rulesync 43.5.0 → 43.6.0

package/dist/{import-C_XK2L62.js → import--Y_A56qx.js}

@@ -873,6 +873,7 @@ const hooksProcessorToolTargetTuple = [
 	"qwencode",
 	"reasonix",
 	"tabnine",
+	"trae",
 	"grokcli",
 	"gitlabduo",
 	"lettacode",
@@ -3923,6 +3924,7 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".poolside/settings.yaml",
 	".config/poolside/settings.yaml",
 	".tabnine/agent/settings.json",
+	".trae/hooks.json",
 	".vibe/config.toml",
 	".zcode/config.json",
 	".zcode/cli/config.json",
@@ -6005,6 +6007,34 @@ const CANONICAL_TO_CORTEXCODE_EVENT_NAMES = {
 };
 const CORTEXCODE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_CORTEXCODE_EVENT_NAMES);
 /**
+* Hook events supported by TRAE.
+*
+* TRAE reads `.trae/hooks.json` (project) and `~/.trae/hooks.json` (user):
+* `{ "version"?: 1, "hooks": { "<Event>": [{ "matcher"?, "hooks": [{ "type":
+* "command", "command", "timeout"? }] }] } }` with Claude-Code-style
+* PascalCase event names. `$TRAE_PROJECT_DIR` resolves to the workspace root
+* inside commands.
+*
+* @see https://docs.trae.ai/ide/hook-configuration-reference?_lang=en
+*/
+const TRAE_HOOK_EVENTS = [
+	"sessionStart",
+	"beforeSubmitPrompt",
+	"preToolUse",
+	"postToolUse",
+	"stop",
+	"notification"
+];
+const CANONICAL_TO_TRAE_EVENT_NAMES = {
+	sessionStart: "SessionStart",
+	beforeSubmitPrompt: "UserPromptSubmit",
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	stop: "Stop",
+	notification: "Notification"
+};
+const TRAE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_TRAE_EVENT_NAMES);
+/**
 * Hook events supported by CodeBuddy Code.
 *
 * CodeBuddy Code reads hooks from the `hooks` key of `.codebuddy/settings.json`
@@ -6477,6 +6507,7 @@ const HooksConfigSchema = z.looseObject({
 	bob: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	codebuddy: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	cortexcode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
+	trae: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	commandcode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	lettacode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	continue: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
@@ -14159,6 +14190,14 @@ const SHARED_CONFIG_OWNERSHIP = {
 			}
 		}
 	},
+	".trae/hooks.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { hooks: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["hooks"]
+		} }
+	},
 	".trae/permission/global.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -23284,10 +23323,13 @@ var TaktCommand = class TaktCommand extends ToolCommand {
 * @see https://docs.trae.ai/ide/slash-commands?_lang=en
 * @see https://docs.trae.ai/ide/ignore-files?_lang=en
 * @see https://docs.trae.ai/ide/permission-and-approval?_lang=en
+* @see https://docs.trae.ai/ide/hook-configuration-reference?_lang=en
 */
 const TRAE_DIR = ".trae";
 /** Project MCP servers (`mcpServers` object), project scope only. */
 const TRAE_MCP_FILE_NAME = "mcp.json";
+/** Hooks: `.trae/hooks.json` (project) and `~/.trae/hooks.json` (global). */
+const TRAE_HOOKS_FILE_NAME = "hooks.json";
 /** Skills: `.trae/skills/<name>/SKILL.md` (project) and `~/.trae/skills/` (global). */
 const TRAE_SKILLS_DIR_PATH = join(TRAE_DIR, "skills");
 /**
@@ -25212,12 +25254,80 @@ var AiassistantSkill = class AiassistantSkill extends ToolSkill {
 		});
 	}
 };
+// src/features/shared/amp-settings.ts
+/**
+* Parse an Amp `settings.json` / `settings.jsonc` document.
+*
+* Shared by the MCP and permissions adapters because both read the very same
+* file. Two separately maintained copies drifted once already: the permissions
+* side was hardened while the MCP side kept calling `jsonc-parser` directly,
+* which left it importing MCP servers reachable only through an injected
+* `__proto__`.
+*
+* {@link parseJsonc} is the strict, sanitizing parser: it throws on any syntax
+* error instead of returning `jsonc-parser`'s best-effort value, and it
+* rebuilds every object from its own enumerable entries, so a root `__proto__`
+* cannot swap the returned object's prototype and `constructor` / `prototype`
+* never survive as own keys, at any depth.
