
 * key that matches nothing.
 */
 function opencodeMcpToolPermissionKey(serverName, toolName) {
-	return `${sanitizeOpencodeMcpNamePart(serverName)}_${toolName.replace(/[^a-zA-Z0-9_\-*?]/g, "_")}`;
+	return `${opencodeMcpServerKeyPrefix(serverName)}${toolName.replace(/[^a-zA-Z0-9_\-*?]/g, "_")}`;
+}
+/** The sanitized `<server>_` prefix every permission key of the server's tools starts with. */
+function opencodeMcpServerKeyPrefix(serverName) {
+	return `${sanitizeOpencodeMcpNamePart(serverName)}_`;
+}
+/**
+* Whether `key` is exactly the sanitized `<server>_` prefix of one of
+* `serverNames` (e.g. `a_b_` for server `a.b` or `a_b`). No tool has an empty
+* name, so such a key filters nothing of that server, and
+* {@link findOpencodeMcpToolKeyOwner} gives it no owner. Read as an unlisted
+* server's filter instead, it would be split at the first `_` into a phantom
+* server (`a` with tool `b_`), so importers leave it out of the rulesync
+* config, and the OpenCode family's generate keeps it in the file as it was.
+*/
+function isBareOpencodeMcpServerPrefix({ key, serverNames }) {
+	return serverNames.some((serverName) => key === opencodeMcpServerKeyPrefix(serverName));
 }
 /**
 * The server among `serverNames` whose tool a permission key names, with the
@@ -41845,7 +42043,7 @@ function findOpencodeMcpToolKeyOwner({ key, serverNames, builtinKeys, acceptRawP
 	if (builtinKeys.has(key)) return;
 	let owner;
 	for (const serverName of serverNames) {
-		const sanitized = `${sanitizeOpencodeMcpNamePart(serverName)}_`;
+		const sanitized = opencodeMcpServerKeyPrefix(serverName);
 		const prefixes = acceptRawPrefix ? (0, es_toolkit.uniq)([sanitized, `${serverName}_`]) : [sanitized];
 		for (const prefix of prefixes) if (key.length > prefix.length && key.startsWith(prefix) && (owner === void 0 || prefix.length > owner.prefix.length)) owner = {
 			serverName,
@@ -42306,7 +42504,10 @@ function convertFromKiloFormat(kiloMcp, tools, permission) {
 	const serverNames = Object.keys(kiloMcp);
 	return {
 		...Object.fromEntries(Object.entries(kiloMcp).map(([serverName, serverConfig]) => [serverName, kiloServerToRulesync(serverName, serverConfig, splitKiloServerTools(serverName, serverNames, filters))])),
-		...orphanMcpToolFiltersToRulesync(kiloMcp, tools)
+		...orphanMcpToolFiltersToRulesync(kiloMcp, Object.fromEntries(Object.entries(tools ?? {}).filter(([key]) => !findKiloMcpToolKeyOwner(key, serverNames) && !isBareOpencodeMcpServerPrefix({
+			key,
+			serverNames
+		}))))
 	};
 }
 /**
@@ -42824,16 +43025,20 @@ function convertFromOpencodeFormat(opencodeMcp, tools, remoteType) {
 		...orphanMcpToolFiltersToRulesync(opencodeMcp, Object.fromEntries(Object.entries(tools ?? {}).filter(([key]) => !findOpencodeToolOwner({
 			key,
 			serverNames
+		}) && !isBareOpencodeMcpServerPrefix({
+			key,
+			serverNames
 		})))),
 		...convertOpencodeServers(opencodeMcp, tools, remoteType)
 	};
 }
+const OPENCODE_MCP_BUILTIN_TOOL_KEYS = /* @__PURE__ */ new Set();
 /** Recognize both OpenCode's sanitized names and keys older rulesync versions wrote. */
 function findOpencodeToolOwner({ key, serverNames }) {
 	return findOpencodeMcpToolKeyOwner({
 		key,
 		serverNames,
-		builtinKeys: /* @__PURE__ */ new Set(),
+		builtinKeys: OPENCODE_MCP_BUILTIN_TOOL_KEYS,
 		acceptRawPrefix: true
 	});
 }
@@ -43003,6 +43208,40 @@ function convertToOpencodeFormat(mcpServers, existingMcp, configShape, logger) {
 		tools
 	};
 }
+/**
+* Copy each key of `existingTools` that is a bare sanitized `<server>_` prefix
+* of one of `serverNames` into `tools`, unless a generated filter already
+* writes the same key or another listed server owns it (`a_b_` is tool `b_` of
+* server `a` when `a` is listed too). An owned key is the rulesync config's to
+* write, so carrying it over would keep a filter the user removed. Mutates
+* `tools` in place.
+*/
+function preserveBareOpencodeMcpServerPrefixKeys({ tools, existingTools, serverNames }) {
+	for (const [key, enabled] of Object.entries(existingTools ?? {})) if (!Object.hasOwn(tools, key) && isBareOpencodeMcpServerPrefix({
+		key,
+		serverNames
+	}) && !findOpencodeToolOwner({
+		key,
+		serverNames
+	})) tools[key] = enabled;
+}
+/**
+* When the existing file does not pass the schema, its `tools` map cannot be
+* read, so a bare `<server>_` key in it is not carried over. Say so rather
+* than lift the deny it may hold without a word.
+*/
+function warnAboutUnreadableBareOpencodeMcpServerPrefixKeys({ existingJson, serverNames, logger }) {
+	const rawTools = isRecord(existingJson) ? existingJson.tools : void 0;
+	if (!isRecord(rawTools)) return;
+	const bareKeys = Object.keys(rawTools).filter((key) => isBareOpencodeMcpServerPrefix({
+		key,
+		serverNames
+	}) && !findOpencodeToolOwner({
+		key,
+		serverNames
+	}));
+	if (bareKeys.length > 0) logger?.warn(`OpenCode MCP: the existing config does not match the expected schema, so the bare server-prefix tool ${bareKeys.length === 1 ? "key" : "keys"} ${bareKeys.map(quoteValueForWarning).join(", ")} ${bareKeys.length === 1 ? "is" : "are"} not kept in "tools".`);
+}
 const OpencodeMcpFeatureOptionsSchema = zod_mini.z.looseObject({ configShape: zod_mini.z.optional(zod_mini.z.enum(["v1", "v2"])) });
 var OpencodeMcp = class extends ToolMcp {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
@@ -43135,6 +43374,16 @@ var OpencodeMcp = class extends ToolMcp {
 			convertedMcp,
 			mcpServers: transformedServers
 		});
+		if (existingMcp.success) preserveBareOpencodeMcpServerPrefixKeys({
+			tools: mcpTools,
+			existingTools: existingMcp.data.tools,
+			serverNames: Object.keys(transformedServers)
+		});
+		else warnAboutUnreadableBareOpencodeMcpServerPrefixKeys({
+			existingJson: this.lowerConfig(existingJson),
+			serverNames: Object.keys(transformedServers),
+			logger
+		});
 		if (this.layout.configVersion === "v2") warnAboutOpencodeV2SseServers({
 			mcpServers: transformedServers,
 			convertedMcp,
@@ -47373,6 +47622,45 @@ var DshRule = class DshRule extends NestedAgentsmdRule {
 		};
 	}
 };
+// src/features/rules/output-style-paths.ts
+/**
+* Shared helpers for tool rule adapters that write opted-in rules as custom
+* output styles (`<tool dir>/output-styles/<name>.md`), e.g. Qoder and
+* Factory Droid. Both tools read only the direct `.md` children of their
+* output-styles directory, with optional `name` / `description` frontmatter.
+*/
+/**
+* Whether the given path is a direct `.md` child of `outputStylesDirPath`.
+*/
+function isDirectMarkdownChild({ outputStylesDirPath, relativeDirPath, relativeFilePath }) {
+	return relativeDirPath === outputStylesDirPath && (0, node_path.extname)(relativeFilePath) === ".md" && (0, node_path.basename)(relativeFilePath) === relativeFilePath;
+}
+/**
+* Whether a rule opts into the `output-style` channel: only a non-root rule
+* can, since an output style is a file of its own.
+*/
+function isOutputStyleChannel({ root, channel }) {
+	return !root && channel === "output-style";
+}
+/**
+* Return the file stem of an output-style source rule, throwing `message`
+* when the rule is nested in a subdirectory of the rules directory: the
+* output file is named after the rule, and the tools read only the top level
+* of their output-styles directory.
+*/
+function resolveTopLevelOutputStyleStem({ sourcePath, message }) {
+	if ((0, node_path.basename)(sourcePath) !== sourcePath) throw new Error(message);
+	return (0, node_path.basename)(sourcePath, (0, node_path.extname)(sourcePath));
+}
+/**
+* The output style's frontmatter: only the `name` and `description` that are set.
+*/
+function buildOutputStyleFrontmatter({ name, description }) {
+	return {
+		...name !== void 0 && { name },
+		...description !== void 0 && { description }
+	};
+}
 // src/features/rules/factorydroid-rule.ts
 /**
 * The file-name glob `getExtraFixedFiles` returns for the output-styles
@@ -47477,7 +47765,11 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	* child of the output-styles directory, at either scope.
 	*/
 	static isOutputStylePath({ relativeDirPath, relativeFilePath }) {
-		return relativeDirPath === this.getOutputStylesDirPath() && (0, node_path.extname)(relativeFilePath) === ".md" && (0, node_path.basename)(relativeFilePath) === relativeFilePath;
+		return isDirectMarkdownChild({
+			outputStylesDirPath: this.getOutputStylesDirPath(),
+			relativeDirPath,
+			relativeFilePath
+		});
 	}
 	/**
 	* Which fixed-file channel, if any, owns the given output path. Matching on
@@ -47517,7 +47809,10 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	/** Whether a rule opts into the `output-style` channel (non-root only). */
 	static isOutputStyleRule(rulesyncRule) {
 		const frontmatter = rulesyncRule.getFrontmatter();
-		return !frontmatter.root && frontmatter.factorydroid?.channel === "output-style";
+		return isOutputStyleChannel({
+			root: frontmatter.root,
+			channel: frontmatter.factorydroid?.channel
+		});
 	}
 	/**
 	* Factory Droid loads the channel files itself, so listing one in the root
@@ -47649,15 +47944,17 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	static buildOutputStyle({ outputRoot, rulesyncRule, validate }) {
 		const frontmatter = rulesyncRule.getFrontmatter();
 		const sourcePath = rulesyncRule.getRelativeFilePath();
-		if ((0, node_path.basename)(sourcePath) !== sourcePath) throw new Error(`Rule '${sourcePath}' sets factorydroid.channel: output-style but is nested in a subdirectory: Factory Droid loads only direct .md children of .factory/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
-		const stem = (0, node_path.basename)(sourcePath, (0, node_path.extname)(sourcePath));
+		const stem = resolveTopLevelOutputStyleStem({
+			sourcePath,
+			message: `Rule '${sourcePath}' sets factorydroid.channel: output-style but is nested in a subdirectory: Factory Droid loads only direct .md children of .factory/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`
+		});
 		const name = frontmatter.factorydroid?.name;
 		const styleName = name ?? stem;
 		if (FACTORYDROID_RESERVED_OUTPUT_STYLE_NAMES.includes(styleName.trim().toLowerCase())) throw new Error(`Rule '${sourcePath}' sets factorydroid.channel: output-style with the style name '${styleName}', which is reserved: Factory Droid's built-in Default and Concise styles cannot be replaced. Rename the rule file or set factorydroid.name.`);
-		const styleFrontmatter = {
-			...name !== void 0 && { name },
-			...frontmatter.description !== void 0 && { description: frontmatter.description }
-		};
+		const styleFrontmatter = buildOutputStyleFrontmatter({
+			name,
+			description: frontmatter.description
+		});
 		const body = rulesyncRule.getBody();
 		return new FactorydroidRule({
 			outputRoot,
@@ -49293,12 +49590,19 @@ var QoderRule = class QoderRule extends ToolRule {
 	* `.qoder/output-styles/`, at either scope.
 	*/
 	static isOutputStylePath({ relativeDirPath, relativeFilePath }) {
-		return relativeDirPath === QODER_OUTPUT_STYLES_DIR_PATH && (0, node_path.extname)(relativeFilePath) === ".md" && (0, node_path.basename)(relativeFilePath) === relativeFilePath;
+		return isDirectMarkdownChild({
+			outputStylesDirPath: QODER_OUTPUT_STYLES_DIR_PATH,
+			relativeDirPath,
+			relativeFilePath
+		});
 	}
 	/** Whether a rule opts into the `output-style` channel (non-root only). */
 	static isOutputStyleRule(rulesyncRule) {
 		const frontmatter = rulesyncRule.getFrontmatter();
-		return !frontmatter.root && frontmatter.qoder?.channel === "output-style";
+		return isOutputStyleChannel({
+			root: frontmatter.root,
+			channel: frontmatter.qoder?.channel
+		});
 	}
 	/**
 	* The output-styles directory, enumerated for import only: it also holds
@@ -49409,16 +49713,18 @@ var QoderRule = class QoderRule extends ToolRule {
 	static buildOutputStyle({ outputRoot, rulesyncRule, validate }) {
 		const { description, qoder } = rulesyncRule.getFrontmatter();
 		const sourcePath = rulesyncRule.getRelativeFilePath();
-		if ((0, node_path.basename)(sourcePath) !== sourcePath) throw new Error(`Rule '${sourcePath}' sets qoder.channel: output-style but is nested in a subdirectory: Qoder reads only the files directly in .qoder/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
-		const name = qoder?.name;
+		const stem = resolveTopLevelOutputStyleStem({
+			sourcePath,
+			message: `Rule '${sourcePath}' sets qoder.channel: output-style but is nested in a subdirectory: Qoder reads only the files directly in .qoder/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`
+		});
 		return new QoderRule({
 			outputRoot,
 			relativeDirPath: QODER_OUTPUT_STYLES_DIR_PATH,
-			relativeFilePath: `${(0, node_path.basename)(sourcePath, (0, node_path.extname)(sourcePath))}.md`,
-			frontmatter: {
-				...name !== void 0 && { name },
-				...description !== void 0 && { description }
-			},
+			relativeFilePath: `${stem}.md`,
+			frontmatter: buildOutputStyleFrontmatter({
+				name: qoder?.name,
+				description
+			}),
 			body: rulesyncRule.getBody(),
 			validate,
 			root: false,
@@ -51689,6 +51995,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			factory
 		});
 		await this.warnForWarpLegacyRootFile(toolRules);
+		this.warnForAugmentcodePluginRules(toolRules);
 		await this.warnForInstructionBudget({
 			toolRules,
 			meta
@@ -52080,6 +52387,20 @@ var RulesProcessor = class extends FeatureProcessor {
 		this.logger.warn(`Writing ${stripControlCharacters(rootFileRelativePath)} for ${this.toolTarget} means ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} will no longer be read. Run \`rulesync import --targets ${this.toolTarget}\` first to carry that content into ${RULESYNC_RULES_RELATIVE_DIR_PATH}, or delete ${listedNames.length === 1 ? "it" : "them"} once you have checked the content is already in the root file.`);
 	}
 	/**
+	* Auggie 1.x (still a prerelease on npm at the time of writing; the stable
+	* line is 0.36.0) no longer loads `rules/` from plugins: "Rules shipped in
+	* plugins (`rules/` in a plugin)" is listed among the removed features, while
+	* commands, agents, skills, hooks and MCP servers still load. The rule files
+	* are still written, because the stable 0.x CLI reads them, but under 1.x the
+	* bundle silently loses them, so say so.
+	* @see https://docs.augmentcode.com/cli/whats-new
+	* @see https://docs.augmentcode.com/cli/v0/plugins
+	*/
+	warnForAugmentcodePluginRules(toolRules) {
+		if (this.toolTarget !== "augmentcode-plugin" || toolRules.length === 0) return;
+		this.logger.warn(`augmentcode-plugin: plugin rules (rules/*.md) are loaded by Auggie 0.x only; Auggie 1.x no longer reads rules/ from plugins, so these ${toolRules.length} rule file(s) have no effect there. Ship instructions that must reach Auggie 1.x users as a skill, or have them generate the augmentcode target in their project.`);
+	}
+	/**
 	* Warp still reads a legacy `WARP.md`, and when both `WARP.md` and
 	* `AGENTS.md` sit in the same directory, `WARP.md` takes priority — so an
 	* `AGENTS.md` this run writes next to one would never be read. That holds for
@@ -56081,9 +56402,9 @@ function groupDefinitionsByMatcher({ definitions, eventName, converterConfig, wa
 			});
 			translatedMatchers.set(normalizedMatcher, matcher);
 		}
-		const key = [matcher, ...subdividingFields.map(({ canonical, valueType }) => {
+		const key = [matcher, ...subdividingFields.map(({ canonical, valueType, events }) => {
 			const value = def[canonical];
-			return isGroupPassthroughValue(value, valueType) ? stableJson(value) : "";
+			return isGroupFieldOnEvent(events, eventName) && isGroupPassthroughValue(value, valueType) ? stableJson(value) : "";
 		})].join("\0");
 		const group = byMatcher.get(key);
 		if (group) group.defs.push(def);
@@ -56124,6 +56445,7 @@ function runsInPosixShell({ shell, converterConfig }) {
 * Apply the optional project directory variable prefix to a command string.
 */
 function applyCommandPrefix({ def, converterConfig }) {
+	if (converterConfig.stripsProjectDirVarOnImportOnly) return def.command;
 	const commandText = def.command;
 	const trimmedCommand = typeof commandText === "string" ? commandText.trimStart() : void 0;
 	const unquotedCommand = trimmedCommand?.replace(/^["']/, "");
@@ -56332,12 +56654,16 @@ const describeInvalidObject = ({ tool, canonical, value }) => isPlainObject(valu
 	value
 })} Importing it would fail validation on the next run.` : `Dropping "${tool}" while importing a hook: it must be an object.`;
 const describeInvalidRecord = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a map of strings whose keys are non-empty and free of "=", and whose keys and values carry no newline, carriage return or NUL characters.`;
+function isGroupFieldOnEvent(events, eventName) {
+	return events === void 0 || events.has(eventName);
+}
 /**
 * Check a value against the shape its field documents. A string field also
 * rejects control characters, matching the canonical `safeString` so an
 * imported value cannot fail validation on the next generate.
 */
 function isGroupPassthroughValue(value, valueType = "object") {
+	if (valueType === "number") return typeof value === "number" && Number.isFinite(value);
 	if (valueType === "string") return typeof value === "string" && !CONTROL_CHARS.some((char) => value.includes(char));
 	return isPlainObject(value);
 }
@@ -56347,10 +56673,14 @@ function isGroupPassthroughValue(value, valueType = "object") {
 */
 function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }) {
 	const emitted = {};
-	for (const { canonical, tool, valueType } of converterConfig.groupPassthroughFields ?? []) {
+	for (const { canonical, tool, valueType, events } of converterConfig.groupPassthroughFields ?? []) {
 		const carried = defs.map((def) => def[canonical]);
 		const first = carried.find((value) => isGroupPassthroughValue(value, valueType));
 		if (first === void 0) continue;
+		if (!isGroupFieldOnEvent(events, eventName)) {
+			logger?.warn(`"${canonical}" on "${eventName}" hooks is ignored — the tool supports "${tool}" only on ${[...events ?? []].map((event) => `"${event}"`).join(", ")} hooks.`);
+			continue;
+		}
 		const firstStable = stableJson(first);
 		const agrees = (value) => isGroupPassthroughValue(value, valueType) && stableJson(value) === firstStable;
 		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${quoteValueForWarning(first)} — including any that asked for something else, or for nothing.`);
@@ -56362,9 +56692,9 @@ function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }
 * Import the configured group-level passthrough fields onto a definition,
 * reversing {@link emitGroupPassthroughFields}.
 */
-function importGroupPassthroughFields({ rawEntry, converterConfig }) {
+function importGroupPassthroughFields({ rawEntry, eventName, converterConfig }) {
 	const entry = rawEntry;
-	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool, valueType }) => isGroupPassthroughValue(entry[tool], valueType)).map(({ canonical, tool }) => [canonical, entry[tool]]));
+	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool, valueType, events }) => isGroupFieldOnEvent(events, eventName) && isGroupPassthroughValue(entry[tool], valueType)).map(({ canonical, tool }) => [canonical, entry[tool]]));
 }
 /**
 * Emit the payload fields specific to a hook type — `url`/`headers`/
@@ -56690,19 +57020,23 @@ function stripCommandPrefix({ command, args, shell, converterConfig, warn }) {
 	const cmd = typeof command === "string" ? command : void 0;
 	const { projectDirVar } = converterConfig;
 	if (projectDirVar === "" || typeof cmd !== "string") return cmd;
-	const { command: stripped, unrestored, retained } = importProjectDirVariable({
-		command: cmd,
-		projectDirVar,
-		firstWordOnly: isExecFormHook({
-			args,
-			converterConfig
-		}) || !runsInPosixShell({
-			shell,
-			converterConfig
-		})
-	});
-	if (warn && unrestored) warn(`Hook command ${quoteValueForWarning(cmd)} was imported as ${quoteValueForWarning(stripped)}: a ${projectDirVar} path that is not a script the command runs becomes relative to the hook's working directory and is not restored on generate. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") to keep the variable.`);
-	if (warn && retained) warn(`Hook command ${quoteValueForWarning(cmd)} keeps ${projectDirVar} in an assignment or option value, or in a later word of a command whose later words are not normalized, so the imported command still refers to it and other tools that do not define it receive it verbatim. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") if other tools should not see it.`);
+	let stripped = cmd;
+	for (const variable of [projectDirVar, ...converterConfig.importedProjectDirVarAliases ?? []]) {
+		const result = importProjectDirVariable({
+			command: stripped,
+			projectDirVar: variable,
+			firstWordOnly: isExecFormHook({
+				args,
+				converterConfig
+			}) || !runsInPosixShell({
+				shell,
+				converterConfig
+			})
+		});
+		stripped = result.command;
+		if (warn && result.unrestored && !converterConfig.stripsProjectDirVarOnImportOnly) warn(`Hook command ${quoteValueForWarning(cmd)} was imported as ${quoteValueForWarning(stripped)}: a ${variable} path that is not a script the command runs becomes relative to the hook's working directory and is not restored on generate. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") to keep the variable.`);
+		if (warn && result.retained) warn(`Hook command ${quoteValueForWarning(cmd)} keeps ${variable} in an assignment or option value, or in a later word of a command whose later words are not normalized, so the imported command still refers to it and other tools that do not define it receive it verbatim. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") if other tools should not see it.`);
+	}
 	return stripped;
 }
 /**
@@ -56743,7 +57077,7 @@ function isStringRecord(value) {
 }
 /** Compare object values without letting key order decide the answer. */
 function stableJson(value) {
-	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value !== "object") return JSON.stringify(value);
 	return JSON.stringify(Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a.localeCompare(b))));
 }
 /**
@@ -56983,6 +57317,7 @@ function toolHookToCanonical({ h, rawEntry, eventName, converterConfig, warn })
 		}),
 		...importGroupPassthroughFields({
 			rawEntry,
+			eventName,
 			converterConfig
 		}),
 		...matcher !== void 0 && matcher !== null && matcher !== "" && { matcher }
@@ -57035,15 +57370,26 @@ function definingFields({ h, rawEntry, hookType, converterConfig }) {
 * is the group-level twin of `matcher`: importing the group without it would
 * widen every hook in it, so the group is skipped instead.
 */
-function describeGroupSkipReason({ rawEntry, converterConfig }) {
+function describeGroupSkipReason({ rawEntry, eventName, converterConfig }) {
 	const entry = rawEntry;
-	for (const { tool, valueType, subdividesGroup } of converterConfig.groupPassthroughFields ?? []) {
+	for (const { tool, valueType, subdividesGroup, events, onInvalidImport } of converterConfig.groupPassthroughFields ?? []) {
 		const value = entry[tool];
-		if (subdividesGroup !== true || value === void 0) continue;
+		if (subdividesGroup !== true || onInvalidImport === "drop-field" || value === void 0 || !isGroupFieldOnEvent(events, eventName)) continue;
 		if (!isGroupPassthroughValue(value, valueType)) return `Skipping the hooks of a matcher group while importing: its "${tool}" (${quoteValueForWarning(value)}) is unusable, and these hooks run only where it matches. Importing them without it would widen when they fire, so they are skipped.`;
 	}
 }
 /**
+* Warn about each `"drop-field"` group value that is present but unusable;
+* {@link importGroupPassthroughFields} leaves it off the imported hooks.
+*/
+function warnDroppedGroupFields({ rawEntry, eventName, converterConfig, warn }) {
+	const entry = rawEntry;
+	for (const { tool, valueType, events, onInvalidImport } of converterConfig.groupPassthroughFields ?? []) {
+		const value = entry[tool];
+		if (onInvalidImport === "drop-field" && value !== void 0 && isGroupFieldOnEvent(events, eventName) && !isGroupPassthroughValue(value, valueType)) warn?.(`Dropping the unusable "${tool}" (${quoteValueForWarning(value)}) of a "${eventName}" matcher group while importing; its hooks are imported without it.`);
+	}
+}
+/**
 * Why this hook cannot be imported, or `undefined` when it can.
 */
 function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
@@ -57070,12 +57416,19 @@ function toolMatcherEntryToCanonical({ rawEntry, eventName, converterConfig, war
 	const hookDefs = rawEntry.hooks ?? [];
 	const groupSkipReason = describeGroupSkipReason({
 		rawEntry,
+		eventName,
 		converterConfig
 	});
 	if (groupSkipReason !== void 0) {
 		warn?.(groupSkipReason);
 		return [];
 	}
+	warnDroppedGroupFields({
+		rawEntry,
+		eventName,
+		converterConfig,
+		warn
+	});
 	const definitions = [];
 	for (const h of hookDefs) {
 		const skipReason = describeHookSkipReason({
@@ -60414,6 +60767,23 @@ var CopilotcliHooks = class CopilotcliHooks extends ToolHooks {
 		});
 	}
 };
+// src/features/hooks/hook-matcher-tool-names.ts
+const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
+function isMatcherName(token) {
+	return !token.startsWith("\\") && !token.startsWith("[");
+}
+/**
+* Rewrites the whole tool names inside a hook `matcher` regex through `names`,
+* leaving escapes, character classes and unknown names as written. Used by
+* adapters whose runtime tool names differ from the canonical (Claude Code)
+* spelling.