+*
+* Removal is silent, matching every other tool-side adapter (opencode, kilo,
+* copilot). Reporting the removed keys through `droppedPollutionKeysError` is
+* reserved for the three files a user authors under `.rulesync/`, whose whole
+* purpose is to be turned into tool config — a key that vanishes there needs
+* explaining, whereas here the surrounding settings are the user's own file
+* and are left alone.
+*
+* Note the consequence for a root `__proto__`: sanitizing runs before the
+* plain-object check, so such a document parses successfully with the key
+* stripped rather than failing that check. That is deliberate — dropping the
+* one poisoned key keeps the user's unrelated settings — and matches the
+* sanitize-before-the-root-check design the shared config gateway documents.
+*/
+function parseAmpSettings({ fileContent }) {
+	let parsed;
+	try {
+		parsed = parseJsonc(fileContent || "{}");
+	} catch (error) {
+		throw new Error(`Failed to parse Amp settings: ${formatError(error)}`, { cause: error });
+	}
+	if (!isPlainObject(parsed)) throw new Error("Amp settings must be a JSON object");
+	return parsed;
+}
+/**
+* Probe `<jsonDir>/settings.jsonc` first, falling back to `settings.json`, so
+* an existing user file is read-modified-written in place instead of a fresh
+* `.json` sibling being created next to a hand-authored `.jsonc`. Defaults to
+* `settings.json` when neither file exists: Amp's canonically documented
+* settings file (`.amp/settings.json`), shared by the MCP and permissions
+* adapters, so generating both on a clean repo writes a single settings file.
+*/
+async function resolveAmpSettingsFile(jsonDir) {
+	const jsoncContent = await readFileContentOrNull(join(jsonDir, AMP_SETTINGS_JSONC_FILE_NAME));
+	if (jsoncContent !== null) return {
+		fileContent: jsoncContent,
+		relativeFilePath: AMP_SETTINGS_JSONC_FILE_NAME
+	};
+	const jsonContent = await readFileContentOrNull(join(jsonDir, AMP_SETTINGS_FILE_NAME));
+	if (jsonContent !== null) return {
+		fileContent: jsonContent,
+		relativeFilePath: AMP_SETTINGS_FILE_NAME
+	};
+	return {
+		fileContent: null,
+		relativeFilePath: AMP_SETTINGS_FILE_NAME
+	};
+}
 // src/features/skills/amp-skill.ts
 const AmpSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string()
 });
 /**
+* Amp setting that makes it skip `~/.config/agents/skills/` and
+* `~/.agents/skills/`. https://ampcode.com/docs/cli/settings
+*/
+const AMP_DISABLE_GLOBAL_AGENTS_SKILLS_KEY = "amp.skills.disableGlobalAgentsSkills";
+/**
 * Represents an Amp Agent Skill directory.
 *
 * Amp natively reads Agent Skills following the open standard: a directory with a
@@ -25252,6 +25362,27 @@ var AmpSkill = class AmpSkill extends ToolSkill {
 			...global && { importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH, AMP_SKILLS_NATIVE_GLOBAL_DIR] }
 		};
 	}
+	/**
+	* Warn when the user's Amp settings disable the global agent-agnostic skill
+	* roots, because the global skills rulesync writes to
+	* `~/.config/agents/skills/` would then never load. Only the user settings
+	* file is checked: a workspace `.amp/settings.json(c)` depends on where Amp
+	* is started, which global generation cannot know.