+*/
+function replaceMatcherNames(matcher, names) {
+	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
+}
+function invertToolNames(names) {
+	return Object.fromEntries(Object.entries(names).map(([canonical, tool]) => [tool, canonical]));
+}
 // src/features/hooks/cortexcode-hooks.ts
 const CORTEXCODE_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]);
 const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
@@ -60424,14 +60794,7 @@ const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
 	Grep: "grep",
 	Glob: "glob"
 };
-const CORTEXCODE_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CORTEXCODE_TOOL_NAMES).map(([canonical, tool]) => [tool, canonical]));
-const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
-function isMatcherName(token) {
-	return !token.startsWith("\\") && !token.startsWith("[");
-}
-function replaceMatcherNames(matcher, names) {
-	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
-}
+const CORTEXCODE_TO_CANONICAL_TOOL_NAMES = invertToolNames(CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
 function canonicalToCortexcodeMatcher({ matcher, eventName, warn }) {
 	const translated = replaceMatcherNames(matcher, CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
 	const unmatched = [...translated.matchAll(MATCHER_TOKEN_PATTERN)].map(([token]) => token).filter((token) => isMatcherName(token) && /^[A-Z]/.test(token));
@@ -65592,6 +65955,61 @@ var TabnineHooks = class TabnineHooks extends ToolHooks {
 		});
 	}
 };
+// src/features/hooks/trae-hooks.ts
+const TRAE_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"sessionStart",
+	"beforeSubmitPrompt",
+	"stop"
+]);
+const CANONICAL_TO_TRAE_TOOL_NAMES = { Bash: "RunCommand" };
+const TRAE_TO_CANONICAL_TOOL_NAMES = invertToolNames(CANONICAL_TO_TRAE_TOOL_NAMES);
+const TRAE_SPEC = {
+	displayName: "TRAE",
+	overrideKey: "trae",
+	converterConfig: {
+		supportedEvents: TRAE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_TRAE_EVENT_NAMES,
+		toolToCanonicalEventNames: TRAE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$TRAE_PROJECT_DIR",
+		stripsProjectDirVarOnImportOnly: true,
+		importedProjectDirVarAliases: ["$CLAUDE_PROJECT_DIR"],
+		noMatcherEvents: TRAE_NO_MATCHER_EVENTS,
+		supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+		groupPassthroughFields: [{
+			canonical: "loop_limit",
+			tool: "loop_limit",
+			valueType: "number",
+			events: /* @__PURE__ */ new Set(["stop"]),
+			subdividesGroup: true,
+			onInvalidImport: "drop-field"
+		}],
+		matcherTranslation: {
+			toTool: ({ matcher }) => replaceMatcherNames(matcher, CANONICAL_TO_TRAE_TOOL_NAMES),
+			toCanonical: (matcher) => replaceMatcherNames(matcher, TRAE_TO_CANONICAL_TOOL_NAMES)
+		}
+	}
+};
+/**
+* TRAE hooks.
+*
+* Hooks live under the top-level `hooks` key of the dedicated `.trae/hooks.json`
+* (project) and `~/.trae/hooks.json` (user scope). The IDE also writes a
+* `version` key there, so generation merges the `hooks` key into the file (see
+* `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
+*
+* @see https://docs.trae.ai/ide/hook-configuration-reference?_lang=en
+*/
+var TraeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return TRAE_SPEC;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: TRAE_DIR,
+			relativeFilePath: TRAE_HOOKS_FILE_NAME
+		};
+	}
+};
 // src/features/hooks/vibe-hooks.ts
 const VIBE_DIR = ".vibe";
 const VIBE_HOOKS_FILE_NAME = "hooks.toml";
@@ -66776,6 +67194,21 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command"],
 		supportsMatcher: true
 	}],
+	["trae", {
+		class: TraeHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		...converterCapabilities(TraeHooks.getConverterConfig()),
+		supportsMatcher: true,
+		matcherEvents: [
+			"preToolUse",
+			"postToolUse",
+			"notification"
+		]
+	}],
 	["vibe", {
 		class: VibeHooks,
 		meta: {
@@ -68884,69 +69317,6 @@ var AiassistantMcp = class extends ToolMcp {
 		});
 	}
 };
-// src/features/shared/amp-settings.ts
-/**
-* Parse an Amp `settings.json` / `settings.jsonc` document.
-*
-* Shared by the MCP and permissions adapters because both read the very same
-* file. Two separately maintained copies drifted once already: the permissions
-* side was hardened while the MCP side kept calling `jsonc-parser` directly,
-* which left it importing MCP servers reachable only through an injected
-* `__proto__`.
-*
-* {@link parseJsonc} is the strict, sanitizing parser: it throws on any syntax
-* error instead of returning `jsonc-parser`'s best-effort value, and it
-* rebuilds every object from its own enumerable entries, so a root `__proto__`
-* cannot swap the returned object's prototype and `constructor` / `prototype`
-* never survive as own keys, at any depth.
-*
-* Removal is silent, matching every other tool-side adapter (opencode, kilo,
-* copilot). Reporting the removed keys through `droppedPollutionKeysError` is
-* reserved for the three files a user authors under `.rulesync/`, whose whole
-* purpose is to be turned into tool config — a key that vanishes there needs
-* explaining, whereas here the surrounding settings are the user's own file
-* and are left alone.
-*
-* Note the consequence for a root `__proto__`: sanitizing runs before the
-* plain-object check, so such a document parses successfully with the key
-* stripped rather than failing that check. That is deliberate — dropping the
-* one poisoned key keeps the user's unrelated settings — and matches the
-* sanitize-before-the-root-check design the shared config gateway documents.
-*/
-function parseAmpSettings({ fileContent }) {
-	let parsed;
-	try {
-		parsed = parseJsonc$6(fileContent || "{}");
-	} catch (error) {
-		throw new Error(`Failed to parse Amp settings: ${formatError(error)}`, { cause: error });
-	}
-	if (!isPlainObject(parsed)) throw new Error("Amp settings must be a JSON object");
-	return parsed;
-}
-/**
-* Probe `<jsonDir>/settings.jsonc` first, falling back to `settings.json`, so
-* an existing user file is read-modified-written in place instead of a fresh
-* `.json` sibling being created next to a hand-authored `.jsonc`. Defaults to
-* `settings.json` when neither file exists: Amp's canonically documented
-* settings file (`.amp/settings.json`), shared by the MCP and permissions
-* adapters, so generating both on a clean repo writes a single settings file.
-*/
-async function resolveAmpSettingsFile(jsonDir) {
-	const jsoncContent = await readFileContentOrNull((0, node_path.join)(jsonDir, AMP_SETTINGS_JSONC_FILE_NAME));
-	if (jsoncContent !== null) return {
-		fileContent: jsoncContent,
-		relativeFilePath: AMP_SETTINGS_JSONC_FILE_NAME
-	};
-	const jsonContent = await readFileContentOrNull((0, node_path.join)(jsonDir, AMP_SETTINGS_FILE_NAME));
-	if (jsonContent !== null) return {
-		fileContent: jsonContent,
-		relativeFilePath: AMP_SETTINGS_FILE_NAME
-	};
-	return {
-		fileContent: null,
-		relativeFilePath: AMP_SETTINGS_FILE_NAME
-	};
-}
 // src/features/mcp/amp-mcp.ts
 const AMP_MCP_SERVERS_KEY = "amp.mcpServers";
 function filterMcpServers(mcpServers) {
@@ -71932,7 +72302,7 @@ var CopilotMcp = class CopilotMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { servers: convertToCopilotFormat(mcpServers) },
+				patch: { servers: undefinedWhenEmpty(convertToCopilotFormat(mcpServers)) },
 				filePath,
 				logger
 			}),
@@ -74253,14 +74623,20 @@ function resolveGooseUrl(config) {
 }
 /**
 * Determines the Goose `type` for a server based on its command/url/transport.
+*
+* Goose no longer has an SSE extension type (it skips a `type: sse` entry as
+* unsupported), so every remote server is written as `streamable_http`.
 */
 function resolveGooseType(config, url) {
 	if (config.command !== void 0) return "stdio";
-	if (url !== void 0) return canonicalTransport(config) === "sse" ? "sse" : "streamable_http";
+	if (url !== void 0) return "streamable_http";
 	return canonicalTransport(config) === "builtin" ? "builtin" : "stdio";
 }
 /**
-* The Goose extension types that carry an MCP server. Goose also documents
+* The Goose extension types that carry an MCP server. `sse` is no longer one
+* Goose reads, but it stays here so a stale `type: sse` entry is still
+* recognized: imported as canonical `sse` and replaced by the regenerated
+* same-name `streamable_http` entry. Goose also documents
 * `builtin`, `platform`, `frontend` and `inline_python` extensions, which have
 * no canonical MCP counterpart: they name capabilities Goose provides itself
 * rather than a server rulesync could describe.
@@ -74320,7 +74696,8 @@ function convertServerToGooseExtension(name, config, logger) {
 			warnWithFallback(logger, `Goose extension "${name}" has no command to run; skipping it rather than writing a stdio extension Goose cannot start to ~/.config/goose/config.yaml.`);
 			return;
 		}
-	} else if (gooseType === "sse" || gooseType === "streamable_http") {
+	} else if (gooseType === "streamable_http") {
+		if (canonicalTransport(config) === "sse") warnWithFallback(logger, `Goose extension "${name}" uses SSE, which Goose no longer supports; writing it as streamable_http, which only works if the server also speaks Streamable HTTP.`);
 		if (url !== void 0) ext.uri = url;
 		if (isPlainObject(config.headers)) ext.headers = omitPrototypePollutionKeys(config.headers);
 	}
@@ -74333,8 +74710,9 @@ function convertServerToGooseExtension(name, config, logger) {
 * Converts rulesync canonical MCP servers into Goose `extensions:` entries.
 *
 * Goose uses a non-standard schema: `name`, `type` (`stdio` | `streamable_http`
-* | `sse` | `builtin`), `cmd`/`args`/`envs` for stdio, `uri`/`headers` for
-* remote, plus `enabled` and `timeout`.
+* | `builtin`), `cmd`/`args`/`envs` for stdio, `uri`/`headers` for remote, plus
+* `enabled` and `timeout`. A canonical `sse` server is written as
+* `streamable_http` with a warning, since Goose dropped SSE support.
 *
 * `extensions:` is co-owned: alongside the MCP servers rulesync manages it also
 * holds Goose's own `builtin`/`platform`/`frontend`/`inline_python` extensions
@@ -74465,7 +74843,8 @@ function convertToGoosePluginMcpServers(mcpServers, logger) {
 *   `~/.config/goose/config.yaml`. That file also holds other Goose settings
 *   (model, provider, ...), so generation merges the `extensions:` block into the
 *   existing config instead of overwriting it, and the file is never deleted.
-*   This location supports both stdio and remote (http/sse) servers.
+*   This location supports both stdio and remote servers (SSE is written as
+*   `streamable_http`, since Goose no longer reads `type: sse`).
 * - **Project**: a stdio-only open-plugin manifest at
 *   `.agents/plugins/rulesync/.mcp.json` (Goose v1.39.0+), reusing the same
 *   `.agents/plugins/rulesync/` tree as Goose hooks. The manifest uses the
@@ -79183,6 +79562,7 @@ var VibeMcp = class VibeMcp extends ToolMcp {
 		const managedNames = new Set(Object.keys(rulesyncServers));
 		const mcpServers = Object.entries(rulesyncServers).map(([name, server]) => rulesyncMcpServerToVibe(name, server, existingByName.get(name)));
 		const unmanagedServers = existingServers.filter((server) => !managedNames.has(server.name));
+		const servers = [...mcpServers, ...unmanagedServers];
 		return new VibeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -79191,7 +79571,7 @@ var VibeMcp = class VibeMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { mcp_servers: [...mcpServers, ...unmanagedServers] },
+				patch: { mcp_servers: servers.length > 0 ? servers : void 0 },
 				filePath
 			}),
 			validate,
@@ -82322,6 +82702,57 @@ function matchesGlobStep(step, character) {
 	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
 	return step.negated ? !admitted : admitted;
 }
+/**
+* Whether `value` matches `glob` in full, with `*`, `?` and `[...]` carrying
+* their usual meaning. The glob comes first, unlike Node's own
+* `path.matchesGlob(path, pattern)`.
+*
+* The glob is walked step by step rather than translated to a regex, because
+* both sides of a comparison can come from a file a repository carries: `*a*a*a*a*b`
+* translated to `^.*a.*a.*a.*a.*b$` takes minutes against a forty-character
+* name, while walking the steps is linear in the name per `*`. Remembering only
+* the most recent `*` to fall back to is enough — an earlier one can always give
+* up whatever the later one needed.
+*/
+function matchesGlob(glob, value) {
+	return compileGlob(glob)(value);
+}
+/**
+* Parse `glob` once and return a predicate that walks it, for a caller that
+* tests the same glob against a whole list of names.
+*/
+function compileGlob(glob) {
+	const steps = parseGlob(glob);
+	return (value) => matchesParsedGlob(steps, value);
+}
+function matchesParsedGlob(steps, value) {
+	const characters = [...value];
+	let stepIndex = 0;
+	let characterIndex = 0;
+	let starStepIndex = -1;
+	let starCharacterIndex = 0;
+	while (characterIndex < characters.length) {
+		const step = steps[stepIndex];
+		if (step?.kind === "star") {
+			starStepIndex = stepIndex;
+			starCharacterIndex = characterIndex;
+			stepIndex += 1;
+			continue;
+		}
+		if (step !== void 0 && matchesGlobStep(step, characters[characterIndex] ?? "")) {
+			stepIndex += 1;
+			characterIndex += 1;
+			continue;
+		}
+		if (starStepIndex < 0) return false;
+		starCharacterIndex += 1;
+		stepIndex = starStepIndex + 1;
+		characterIndex = starCharacterIndex;
+	}
+	let remaining = stepIndex;
+	while (steps[remaining]?.kind === "star") remaining += 1;
+	return remaining === steps.length;
+}
 /** Whether two single-character steps can both match one same character. */
 function stepsShareACharacter(left, right) {
 	if (left.kind === "any" || right.kind === "any") return true;
@@ -82564,6 +82995,20 @@ function isUnicodeClass(rest) {
 	}));
 }
 /**
+* Return a function that, for a `[:` at `index`, gives the position of the
+* next `:]` (Go reads everything between as the class name), or -1. The
+* position is cached and `index` only grows, so a long run of `[:` with no
+* `:]` costs linear time rather than a scan to the end at each one.
+*/
+function posixEndFinder(source) {
+	let next = -2;
+	return (index) => {
+		if (!source.startsWith("[:", index)) return -1;
+		if (next !== -1 && next < index + 2) next = source.indexOf(":]", index + 2);
+		return next;
+	};
+}
+/**
 * Replace each POSIX class (`[:alpha:]`) inside a bracket class with a plain
 * character, so JavaScript can compile the rest, or return `undefined` for an
 * unknown one. Only inside a bracket is `[:name:]` a POSIX class; a bare
@@ -82573,6 +83018,7 @@ function replacePosixClasses(source) {
 	let result = "";
 	let inClass = false;
 	let index = 0;
+	const findPosixEnd = posixEndFinder(source);
 	while (index < source.length) {
 		const character = source[index] ?? "";
 		if (character === "\\") {
@@ -82597,11 +83043,11 @@ function replacePosixClasses(source) {
 			}
 			continue;
 		}
-		const posix = /^\[:\^?([\s\S]*?):\]/.exec(source.slice(index));
-		if (posix !== null) {
-			if (!POSIX_CLASSES.has(posix[1] ?? "")) return;
+		const posixEnd = findPosixEnd(index);
+		if (posixEnd !== -1) {
+			if (!POSIX_CLASSES.has(source.slice(index + 2, posixEnd).replace(/^\^/, ""))) return;
 			result += "a";
-			index += posix[0].length;
+			index = posixEnd + 2;
 			continue;
 		}
 		if (character === "]") inClass = false;
@@ -82680,6 +83126,7 @@ function hasClassEscapeRangeEnd(source) {
 	let inClass = false;
 	let afterCharacter = false;
 	let index = 0;
+	const findPosixEnd = posixEndFinder(source);
 	while (index < source.length) {
 		const character = source[index] ?? "";
 		if (character === "\\") {
@@ -82695,7 +83142,7 @@ function hasClassEscapeRangeEnd(source) {
 			});
 			continue;
 		}
-		const posixEnd = source.startsWith("[:", index) ? source.indexOf(":]", index + 2) : -1;
+		const posixEnd = findPosixEnd(index);
 		if (character === "]" || posixEnd !== -1) {
 			inClass = character !== "]";
 			afterCharacter = false;
@@ -83257,6 +83704,8 @@ function buildToolPatternEntry({ toolName, pattern }) {
 * - `execute_url` takes a domain, like `read_url`.
 * - `command` and `unsandboxed` take literal words or a per-word `regex:`,
 *   matched word by word (see `antigravity-command-patterns.ts`).
+* - `mcp` takes `server/tool` or `server/*`, matched exactly. A canonical
+*   `mcp__<server>__<tool>` category is written as that target.
 *
 * A glob copied verbatim (`read_file(**\/*.env)`) is a literal path that
 * matches nothing, so a deny written that way blocks nothing. A pattern with
@@ -83280,7 +83729,8 @@ const DENY_HINTS = {
 	read_file: "deny a directory or file path instead",
 	write_file: "deny a directory or file path instead",
 	command: "deny the first words of the command instead",
-	unsandboxed: "deny the first words of the command instead"
+	unsandboxed: "deny the first words of the command instead",
+	mcp: "deny the whole MCP server or tool instead"
 };
 function hasGlob(pattern) {
 	return BRACE_ALTERNATIVES.test(pattern) || parseGlobPattern(pattern).steps.some((step) => step.kind !== "literal");
@@ -83336,6 +83786,40 @@ function toTarget(action, pattern) {
 	if (URL_ACTIONS.has(action)) return toUrlTarget(pattern);
 	return { target: pattern };
 }
+const MCP_CATEGORY_PREFIX = "mcp__";
+const MCP_TARGET_SEPARATORS = /[/()]/;
+/**
+* The `mcp` target of a canonical `mcp__<server>__<tool>` category:
+* `<server>/<tool>`, `<server>/*` for a whole server (`mcp__<server>`,
+* `mcp__<server>__*`), or `*` for every MCP tool (`mcp__*`, `mcp__*__*`). The
+* server ends at the first `__`, as elsewhere in rulesync. Antigravity matches
+* names exactly, so a glob, an empty name, or a `/` or parenthesis in a name
+* has no target; when only the tool part is at fault, its server is the `lead`
+* a deny widens to.
+*/
+function toMcpTarget(category) {
+	const remainder = category.slice(5);
+	const separator = remainder.indexOf("__");
+	const server = separator === -1 ? remainder : remainder.slice(0, separator);
+	const tool = separator === -1 ? "*" : remainder.slice(separator + 2);
+	if (server === "*" && tool === "*") return { target: "*" };
+	const skipReason = "Antigravity MCP targets name one server or one tool exactly. Only `mcp__<server>`, `mcp__<server>__*`, `mcp__<server>__<tool>` or `mcp__*` can be expressed";
+	if (server.length === 0 || MCP_TARGET_SEPARATORS.test(server) || hasGlob(server)) return { skipReason };
+	if (tool === "*") return { target: `${server}/*` };
+	return tool.length === 0 || MCP_TARGET_SEPARATORS.test(tool) || hasGlob(tool) ? {
+		skipReason,
+		lead: `${server}/*`
+	} : { target: `${server}/${tool}` };
+}
+/** The target of a canonical `mcp__...` rule, with the `lead` a deny widens to. */
+function toMcpRuleTarget(category, pattern) {
+	const target = toMcpTarget(category);
+	if (pattern === "*" || !("target" in target)) return target;
+	return {
+		skipReason: "Antigravity MCP targets name a server or a tool, not the tool's arguments",
+		lead: target.target
+	};
+}
 /**
 * The leading directories of a path glob (`src` for `src/*.ts`), or
 * `undefined` when it has none. A directory target covers everything inside
@@ -83358,6 +83842,20 @@ function toWidenedDenyTarget(action, pattern) {
 	if (ANTIGRAVITY_COMMAND_ACTIONS.has(action)) return toAntigravityCommandLiteralPrefix(pattern);
 	if (PATH_ACTIONS.has(action)) return toPathLiteralPrefix(pattern);
 }
+/** The entry a deny is widened to, and what it now blocks. */
+function describeWidenedDeny({ action, prefix, isMcp }) {
+	if (isMcp) return prefix === "*" ? {
+		entry: action,
+		scope: "every MCP tool"
+	} : {
+		entry: `${action}(${prefix})`,
+		scope: `every call of \`${action}(${prefix})\``
+	};
+	return {
+		entry: `${action}(${prefix})`,
+		scope: PATH_ACTIONS.has(action) ? `every path under \`${prefix}\`` : `every command that starts with \`${prefix}\``
+	};
+}
 /**
 * Warn about a path target that is a home or variable reference. Antigravity
 * documents absolute and workspace-relative paths only, so such a reference
@@ -83379,14 +83877,20 @@ function warnHomeOrVariablePath({ action, target, rule, decision, logger, toolLa
 * nothing enforces it, and a widened one is warned about too, because it
 * blocks more than it says.
 */
-function buildAntigravityPermissionEntry({ action, category, pattern, decision, logger, toolLabel }) {
-	const result = pattern === "*" ? { target: "*" } : toTarget(action, pattern);
+function buildAntigravityPermissionEntry({ action: toolAction, category, pattern, decision, logger, toolLabel }) {
+	const isMcp = category.startsWith(MCP_CATEGORY_PREFIX);
+	const action = isMcp ? "mcp" : toolAction;
+	const result = isMcp ? toMcpRuleTarget(category, pattern) : pattern === "*" ? { target: "*" } : toTarget(action, pattern);
 	const rule = `${category}: { "${pattern}": "${decision}" }`;
 	if ("skipReason" in result) {
-		const prefix = decision === "deny" ? toWidenedDenyTarget(action, pattern) : void 0;
+		const prefix = decision !== "deny" ? void 0 : isMcp ? result.lead : toWidenedDenyTarget(action, pattern);
 		if (prefix !== void 0) {
-			const scope = PATH_ACTIONS.has(action) ? `every path under \`${prefix}\`` : `every command that starts with \`${prefix}\``;
-			logger.warn(`${toolLabel} permissions: widening ${rule} to ${action}(${prefix}). ${result.skipReason}. The deny now blocks ${scope}, overriding any allow or ask for them.`);
+			const { entry, scope } = describeWidenedDeny({
+				action,
+				prefix,
+				isMcp
+			});
+			logger.warn(`${toolLabel} permissions: widening ${rule} to ${entry}. ${result.skipReason}. The deny now blocks ${scope}, overriding any allow or ask for them.`);
 			warnHomeOrVariablePath({
 				action,
 				target: prefix,
@@ -83395,7 +83899,7 @@ function buildAntigravityPermissionEntry({ action, category, pattern, decision,
 				logger,
 				toolLabel
 			});
-			return `${action}(${prefix})`;
+			return entry;
 		}
 		const consequence = decision === "deny" ? `This deny is NOT enforced in ${toolLabel}; ${DENY_HINTS[action] ?? "write it in a form Antigravity can match"}` : decision === "ask" ? `${toolLabel} falls back to its default for it, so it runs without a prompt when ${toolLabel} is set to always proceed` : `${toolLabel} falls back to its default for it`;
 		logger.warn(`${toolLabel} permissions: skipping ${rule}. ${result.skipReason}. ${consequence}.`);
@@ -83539,6 +84043,7 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 	mcp: "mcp"
 };
 function toAntigravityCliToolName(canonical) {
+	if (canonical.startsWith("mcp__")) return "mcp";
 	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
 }
 function toCanonicalToolName$9(cliName) {
@@ -83601,10 +84106,11 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			logger
 		});
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toAntigravityCliToolName(category)));
+		const isManagedToolName = (toolName) => managedToolNames.has(toolName) || managedToolNames.has("mcp") && toolName.startsWith("mcp__");
 		const existingPermissions = settings.permissions ?? {};
-		const preservedAllow = (existingPermissions.allow ?? []).filter((entry) => !managedToolNames.has(parseToolPatternEntry(entry).toolName));
-		const preservedAsk = (existingPermissions.ask ?? []).filter((entry) => !managedToolNames.has(parseToolPatternEntry(entry).toolName));
-		const preservedDeny = (existingPermissions.deny ?? []).filter((entry) => !managedToolNames.has(parseToolPatternEntry(entry).toolName));
+		const preservedAllow = (existingPermissions.allow ?? []).filter((entry) => !isManagedToolName(parseToolPatternEntry(entry).toolName));
+		const preservedAsk = (existingPermissions.ask ?? []).filter((entry) => !isManagedToolName(parseToolPatternEntry(entry).toolName));
+		const preservedDeny = (existingPermissions.deny ?? []).filter((entry) => !isManagedToolName(parseToolPatternEntry(entry).toolName));
 		const mergedPermissions = { ...existingPermissions };
 		const mergedAllow = (0, es_toolkit.uniq)([...preservedAllow, ...allow].toSorted());
 		const mergedAsk = (0, es_toolkit.uniq)([...preservedAsk, ...ask].toSorted());
@@ -83713,6 +84219,7 @@ const IDE_ACTION_TO_CANONICAL = {
 	mcp: "mcp"
 };
 function toIdeAction(canonical) {
+	if (canonical.startsWith("mcp__")) return "mcp";
 	return CANONICAL_TO_IDE_ACTION[canonical] ?? canonical;
 }
 function toCanonicalCategory$2(ideAction) {
@@ -83769,8 +84276,9 @@ var AntigravityIdePermissions = class AntigravityIdePermissions extends ToolPerm
 			logger
 		});
 		const managedActions = new Set(Object.keys(config.permission).map((category) => toIdeAction(category)));
+		const isManagedAction = (action) => managedActions.has(action) || managedActions.has("mcp") && action.startsWith("mcp__");
 		const existingPermissions = settings.permissions ?? {};
-		const preserve = (entries) => (entries ?? []).filter((entry) => !managedActions.has(parseToolPatternEntry(entry).toolName));
+		const preserve = (entries) => (entries ?? []).filter((entry) => !isManagedAction(parseToolPatternEntry(entry).toolName));
 		const mergedPermissions = { ...existingPermissions };
 		const mergedAllow = (0, es_toolkit.uniq)([...preserve(existingPermissions.allow), ...allow].toSorted());
 		const mergedAsk = (0, es_toolkit.uniq)([...preserve(existingPermissions.ask), ...ask].toSorted());
@@ -83858,9 +84366,13 @@ const CANONICAL_TO_AUGMENT_TOOL_NAMES = {
 const AUGMENT_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENT_TOOL_NAMES).map(([k, v]) => [v, k]));
 const CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES = {
 	terminal: "launch-process",
+	bash: "launch-process",
+	shell: "launch-process",
 	read: "view",
 	edit: "str-replace-editor",
-	write: "save-file"
+	str_replace_editor: "str-replace-editor",
+	write: "save-file",
+	save_file: "save-file"
 };
 function toAugmentToolName(canonical) {
 	return lookupOwn({
@@ -84012,6 +84524,7 @@ function isShellRegexRoundtrippable(regex) {
 	while (i < body.length) {
 		const ch = body[i];
 		if (ch === "\\" && i + 1 < body.length) {
+			if (isGlobSpecial(body[i + 1])) return false;
 			i += 2;
 			continue;
 		}
@@ -84028,6 +84541,37 @@ function isShellRegexRoundtrippable(regex) {
 	}
 	return true;
 }
+/** Characters a glob reads as syntax (wildcards or the start of a character class). */
+function isGlobSpecial(ch) {
+	return ch === "*" || ch === "?" || ch === "[";
+}
+/**
+* Whether `shellRegexToGlob` can approximate a `shellInputRegex` without widening it. The lossy
+* conversion keeps regex quantifiers as characters, and a `*` or `?` left in the glob becomes a
+* wildcard: `^rm -rf /tmp/a*$` (a run of `a`s) would turn into the glob `rm -rf /tmp/a*`, which
+* matches `rm -rf /tmp/a /home`. So a regex is unsafe when it has an escaped literal `\*` / `\?` /
+* `\[` (a `[` would open a character class in targets whose globs support one),
+* or a bare quantifier `*` / `?` / `+` / `{` that is not part of a `.*` run (which the glob `*`
+* reproduces faithfully).
+*/
+function canApproximateShellRegexWithoutWidening(regex) {
+	let i = 0;
+	while (i < regex.length) {
+		const ch = regex[i];
+		if (ch === "\\" && i + 1 < regex.length) {
+			if (isGlobSpecial(regex[i + 1])) return false;
+			i += 2;
+			continue;
+		}
+		if (ch === "." && regex[i + 1] === "*") {
+			i += 2;
+			continue;
+		}
+		if (ch === "*" || ch === "?" || ch === "+" || ch === "{") return false;
+		i += 1;
+	}
+	return true;
+}
 const MANAGED_AUGMENT_TOOL_NAMES = new Set(Object.values(CANONICAL_TO_AUGMENT_TOOL_NAMES));
 var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermissions {
 	constructor(params) {
@@ -84464,12 +85008,18 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 		if (legacyToolName === "launch-process" && entry.shellInputRegex) {
 			const regex = entry.shellInputRegex;
 			if (isShellRegexRoundtrippable(regex)) pattern = shellRegexToGlob(regex);
-			else if (action === "deny") {
-				logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as the catch-all '*' pattern (fail-closed) so the deny rule cannot be silently narrowed on regenerate.`);
-				pattern = "*";
-			} else {
-				pattern = shellRegexToGlob(regex);
-				logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as glob '${pattern}'; the rule may match a different set of inputs after regenerate.`);
+			else {
+				if (action !== "deny" && !canApproximateShellRegexWithoutWidening(regex)) {
+					logger?.warn(`AugmentCode permissions: skipping ${action} entry for tool '${entry.toolName}': shellInputRegex '${regex}' uses a quantifier or a literal '*' / '?' that a glob cannot express, and converting it would widen the rule. The entry is not imported.`);
+					continue;
+				}
+				if (action === "deny") {
+					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as the catch-all '*' pattern (fail-closed) so the deny rule cannot be silently narrowed on regenerate.`);
+					pattern = "*";
+				} else {
+					pattern = shellRegexToGlob(regex);
+					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as glob '${pattern}'; the rule may match a different set of inputs after regenerate.`);
+				}
 			}
 		} else pattern = "*";
 		if (isPrototypePollutionKey(pattern)) {
@@ -85962,15 +86512,19 @@ const CLAUDECODE_ENV_IGNORED_IN_EVERY_FILE = /* @__PURE__ */ new Set([
 * `env` variables a project or local settings file cannot set, because a
 * checked-out repository should not control them: where Claude Code stores its
 * own files, what session content it exports, where telemetry goes, how it
-* starts or syncs, the timers on an unanswered dialog, and whether it processes
-* attachments or expands `@` file mentions, and the screen reader (`CLAUDE_AX_*`) variables. Claude Code drops them there, so they are skipped at project scope and emitted only under `--global`.
+* starts or syncs, which claude.ai sign-in it uses, the timers on an unanswered
+* dialog, and whether it processes attachments or expands `@` file mentions,
+* and the screen reader (`CLAUDE_AX_*`) variables. Claude Code drops them there, so they are skipped at project scope and emitted only under `--global`.
 *
-* Only the names the settings reference lists are covered; its directory and
-* Windows groups are introduced with "such as", so an unlisted member of those
+* Only the names the settings reference lists are covered; its directory,
+* Windows and sign-in groups are introduced with "such as", so an unlisted member of those
 * families is still written. Windows variable names are case-insensitive, so
-* that group is matched without regard to case.
+* that group is matched without regard to case. `ALLUSERSPROFILE`,
+* `SystemDrive` and the `CommonProgramFiles` family are ignored there since
+* Claude Code v2.1.285.
 *
 * @see https://code.claude.com/docs/en/settings-reference#variables-claude-code-ignores-in-env
+* @see https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
 */
 const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"BETA_TRACING_ENDPOINT",
@@ -85980,6 +86534,9 @@ const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"CLAUDE_CODE_DISABLE_FILE_MENTIONS",
 	"CLAUDE_CODE_ENABLE_TELEMETRY",
 	"CLAUDE_CODE_ENHANCED_TELEMETRY_BETA",
+	"CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+	"CLAUDE_CODE_OAUTH_SCOPES",
+	"CLAUDE_CODE_OAUTH_TOKEN",
 	"CLAUDE_CODE_PLUGIN_CACHE_DIR",
 	"CLAUDE_CODE_PLUGIN_SEED_DIR",
 	"CLAUDE_CODE_PROCESS_WRAPPER",
@@ -86000,14 +86557,23 @@ const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"TMPDIR"
 ]);
 const CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_NAMES = /* @__PURE__ */ new Set([
+	"ALLUSERSPROFILE",
+	"COMMONPROGRAMW6432",
 	"COMSPEC",
 	"LOCALAPPDATA",
 	"PATHEXT",
 	"PROGRAMDATA",
 	"PROGRAMW6432",
 	"PSMODULEPATH",
+	"SYSTEMDRIVE",
 	"SYSTEMROOT"
 ]);
+/**
+* Windows name prefixes matched as whole families: `ProgramFiles*` and
+* `CommonProgramFiles*`. `ProgramW6432` and `CommonProgramW6432` are exact
+* names in the set above.
+*/
+const CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_PREFIXES = ["PROGRAMFILES", "COMMONPROGRAMFILES"];
 const CLAUDECODE_ENV_OTLP_IGNORED_SUFFIXES = [
 	"_ENDPOINT",
 	"_HEADERS",
@@ -86052,7 +86618,7 @@ const CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES = {
 function isProjectIgnoredEnvVariable(name, value) {
 	if (CLAUDECODE_ENV_PROJECT_IGNORED_NAMES.has(name) || name.startsWith("XDG_") || name.startsWith("CLAUDE_AX_")) return true;
 	const upper = name.toUpperCase();
-	if (CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_NAMES.has(upper) || upper.startsWith("PROGRAMFILES")) return true;
+	if (CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_NAMES.has(upper) || CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_PREFIXES.some((prefix) => upper.startsWith(prefix))) return true;
 	if (name.startsWith("OTEL_EXPORTER_OTLP_") && CLAUDECODE_ENV_OTLP_IGNORED_SUFFIXES.some((suffix) => name.endsWith(suffix))) return true;
 	if (Object.hasOwn(CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES, name)) {
 		const offValues = CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES[name];
@@ -86084,7 +86650,7 @@ function stripIgnoredEnvVariables({ env, global, relativeFilePath, logger }) {
 		kept[name] = value;
 	}
 	if (ignoredEverywhere.length > 0) logger?.warn(`Claude Code permissions: Claude Code ignores ${ignoredEverywhere.map((name) => `'env.${name}'`).join(", ")} in every settings file, so ${ignoredEverywhere.length === 1 ? "it is" : "they are"} not written to ${relativeFilePath}. Set ${ignoredEverywhere.length === 1 ? "it" : "them"} in the environment Claude Code starts from instead, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`);
-	if (ignoredAtProjectScope.length > 0) logger?.warn(`Claude Code permissions: ${ignoredAtProjectScope.map((name) => `'env.${name}'`).join(", ")} ${ignoredAtProjectScope.length === 1 ? "is" : "are"} not honored in the project-scoped ${relativeFilePath}, so ${ignoredAtProjectScope.length === 1 ? "it is" : "they are"} not written there — Claude Code ignores variables there that choose where it writes its files, export session content or telemetry, change how it starts or syncs, set dialog timers, turn attachments or file mentions off, or turn Claude in Chrome on (a value that turns telemetry or Chrome off, such as "none" or "0", is still written). Author ${ignoredAtProjectScope.length === 1 ? "it" : "them"} in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+	if (ignoredAtProjectScope.length > 0) logger?.warn(`Claude Code permissions: ${ignoredAtProjectScope.map((name) => `'env.${name}'`).join(", ")} ${ignoredAtProjectScope.length === 1 ? "is" : "are"} not honored in the project-scoped ${relativeFilePath}, so ${ignoredAtProjectScope.length === 1 ? "it is" : "they are"} not written there — Claude Code ignores variables there that choose where it writes its files, export session content or telemetry, change how it starts or syncs, set the claude.ai sign-in, set dialog timers, turn attachments or file mentions off, or turn Claude in Chrome on (a value that turns telemetry or Chrome off, such as "none" or "0", is still written). Author ${ignoredAtProjectScope.length === 1 ? "it" : "them"} in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
 	return kept;
 }
 /**
@@ -86734,7 +87300,7 @@ const CODEBUDDY_RULE_LISTS = [
 	"ask",
 	"deny"
 ];
-const CATCH_ALL_PATTERN$13 = "*";
+const CATCH_ALL_PATTERN$14 = "*";
 const MCP_CATEGORY = "mcp";
 const MCP_RULE_PREFIX = "mcp__";
 const ALL_MCP_RULE = "mcp__*";
@@ -86804,7 +87370,7 @@ function categoryOfRule$2(rule) {
 *   and reach the `Bash` rules through `honorAllToolsOnBash`.
 */
 function buildCodebuddyRule({ category, pattern, action, logger }) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$13;
+	const catchAll = pattern === CATCH_ALL_PATTERN$14;
 	if (category === MCP_CATEGORY) {
 		if (catchAll && action === "allow") {
 			logger?.warn(`CodeBuddy permissions: skipping the 'mcp' allow rule '*' — CodeBuddy honors the all-MCP wildcard 'mcp__*' in deny and ask only. Allow servers by name instead (for example 'mcp__github').`);
@@ -86813,7 +87379,7 @@ function buildCodebuddyRule({ category, pattern, action, logger }) {
 		return catchAll ? ALL_MCP_RULE : `${MCP_RULE_PREFIX}${pattern}`;
 	}
 	if (category === "*") {
-		if (catchAll) return CATCH_ALL_PATTERN$13;
+		if (catchAll) return CATCH_ALL_PATTERN$14;
 		logger?.warn(`CodeBuddy permissions: skipping the all-tools '*' rule '${pattern}' — CodeBuddy's standalone '*' rule takes no specifier. Write it under the category it is meant for (for example 'bash' or 'read').`);
 		return null;
 	}
@@ -86831,7 +87397,7 @@ function parseCodebuddyRule(rule) {
 	const { specifier } = splitCodebuddyRule(rule);
 	if (specifier === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$13
+		pattern: CATCH_ALL_PATTERN$14
 	};
 	const trimmed = specifier.trim();
 	return trimmed === "" ? null : {
@@ -89157,8 +89723,8 @@ function mapBashActionToDecision(action) {
 // src/features/permissions/commandcode-permissions.ts
 /** Top-level key of `.commandcode/settings.json` that rulesync owns. */
 const COMMANDCODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$12 = "*";
-const MCP_CANONICAL_PREFIX$7 = "mcp__";
+const CATCH_ALL_PATTERN$13 = "*";
+const MCP_CANONICAL_PREFIX$8 = "mcp__";
 const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
 const CATEGORY_TO_COMMANDCODE_TOOL = {
 	bash: "Shell",
@@ -89203,10 +89769,10 @@ const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (
 * restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
 */
 function buildCommandcodeRule(category, pattern) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$12 || pattern === "";
-	if (category.startsWith(MCP_CANONICAL_PREFIX$7)) return catchAll ? category : `${category}(${pattern})`;
-	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$7}${pattern}`;
-	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$12 : null;
+	const catchAll = pattern === CATCH_ALL_PATTERN$13 || pattern === "";
+	if (category.startsWith(MCP_CANONICAL_PREFIX$8)) return catchAll ? category : `${category}(${pattern})`;
+	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$8}${pattern}`;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$13 : null;
 	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
 	if (tool === void 0) return null;
 	return catchAll ? tool : `${tool}(${pattern})`;
@@ -89242,7 +89808,7 @@ function splitCommandcodeRule(rule) {
 }
 /** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
 function isCatchAllSpecifier(inner) {
-	return inner === "" || inner === CATCH_ALL_PATTERN$12;
+	return inner === "" || inner === CATCH_ALL_PATTERN$13;
 }
 /**
 * Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
@@ -89276,34 +89842,34 @@ function parseMcpCommandcodeRule({ tool, inner }) {
 	if (server.length === 0) return null;
 	const everyServer = {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: true
 	};
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$7)) {
-		if (server === CATCH_ALL_PATTERN$12) return everyServer;
-		if (server.includes(CATCH_ALL_PATTERN$12)) return null;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$8)) {
+		if (server === CATCH_ALL_PATTERN$13) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$13)) return null;
 		return {
-			category: rest === "" || rest === CATCH_ALL_PATTERN$12 ? `${MCP_CANONICAL_PREFIX$7}${server}` : `${MCP_CANONICAL_PREFIX$7}${remainder}`,
-			pattern: CATCH_ALL_PATTERN$12,
+			category: rest === "" || rest === CATCH_ALL_PATTERN$13 ? `${MCP_CANONICAL_PREFIX$8}${server}` : `${MCP_CANONICAL_PREFIX$8}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$13,
 			notInAllow: false
 		};
 	}
-	const category = `${MCP_CANONICAL_PREFIX$7}${remainder}`;
-	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$12);
+	const category = `${MCP_CANONICAL_PREFIX$8}${remainder}`;
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$13);
 	if (!isCatchAllSpecifier(inner)) return namesTool ? {
 		category,
 		pattern: inner,
 		notInAllow: true
 	} : null;
-	if (remainder === CATCH_ALL_PATTERN$12) return everyServer;
-	if (rest === CATCH_ALL_PATTERN$12 && !server.includes(CATCH_ALL_PATTERN$12)) return {
-		category: `${MCP_CANONICAL_PREFIX$7}${server}`,
-		pattern: CATCH_ALL_PATTERN$12,
+	if (remainder === CATCH_ALL_PATTERN$13) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$13 && !server.includes(CATCH_ALL_PATTERN$13)) return {
+		category: `${MCP_CANONICAL_PREFIX$8}${server}`,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: true
 	};
 	return namesTool ? {
 		category,
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: false
 	} : null;
 }
@@ -89327,14 +89893,14 @@ function friendlyToolRule({ category, inner }) {
 	if (category === "bash") {
 		if (isCatchAllSpecifier(inner)) return {
 			category,
-			pattern: CATCH_ALL_PATTERN$12,
+			pattern: CATCH_ALL_PATTERN$13,
 			notInAllow: false
 		};
 		const normalized = inner.trim().replace(/\s+/g, " ");
 		if (normalized === "" || normalized === ":*") return null;
 		return isCatchAllSpecifier(normalized) ? {
 			category,
-			pattern: CATCH_ALL_PATTERN$12,
+			pattern: CATCH_ALL_PATTERN$13,
 			notInAllow: true
 		} : {
 			category,
@@ -89344,7 +89910,7 @@ function friendlyToolRule({ category, inner }) {
 	}
 	if (isCatchAllSpecifier(inner)) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: false
 	};
 	return isCatchAllSpecifier(inner.trim()) ? null : {
@@ -89363,13 +89929,13 @@ function friendlyToolRule({ category, inner }) {
 */
 function parseCommandcodeRule(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	if (tool === CATCH_ALL_PATTERN$12) return isCatchAllSpecifier(inner) ? {
+	if (tool === CATCH_ALL_PATTERN$13) return isCatchAllSpecifier(inner) ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: true
 	} : null;
 	const lowered = tool.toLowerCase();
-	if (lowered.startsWith(MCP_CANONICAL_PREFIX$7)) return parseMcpCommandcodeRule({
+	if (lowered.startsWith(MCP_CANONICAL_PREFIX$8)) return parseMcpCommandcodeRule({
 		tool,
 		inner
 	});
@@ -89387,12 +89953,12 @@ function parseCommandcodeRule(rule) {
 */
 function isFoldedMcpToolNameRule({ rule, category }) {
 	const { tool } = splitCommandcodeRule(rule);
-	return category.startsWith(MCP_CANONICAL_PREFIX$7) && !tool.startsWith(MCP_CANONICAL_PREFIX$7);
+	return category.startsWith(MCP_CANONICAL_PREFIX$8) && !tool.startsWith(MCP_CANONICAL_PREFIX$8);
 }
 /** The `Tool` half of `Tool(specifier)`, when the rule is an exact-prefix MCP rule with a specifier. */
 function scopedMcpRuleTool(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$7) ? tool : null;
+	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$8) ? tool : null;
 }
 /**
 * The string entries of a Command Code permission list. Command Code reads
@@ -89435,7 +90001,7 @@ function preservedRules({ existingPermissions, key, managedCategories, written,
 	}).filter((rule) => {
 		const parsed = parseCommandcodeRule(rule);
 		if (parsed === null || !managedCategories.has(parsed.category)) return true;
-		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$12})`);
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$13})`);
 		if (key !== "allow" && isStricterAction({
 			action: key,
 			existing: replacement
@@ -89492,7 +90058,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$12);
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$13);
 		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
 		if (managedCategory !== null) managedCategories.add(managedCategory.category);
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -89561,7 +90127,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 function skippedAllowImportMessage({ rule, category }) {
 	const { tool, inner } = splitCommandcodeRule(rule);
 	if (category === "bash") return `Command Code reads '${rule}' in "allow" as ${PADDED_SHELL_WILDCARD_REASON}, which rulesync cannot import without widening the grant to every command, so it was not imported.`;
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$7) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$8) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
 	return `Command Code globs the specifier of '${rule}' in "allow" against the call's arguments, which rulesync cannot import without widening the grant to the whole tool, so it was not imported.`;
 }
 /**
@@ -89756,7 +90322,7 @@ function parseCommandcodeSettings({ fileContent, relativePath }) {
 }
 // src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$11 = "*";
+const CATCH_ALL_PATTERN$12 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
 * would match `Tool(**)` against every argument just as the bare tool name
@@ -89764,7 +90330,7 @@ const CATCH_ALL_PATTERN$11 = "*";
 * the bare entry instead of being skipped as a pattern-specific rule.
 */
 function normalizeCatchAllPattern$1(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$11 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$12 : pattern;
 }
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
@@ -89808,7 +90374,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$11 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$12 : pattern
 	};
 }
 /**
@@ -89973,7 +90539,7 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$11) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$12) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -90029,13 +90595,116 @@ const AUTO_APPROVE_KEYS = {
 	webfetch: "chat.tools.urls.autoApprove"
 };
 /**
-* The workspace setting holding the starting permission level of new chat
-* sessions, authored through the `copilot.defaultPermissionMode` override.
+* The workspace setting holding the starting permission level of new Local
+* (`local` harness) chat sessions, authored through the
+* `copilot.defaultPermissionMode` override. VS Code 1.144 narrowed it to Local
+* sessions; the Copilot harness reads {@link DEFAULT_CONFIGURATION_KEY}.
 *
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
 const DEFAULT_PERMISSION_MODE_KEY$1 = "chat.permissions.default";
 /**
+* The workspace setting holding the starting `mode` (`interactive` / `plan` /
+* `autopilot`) and `approvals` (`manual` / `assisted` / `allowAll`) of new
+* agent sessions such as the Copilot harness, the default since VS Code 1.143.
+* It shipped in stable VS Code 1.144 as an object setting with
+* `additionalProperties: false`; older releases ignore it.
+*
+* @see https://github.com/microsoft/vscode/blob/1.144.0/src/vs/workbench/contrib/chat/browser/chat.shared.contribution.ts
+* @see https://github.com/microsoft/vscode/blob/1.144.0/src/vs/workbench/contrib/chat/common/constants.ts
+*/
+const DEFAULT_CONFIGURATION_KEY = "chat.defaultConfiguration";
+/**
+* What each `copilot.defaultPermissionMode` value writes. `local` goes to
+* `chat.permissions.default`; `approvals` and `autopilot` go to
+* `chat.defaultConfiguration`. The Local picker has no Assisted level, so
+* `assisted` starts Local sessions with Default Permissions — the stricter
+* fallback. Autopilot is a permission level in the Local picker but a `mode`
+* in `chat.defaultConfiguration`, where it runs with every tool call approved.
+*/
+const DEFAULT_PERMISSION_MODE_MAPPINGS = {
+	default: {
+		local: "default",
+		approvals: "manual",
+		autopilot: false
+	},
+	autoApprove: {
+		local: "autoApprove",
+		approvals: "allowAll",
+		autopilot: false
+	},
+	autopilot: {
+		local: "autopilot",
+		approvals: "allowAll",
+		autopilot: true
+	},
+	assisted: {
+		local: "default",
+		approvals: "assisted",
+		autopilot: false
+	}
+};
+/**
+* The `chat.defaultConfiguration` value for `mode`. Rulesync owns only whether
+* the mode is Autopilot: authoring Autopilot sets it, and any other value
+* removes any Autopilot mode in the file (whether an earlier run or a person
+* wrote it, since the two cannot be told apart), while an `interactive` or
+* `plan` mode is kept.
+*/
+function buildDefaultConfigurationValue({ defaultPermissionMode, existingSettings }) {
+	const { approvals, autopilot } = DEFAULT_PERMISSION_MODE_MAPPINGS[defaultPermissionMode];
+	const existing = existingSettings[DEFAULT_CONFIGURATION_KEY];
+	const value = { ...isPlainObject(existing) ? existing : {} };
+	if (autopilot) value.mode = "autopilot";
+	else if (value.mode === "autopilot") delete value.mode;
+	value.approvals = approvals;
+	return value;
+}
+/**
+* The `copilot.defaultPermissionMode` values from least to most permissive,
+* used to settle a file whose two keys disagree.
+*/
+const DEFAULT_PERMISSION_MODE_RANK = {
+	default: 0,
+	assisted: 1,
+	autoApprove: 2,
+	autopilot: 3
+};
+/**
+* The `copilot.defaultPermissionMode` a `chat.defaultConfiguration` value
+* stands for. Autopilot is recognized only together with `allowAll`, the pair
+* Rulesync writes for it: an Autopilot mode with stricter approvals is read
+* from `approvals` alone, so that regenerating never escalates it to Allow
+* All. An object without `approvals` is read as `default`, since VS Code then
+* starts sessions with Manual permissions.
+*/
+function readDefaultConfigurationMode(configuration) {
+	if (!isPlainObject(configuration)) return;
+	switch (configuration.approvals) {
+		case void 0:
+		case "manual": return "default";
+		case "assisted": return "assisted";
+		case "allowAll": return configuration.mode === "autopilot" ? "autopilot" : "autoApprove";
+		default: return;
+	}
+}
+/**
+* Read `copilot.defaultPermissionMode` back from the settings. When the two
+* keys agree — `chat.permissions.default` holds the Local level Rulesync
+* writes for the `chat.defaultConfiguration` value — the latter is returned,
+* since only it can say `assisted`. When they disagree, the less permissive of
+* the two is returned, so regenerating never raises either harness's starting
+* permissions. Either key alone is read as it stands.
+*/
+function readDefaultPermissionMode(settings) {
+	const fromConfiguration = readDefaultConfigurationMode(settings[DEFAULT_CONFIGURATION_KEY]);
+	const localValue = settings[DEFAULT_PERMISSION_MODE_KEY$1];
+	const fromLocal = COPILOT_LOCAL_PERMISSION_LEVELS.find((level) => level === localValue);
+	if (fromConfiguration === void 0 || fromLocal === void 0) return fromConfiguration ?? fromLocal;
+	if (DEFAULT_PERMISSION_MODE_MAPPINGS[fromConfiguration].local === fromLocal) return fromConfiguration;
+	return DEFAULT_PERMISSION_MODE_RANK[fromLocal] < DEFAULT_PERMISSION_MODE_RANK[fromConfiguration] ? fromLocal : fromConfiguration;
+}
+/**
 * The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
 * at path `a.b` is written to `chat.agent.sandbox.a.b`.
 */
@@ -90222,9 +90891,6 @@ function readSandboxFromSettings(settings) {
 	}
 	return Object.keys(sandbox).length > 0 ? sandbox : void 0;
 }
-function isCopilotDefaultPermissionMode(value) {
-	return COPILOT_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
-}
 function asAutoApproveMap(value) {
 	if (!isPlainObject(value)) return {};
 	const result = {};
@@ -90268,9 +90934,11 @@ function buildAutoApproveValue({ category, rules }) {
 * `false`. A key whose canonical category is absent entirely
 * is left untouched, so authoring only `bash` rules never disturbs a
 * hand-written edits or urls map.
-* The `copilot.defaultPermissionMode` override writes `chat.permissions.default`
-* (the starting permission level of new chat sessions); without it the key is
-* left untouched. The `copilot.sandbox` override writes the Agent Host sandbox
+* The `copilot.defaultPermissionMode` override writes both
+* `chat.permissions.default` (Local sessions) and `chat.defaultConfiguration`
+* (Copilot-harness sessions, VS Code 1.144+; see
+* {@link DEFAULT_PERMISSION_MODE_MAPPINGS}); without it both keys are left
+* untouched. The `copilot.sandbox` override writes the Agent Host sandbox
 * settings (`chat.agent.sandbox.*`, see {@link SANDBOX_LEAVES}) per key, and
 * warns about every value it writes that loosens the sandbox.
 * Only project scope is modeled: VS Code's user-scope settings.json lives at a
@@ -90321,17 +90989,24 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 				rules
 			});
 		}
+		const existingSettings = () => parseSharedConfig({
+			format: "jsonc",
+			fileContent: existingContent,
+			filePath
+		});
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
-		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY$1] = defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) {
+			patch[DEFAULT_PERMISSION_MODE_KEY$1] = DEFAULT_PERMISSION_MODE_MAPPINGS[defaultPermissionMode].local;
+			patch[DEFAULT_CONFIGURATION_KEY] = buildDefaultConfigurationValue({
+				defaultPermissionMode,
+				existingSettings: existingSettings()
+			});
+		}
 		const sandbox = config.copilot?.sandbox;
 		if (sandbox !== void 0) {
 			Object.assign(patch, buildSandboxPatch({
 				sandbox,
-				existingSettings: parseSharedConfig({
-					format: "jsonc",
-					fileContent: existingContent,
-					filePath
-				})
+				existingSettings: existingSettings()
 			}));
 			warnOnTrustAffectingEntries({
 				toolLabel: COPILOT_TOOL_LABEL,
@@ -90378,10 +91053,10 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			for (const [pattern, flag] of Object.entries(autoApprove)) rules[pattern] = flag ? "allow" : "deny";
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
-		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY$1];
+		const defaultPermissionMode = readDefaultPermissionMode(settings);
 		const sandbox = readSandboxFromSettings(settings);
 		const copilot = {
-			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
+			...defaultPermissionMode !== void 0 && { defaultPermissionMode },
 			...sandbox !== void 0 && { sandbox }
 		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
@@ -90579,14 +91254,14 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 	}
 };
 // src/features/permissions/crush-permissions.ts
-const CATCH_ALL_PATTERN$10 = "*";
+const CATCH_ALL_PATTERN$11 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
 * argument patterns at all, so it is the only pattern a rule can carry and
 * still be written.
 */
 function normalizeCatchAllPattern(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$10 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$11 : pattern;
 }
 const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	bash: "bash",
@@ -90598,11 +91273,11 @@ const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	webfetch: "fetch"
 };
 const CRUSH_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_TOOL_NAMES).map(([k, v]) => [v, k]));
-const MCP_CANONICAL_PREFIX$6 = "mcp__";
+const MCP_CANONICAL_PREFIX$7 = "mcp__";
 const MCP_CRUSH_PREFIX = "mcp_";
 function toCrushToolName(canonical) {
 	if (Object.hasOwn(CANONICAL_TO_CRUSH_TOOL_NAMES, canonical)) return CANONICAL_TO_CRUSH_TOOL_NAMES[canonical] ?? canonical;
-	if (canonical.startsWith(MCP_CANONICAL_PREFIX$6) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX$7) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
 	return canonical;
 }
 function toCanonicalToolName$5(crushName) {
@@ -90776,7 +91451,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 	for (const [rawPattern, action] of Object.entries(rules)) {
 		if (isPrototypePollutionKey(rawPattern)) continue;
 		const pattern = normalizeCatchAllPattern(rawPattern);
-		if (pattern === CATCH_ALL_PATTERN$10) {
+		if (pattern === CATCH_ALL_PATTERN$11) {
 			catchAllAction = action;
 			continue;
 		}
@@ -90849,11 +91524,11 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 	};
 	for (const entry of disabled) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$10] = "deny";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$11] = "deny";
 	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$10] ??= "allow";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$11] ??= "allow";
 	}
 	return { permission };
 }
@@ -90899,13 +91574,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX$5 = "mcp__";
+const MCP_CANONICAL_PREFIX$6 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX$5) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$6) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -90939,7 +91614,7 @@ function toCanonicalCategory$1(cursorType, pattern) {
 		if (match) {
 			const server = match[1] ?? "*";
 			const tool = match[2] ?? "*";
-			return `${MCP_CANONICAL_PREFIX$5}${server}__${tool}`;
+			return `${MCP_CANONICAL_PREFIX$6}${server}__${tool}`;
 		}
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
@@ -91201,7 +91876,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { toolName: type, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$5) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$6) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -92700,7 +93375,7 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 // src/features/permissions/goose-permissions.ts
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
-const CATCH_ALL_PATTERN$9 = "*";
+const CATCH_ALL_PATTERN$10 = "*";
 const RULESYNC_TO_GOOSE_TOOL_NAME = { bash: "shell" };
 const GOOSE_TO_RULESYNC_TOOL_NAMES = {
 	shell: ["bash"],
@@ -92849,7 +93524,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	const assigned = /* @__PURE__ */ new Map();
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
-		for (const [pattern, action] of Object.entries(rules)) if (pattern !== CATCH_ALL_PATTERN$9) logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
+		for (const [pattern, action] of Object.entries(rules)) if (pattern !== CATCH_ALL_PATTERN$10) logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 		const { action, downgraded } = failSafeCatchAllAction({
 			rules,
 			allToolsRules: category === "*" ? void 0 : config.permission["*"]
@@ -92882,7 +93557,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
-			permission[category][CATCH_ALL_PATTERN$9] = action;
+			permission[category][CATCH_ALL_PATTERN$10] = action;
 		}
 	}
 	return { permission };
@@ -92892,8 +93567,8 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const GROKCLI_AUTO_PERMISSION_MODE = "auto";
-const CATCH_ALL_PATTERN$8 = "*";
-const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const CATCH_ALL_PATTERN$9 = "*";
+const MCP_CANONICAL_PREFIX$5 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
 	read: "Read",
@@ -92925,6 +93600,25 @@ const GROK_TOOL_TO_CATEGORY_LOWER = {
 };
 const GROK_MCP_TOOL_ALIASES = /* @__PURE__ */ new Set(["mcp", GROK_MCP_TOOL.toLowerCase()]);
 const GROKCLI_PERMISSION_RULES_KEY = "rules";
+const GROK_PATH_PATTERN_CATEGORIES = /* @__PURE__ */ new Set([
+	"read",
+	"edit",
+	"write",
+	"grep",
+	"glob"
+]);
+const CLAUDE_ABSOLUTE_PATH_PREFIX = "//";
+/**
+* Rewrite a canonical path pattern into the anchor Grok understands. A
+* Claude-style `//abs` absolute pattern becomes `/abs`; without this the rule
+* would match nothing on Grok, so a `deny` or `ask` rule would silently give
+* no protection. Every other pattern is returned unchanged.
+*/
+function toGrokPathPattern(category, pattern) {
+	if (!GROK_PATH_PATTERN_CATEGORIES.has(category)) return pattern;
+	if (!pattern.startsWith(CLAUDE_ABSOLUTE_PATH_PREFIX)) return pattern;
+	return `/${pattern.replace(/^\/+/, "")}`;
+}
 /**
 * Build a Grok Claude-style permission entry (e.g. `Bash(git *)`, `Read`,
 * `MCPTool(server__tool)`) from a canonical category + pattern. Returns `null`
@@ -92935,18 +93629,20 @@ const GROKCLI_PERMISSION_RULES_KEY = "rules";
 * `MCPTool`. For every other tool, a `*` pattern emits the bare tool name and a
 * concrete pattern emits `Tool(pattern)`. The all-tools `*` category becomes
 * Grok's bare `*` rule for its catch-all pattern only; a narrower pattern
-* under it has no Grok spelling and returns `null`.
+* under it has no Grok spelling and returns `null`. A Claude-style `//abs`
+* path pattern on a file tool is rewritten to Grok's `/abs` (see
+* `toGrokPathPattern`).
 */
 function buildGrokEntry(category, pattern) {
-	if (category === "*") return pattern === CATCH_ALL_PATTERN$8 ? GROK_ALL_TOOLS_ENTRY : null;
-	if (category.startsWith(MCP_CANONICAL_PREFIX$4)) {
+	if (category === "*") return pattern === CATCH_ALL_PATTERN$9 ? GROK_ALL_TOOLS_ENTRY : null;
+	if (category.startsWith(MCP_CANONICAL_PREFIX$5)) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
-	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$8 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$9 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
 	const tool = CATEGORY_TO_GROK_TOOL[category];
 	if (tool === void 0) return null;
-	return pattern === CATCH_ALL_PATTERN$8 || pattern === "" ? tool : `${tool}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$9 || pattern === "" ? tool : `${tool}(${toGrokPathPattern(category, pattern)})`;
 }
 /**
 * Parse a Grok Claude-style permission entry back into a canonical category +
@@ -92968,21 +93664,21 @@ function parseGrokEntry(entry) {
 	}
 	if (parenIndex === -1 && tool === GROK_ALL_TOOLS_ENTRY) return {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$8
+		pattern: CATCH_ALL_PATTERN$9
 	};
-	if (parenIndex === -1 && tool.startsWith(MCP_CANONICAL_PREFIX$4)) return parseClaudeStyleMcpEntry(tool);
+	if (parenIndex === -1 && tool.startsWith(MCP_CANONICAL_PREFIX$5)) return parseClaudeStyleMcpEntry(tool);
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
-		category: `${MCP_CANONICAL_PREFIX$4}${inner}`,
-		pattern: CATCH_ALL_PATTERN$8
+		category: `${MCP_CANONICAL_PREFIX$5}${inner}`,
+		pattern: CATCH_ALL_PATTERN$9
 	} : {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$8
+		pattern: CATCH_ALL_PATTERN$9
 	};
 	const category = GROK_TOOL_TO_CATEGORY[tool];
 	if (category === void 0) return null;
 	return {
 		category,
-		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$8
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$9
 	};
 }
 /**
@@ -92999,14 +93695,14 @@ function parseGrokEntry(entry) {
 function parseClaudeStyleMcpEntry(entry) {
 	const rest = entry.slice(5);
 	if (rest.length === 0) return null;
-	if (rest === CATCH_ALL_PATTERN$8) return {
+	if (rest === CATCH_ALL_PATTERN$9) return {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$8
+		pattern: CATCH_ALL_PATTERN$9
 	};
 	const address = rest.includes("__") ? rest : `${rest}__*`;
 	return {
-		category: `${MCP_CANONICAL_PREFIX$4}${address}`,
-		pattern: CATCH_ALL_PATTERN$8
+		category: `${MCP_CANONICAL_PREFIX$5}${address}`,
+		pattern: CATCH_ALL_PATTERN$9
 	};
 }
 /**
@@ -93027,20 +93723,20 @@ function parseGrokRule(rule) {
 	if (typeof tool !== "string") return null;
 	if (pattern !== void 0 && typeof pattern !== "string") return null;
 	const trimmedPattern = pattern?.trim() ?? "";
-	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$8;
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$9;
 	const lowerTool = tool.trim().toLowerCase();
-	if (lowerTool === GROK_VERBOSE_ANY_TOOL) return resolvedPattern === CATCH_ALL_PATTERN$8 ? {
+	if (lowerTool === GROK_VERBOSE_ANY_TOOL) return resolvedPattern === CATCH_ALL_PATTERN$9 ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$8,
+		pattern: CATCH_ALL_PATTERN$9,
 		action
 	} : null;
-	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$8 ? {
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$9 ? {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$8,
+		pattern: CATCH_ALL_PATTERN$9,
 		action
 	} : {
-		category: `${MCP_CANONICAL_PREFIX$4}${resolvedPattern}`,
-		pattern: CATCH_ALL_PATTERN$8,
+		category: `${MCP_CANONICAL_PREFIX$5}${resolvedPattern}`,
+		pattern: CATCH_ALL_PATTERN$9,
 		action
 	};
 	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
@@ -93190,7 +93886,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const fineGrained = parseGrokPermissionArrays(isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
-		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$8]: legacyModeAction(parsed) } } };
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$9]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
@@ -93375,6 +94071,195 @@ function ensureCategory(permission, category) {
 function removeEmptyCategories(permission) {
 	for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
 }
+/** The prefix Hermes's MCP trust gate keys its persisted "Always" answers with. */
+const MCP_ALLOWLIST_PREFIX = "mcp:";
+const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const CATCH_ALL_PATTERN$8 = "*";
+/**
+* Whether a `command_allowlist` entry is an MCP trust-gate grant rather than a
+* shell-command pattern. Since Hermes Agent v0.22.6, answering **Always** to
+* the approval prompt of a `trust: untrusted` MCP server appends
+* `mcp:<server>/<tool>` to `command_allowlist` (`_trust_approval_key` in
+* `tools/mcp_tool_handlers.py`), and the gate looks the key up by exact set
+* membership, so no `mcp:` entry is ever a command.
+*/
+function isMcpAllowlistEntry(entry) {
+	return entry.startsWith(MCP_ALLOWLIST_PREFIX);
+}
+/**
+* The canonical category (`mcp__<server>__<tool>`) a Hermes `mcp:<server>/<tool>`
+* grant stands for, or `null` when it has none: a malformed entry, a server
+* name containing `__` (the canonical name would read back as another server),
+* or a `*` in either name (Hermes compares the key literally, while a canonical
+* `*` is a wildcard).
+*/
+function mcpAllowlistEntryToCategory(entry) {
+	const parsed = parseMcpAllowlistEntry(entry);
+	if (parsed === null) return null;
+	const { server, tool } = parsed;
+	if (server.includes("__") || server.includes(CATCH_ALL_PATTERN$8)) return null;
+	if (tool.includes(CATCH_ALL_PATTERN$8)) return null;
+	return `${MCP_CANONICAL_PREFIX$4}${server}__${tool}`;
+}
+/** The server and tool an `mcp:<server>/<tool>` entry names, or `null` when it is malformed. */
+function parseMcpAllowlistEntry(entry) {
+	if (!isMcpAllowlistEntry(entry)) return null;
+	const rest = entry.slice(4);
+	const slash = rest.indexOf("/");
+	const server = slash === -1 ? "" : rest.slice(0, slash);
+	const tool = slash === -1 ? "" : rest.slice(slash + 1);
+	return server.length === 0 || tool.length === 0 ? null : {
+		server,
+		tool
+	};
+}
+/**
+* The server and tool a canonical `mcp__<server>__<tool>` category names, or
+* `null` when it names no single tool (a whole server, a wildcard, or the bare
+* `mcp` category). Only such a category can become one Hermes grant.
+*/
+function parseMcpToolCategory(category) {
+	if (!category.startsWith(MCP_CANONICAL_PREFIX$4)) return null;
+	const remainder = category.slice(5);
+	const separator = remainder.indexOf("__");
+	if (separator <= 0) return null;
+	const server = remainder.slice(0, separator);
+	const tool = remainder.slice(separator + 2);
+	if (tool.length === 0 || server.includes("/") || server.includes(CATCH_ALL_PATTERN$8) || tool.includes(CATCH_ALL_PATTERN$8)) return null;
+	return {
+		server,
+		tool
+	};
+}
+function isMcpCategory$1(category) {
+	return category === "mcp" || category.startsWith(MCP_CANONICAL_PREFIX$4);
+}
+function isRestricting(action) {
+	return action === "deny" || action === "ask";
+}
+/** The first `deny` or `ask` rule of a category, as `<category>: <pattern> (<action>)`. */
+function firstRestrictingRule(category, rules, covers = () => true) {
+	const found = Object.entries(rules ?? {}).find(([pattern, action]) => isRestricting(action) && covers(pattern));
+	return found ? `${category}: ${found[0]} (${found[1]})` : null;
+}
+/**
+* Whether an MCP name glob (the remainder of an `mcp__...` category, or a
+* pattern of the bare `mcp` category) covers `server`'s tool `tool`: it names
+* the tool (`github__delete_repo`, `github__*`, `*__delete_repo`, `*`) or the
+* whole server (`github`).
+*/
+function mcpNameGlobCovers(glob, server, tool) {
+	return glob === `${server}__${tool}` || glob === server || matchesGlob(glob, `${server}__${tool}`) || matchesGlob(glob, server);
+}
+/**
+* The `deny` or `ask` rule that outranks an allow on `server`'s tool `tool`, or
+* `null` when none does: any one under the all-tools `*` category (a rule there
+* applies to every tool, so even a narrower pattern restricts some of the
+* tool's calls), one under the bare `mcp` category whose pattern covers the
+* tool, or any one in an `mcp__...` category whose name covers the tool — its
+* own category included, since a deny or ask scoped to some of its calls still
+* forbids approving all of them. A Hermes grant approves every call of the
+* tool and Hermes has no ask tier, so such an allow is withheld, the same way
+* a `bash` allow a stricter rule covers is.
+*/
+function findMcpToolRestriction(permission, server, tool) {
+	for (const [category, rules] of Object.entries(permission)) {
+		let found = null;
+		if (category === "*") found = firstRestrictingRule(category, rules);
+		else if (category === "mcp") found = firstRestrictingRule(category, rules, (pattern) => mcpNameGlobCovers(pattern, server, tool));
+		else if (category.startsWith(MCP_CANONICAL_PREFIX$4) && mcpNameGlobCovers(category.slice(5), server, tool)) found = firstRestrictingRule(category, rules);
+		if (found !== null) return found;
+	}
+	return null;
+}
+function isMcpToolRestricted(permission, server, tool) {
+	return findMcpToolRestriction(permission, server, tool) !== null;
+}
+/**
+* Translate the canonical MCP `allow` rules into Hermes trust-gate grants: a
+* `*` allow on `mcp__<server>__<tool>` becomes `mcp:<server>/<tool>`. Every
+* other MCP allow (a whole server, a wildcard, a narrower pattern) has no
+* Hermes spelling, and an allow a deny or ask covers is withheld.
+*/
+function collectMcpAllowlistEntries(permission) {
+	const entries = [];
+	const withheldCategories = [];
+	const unexpressedRules = [];
+	for (const [category, rules] of Object.entries(permission)) {
+		if (!isMcpCategory$1(category)) continue;
+		const parsed = parseMcpToolCategory(category);
+		for (const pattern of patternsByAction(rules, "allow")) if (parsed === null || pattern !== CATCH_ALL_PATTERN$8) unexpressedRules.push(`${category}: ${pattern}`);
+		else {
+			const restriction = findMcpToolRestriction(permission, parsed.server, parsed.tool);
+			if (restriction === null) entries.push(`${MCP_ALLOWLIST_PREFIX}${parsed.server}/${parsed.tool}`);
+			else withheldCategories.push(`${category} (covered by ${restriction})`);
+		}
+	}
+	return {
+		entries,
+		withheldCategories,
+		unexpressedRules
+	};
+}
+function warnAboutUnwrittenMcpAllows({ withheldCategories, unexpressedRules, logger }) {
+	if (withheldCategories.length > 0) warnWithFallback(logger, `Hermes Agent's command_allowlist was not given the MCP allow rule(s) for ${withheldCategories.join(", ")}: a deny or ask rule covers each, a Hermes grant approves every call of the tool, and Hermes has no ask tier.`);
+	if (unexpressedRules.length > 0) warnWithFallback(logger, `Hermes Agent grants MCP tools one at a time (command_allowlist entries 'mcp:<server>/<tool>'), so only a '*' allow on an 'mcp__<server>__<tool>' category can be written; the MCP allow rule(s) ${unexpressedRules.join(", ")} were skipped and survive only in the permissions.rulesync round-trip block.`);
+}
+/**
+* Make the native `mcp:<server>/<tool>` grants authoritative for the canonical
+* single-tool MCP allows they can speak for. An allow the generator withheld
+* because a deny or ask covers it was never written, so its absence
+* is not a retraction and it is kept, as is every MCP allow with no Hermes
+* spelling. A grant with no canonical spelling stays only in Hermes, where
+* generation keeps it (see `setFileContent`).
+*/
+function reconcileMcpAllowlist({ permission, mcpEntries, logger }) {
+	for (const [category, rules] of Object.entries(permission)) {
+		const parsed = parseMcpToolCategory(category);
+		if (parsed !== null && rules[CATCH_ALL_PATTERN$8] === "allow" && !isMcpToolRestricted(permission, parsed.server, parsed.tool)) delete rules[CATCH_ALL_PATTERN$8];
+	}
+	const keptRestrictions = [];
+	for (const entry of mcpEntries) {
+		const category = mcpAllowlistEntryToCategory(entry);
+		if (category === null) continue;
+		const rules = ensureCategory(permission, category);
+		if (isRestricting(rules[CATCH_ALL_PATTERN$8])) {
+			keptRestrictions.push(entry);
+			continue;
+		}
+		rules[CATCH_ALL_PATTERN$8] = "allow";
+	}
+	if (keptRestrictions.length > 0) warnWithFallback(logger, `Hermes Agent's command_allowlist grants ${keptRestrictions.join(", ")}, but the permissions.rulesync block denies or asks for those MCP tools; the canonical rule was kept and the grant was not imported.`);
+}
+/**
+* The `mcp:` grants in an existing `command_allowlist` that rulesync does not
+* manage and must keep when it rewrites the list: Hermes appends one whenever
+* the user answers **Always** on an untrusted MCP server, so dropping it would
+* silently revoke the grant. A grant is managed — and so retracted with its
+* canonical rule — when the previous or the new canonical block has a rule
+* for its `mcp__<server>__<tool>` category, or when the new block restricts
+* the tool in any way.
+*/
+function unmanagedMcpAllowlistEntries({ existing, previousPermission, nextPermission, nextAllowlist }) {
+	return (isStringArray(existing.command_allowlist) ? existing.command_allowlist : []).filter((entry) => {
+		if (!isMcpAllowlistEntry(entry) || nextAllowlist.includes(entry)) return false;
+		const parsed = parseMcpAllowlistEntry(entry);
+		if (parsed !== null && isMcpToolRestricted(nextPermission, parsed.server, parsed.tool)) return false;
+		const category = mcpAllowlistEntryToCategory(entry);
+		return category === null || !Object.hasOwn(previousPermission, category) && !Object.hasOwn(nextPermission, category);
+	});
+}
+/** The validated canonical `permission` block of a config's `permissions.rulesync` blob. */
+function canonicalPermissionOf(config) {
+	const parsed = RulesyncPermissionsFileSchema.safeParse({ permission: provenancePermissionOf(config) });
+	return parsed.success ? parsed.data.permission : {};
+}
+/** The canonical `permission` block of a config's `permissions.rulesync` blob, if any. */
+function provenancePermissionOf(config) {
+	const permissionsRoot = isRecord(config.permissions) ? config.permissions : {};
+	const provenance = isRecord(permissionsRoot.rulesync) ? permissionsRoot.rulesync : {};
+	return isRecord(provenance.permission) ? provenance.permission : {};
+}
 /**
 * Make the native `command_allowlist` authoritative for the `bash` allow rules
 * it can speak for, and for those only. The allowlist is a list of shell-command
@@ -93392,8 +94277,9 @@ function reconcileCommandAllowlist({ permission, commandAllowlist }) {
 		writesAllToolsDeny: false
 	});
 	const withheld = new Set(shadowedAllowPatterns);
+	const isWithheld = (pattern) => withheld.has(pattern) || isMcpAllowlistEntry(pattern);
 	const rules = ensureCategory(permission, SHELL_PERMISSION_CATEGORY);
-	for (const [pattern, action] of Object.entries(rules)) if (action === "allow" && !withheld.has(pattern)) delete rules[pattern];
+	for (const [pattern, action] of Object.entries(rules)) if (action === "allow" && !isWithheld(pattern)) delete rules[pattern];
 	for (const pattern of commandAllowlist) rules[pattern] = "allow";
 }
 /**
@@ -93481,17 +94367,31 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		return true;
 	}
 	setFileContent(fileContent) {
+		const patch = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.fileContent
+		});
+		if (isStringArray(patch.command_allowlist)) {
+			const existing = parseSharedConfig({
+				format: "yaml",
+				fileContent
+			});
+			const kept = unmanagedMcpAllowlistEntries({
+				existing,
+				previousPermission: provenancePermissionOf(existing),
+				nextPermission: canonicalPermissionOf(patch),
+				nextAllowlist: patch.command_allowlist
+			});
+			if (kept.length > 0) patch.command_allowlist = [...patch.command_allowlist, ...kept];
+		}
 		this.fileContent = applySharedConfigPatch({
 			fileKey: getHermesagentConfigSharedFileKey({ global: this.global }),
 			feature: "permissions",
 			existingContent: fileContent,
-			patch: parseSharedConfig({
-				format: "yaml",
-				fileContent: this.fileContent
-			})
+			patch
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const config = parseSharedConfig({
 			format: "yaml",
 			fileContent: this.getFileContent()
@@ -93503,9 +94403,15 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		}) : rawProvenance);
 		const provenance = parsedProvenance.success ? parsedProvenance.data : { permission: {} };
 		const permission = clonePermissionBlock(provenance.permission);
+		const commandAllowlist = isStringArray(config.command_allowlist) ? config.command_allowlist : [];
 		reconcileCommandAllowlist({
 			permission,
-			commandAllowlist: isStringArray(config.command_allowlist) ? config.command_allowlist : []
+			commandAllowlist: commandAllowlist.filter((entry) => !isMcpAllowlistEntry(entry))
+		});
+		reconcileMcpAllowlist({
+			permission,
+			mcpEntries: commandAllowlist.filter(isMcpAllowlistEntry),
+			logger
 		});
 		const approvals = isRecord(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
@@ -93563,8 +94469,16 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			logger
 		});
 		const webfetchDeny = patternsByAction(permissionBlock[WEBFETCH_PERMISSION_CATEGORY], "deny");
+		const mcpAllows = collectMcpAllowlistEntries(permissionBlock);
+		warnAboutUnwrittenMcpAllows({
+			...mcpAllows,
+			logger
+		});
+		const bashMcpAllows = commandAllowlist.filter(isMcpAllowlistEntry);
+		if (bashMcpAllows.length > 0) warnWithFallback(logger, `Hermes Agent reads 'mcp:' entries in command_allowlist as MCP tool grants, so the bash allow rule(s) ${bashMcpAllows.join(", ")} were skipped; write them as a '*' allow on an 'mcp__<server>__<tool>' category instead.`);
+		const allowlist = [...commandAllowlist.filter((entry) => !isMcpAllowlistEntry(entry)), ...mcpAllows.entries];
 		let config = {};
-		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
+		if (allowlist.length > 0) config.command_allowlist = allowlist;
 		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
 		if (webfetchDeny.length > 0) config.security = { website_blocklist: {
 			enabled: true,
@@ -100405,6 +101319,7 @@ const TAKT_SECURITY_POLICIES = {
 	],
 	workflow_runtime_prepare: ["custom_scripts"],
 	workflow_command_gates: ["custom_scripts"],
+	workflow_system_commands: ["custom_scripts"],
 	sync_conflict_resolver: ["auto_approve_tools"],
 	allow_git_hooks: null,
 	allow_git_filters: null