+	*/
+	static async getGenerationWarnings({ outputRoot, global, logger }) {
+		if (!global) return [];
+		const { fileContent, relativeFilePath } = await resolveAmpSettingsFile(join(outputRoot, AMP_GLOBAL_DIR));
+		if (fileContent === null) return [];
+		let settings;
+		try {
+			settings = parseAmpSettings({ fileContent });
+		} catch (error) {
+			logger.debug(`Skipping the Amp skills settings check for ${join(AMP_GLOBAL_DIR, relativeFilePath)}: ${formatError(error)}`);
+			return [];
+		}
+		if (settings[AMP_DISABLE_GLOBAL_AGENTS_SKILLS_KEY] !== true) return [];
+		return [`Amp will not load the global skills rulesync writes to ~/${AMP_SKILLS_GLOBAL_DIR}/: '${AMP_DISABLE_GLOBAL_AGENTS_SKILLS_KEY}' is true in ~/${join(AMP_GLOBAL_DIR, relativeFilePath)}.`];
+	}
 	getFrontmatter() {
 		return AmpSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
 	}
@@ -33228,7 +33359,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 	async convertRulesyncDirsToToolDirs(rulesyncDirs) {
 		const rulesyncSkills = rulesyncDirs.filter((dir) => dir instanceof RulesyncSkill);
 		const factory = this.getFactory(this.toolTarget);
-		return (await Promise.all(rulesyncSkills.map(async (rulesyncSkill) => {
+		const toolSkills = (await Promise.all(rulesyncSkills.map(async (rulesyncSkill) => {
 			const isClaudecodeScheduledTask = rulesyncSkill.getFrontmatter().claudecode?.["scheduled-task"] === true;
 			if (isClaudecodeScheduledTask && this.toolTarget !== "claudecode" && this.toolTarget !== "claudecode-legacy") return null;
 			if (!factory.class.isTargetedByRulesyncSkill(rulesyncSkill)) return null;
@@ -33255,6 +33386,15 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 				logger: this.logger
 			});
 		}))).filter((skill) => skill !== null);
+		if (toolSkills.length > 0 && factory.class.getGenerationWarnings) {
+			const warnings = await factory.class.getGenerationWarnings({
+				outputRoot: this.outputRoot,
+				global: this.global,
+				logger: this.logger
+			});
+			for (const warning of warnings) this.logger.warn(warning);
+		}
+		return toolSkills;
 	}
 	async convertToolDirsToRulesyncDirs(toolDirs) {
 		const toolSkills = toolDirs.filter((dir) => dir instanceof ToolSkill);
@@ -47460,6 +47600,45 @@ var DshRule = class DshRule extends NestedAgentsmdRule {
 		};
 	}
 };
+// src/features/rules/output-style-paths.ts
+/**
+* Shared helpers for tool rule adapters that write opted-in rules as custom
+* output styles (`<tool dir>/output-styles/<name>.md`), e.g. Qoder and
+* Factory Droid. Both tools read only the direct `.md` children of their
+* output-styles directory, with optional `name` / `description` frontmatter.
+*/
+/**
+* Whether the given path is a direct `.md` child of `outputStylesDirPath`.
+*/
+function isDirectMarkdownChild({ outputStylesDirPath, relativeDirPath, relativeFilePath }) {
+	return relativeDirPath === outputStylesDirPath && extname(relativeFilePath) === ".md" && basename(relativeFilePath) === relativeFilePath;
+}
+/**
+* Whether a rule opts into the `output-style` channel: only a non-root rule
+* can, since an output style is a file of its own.
+*/
+function isOutputStyleChannel({ root, channel }) {
+	return !root && channel === "output-style";
+}
+/**
+* Return the file stem of an output-style source rule, throwing `message`
+* when the rule is nested in a subdirectory of the rules directory: the
+* output file is named after the rule, and the tools read only the top level
+* of their output-styles directory.
+*/
+function resolveTopLevelOutputStyleStem({ sourcePath, message }) {
+	if (basename(sourcePath) !== sourcePath) throw new Error(message);
+	return basename(sourcePath, extname(sourcePath));
+}
+/**
+* The output style's frontmatter: only the `name` and `description` that are set.
+*/
+function buildOutputStyleFrontmatter({ name, description }) {
+	return {
+		...name !== void 0 && { name },
+		...description !== void 0 && { description }
+	};
+}
 // src/features/rules/factorydroid-rule.ts
 /**
 * The file-name glob `getExtraFixedFiles` returns for the output-styles
@@ -47564,7 +47743,11 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	* child of the output-styles directory, at either scope.
 	*/
 	static isOutputStylePath({ relativeDirPath, relativeFilePath }) {
-		return relativeDirPath === this.getOutputStylesDirPath() && extname(relativeFilePath) === ".md" && basename(relativeFilePath) === relativeFilePath;
+		return isDirectMarkdownChild({
+			outputStylesDirPath: this.getOutputStylesDirPath(),
+			relativeDirPath,
+			relativeFilePath
+		});
 	}
 	/**
 	* Which fixed-file channel, if any, owns the given output path. Matching on
@@ -47604,7 +47787,10 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	/** Whether a rule opts into the `output-style` channel (non-root only). */
 	static isOutputStyleRule(rulesyncRule) {
 		const frontmatter = rulesyncRule.getFrontmatter();
-		return !frontmatter.root && frontmatter.factorydroid?.channel === "output-style";
+		return isOutputStyleChannel({
+			root: frontmatter.root,
+			channel: frontmatter.factorydroid?.channel
+		});
 	}
 	/**
 	* Factory Droid loads the channel files itself, so listing one in the root
@@ -47736,15 +47922,17 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	static buildOutputStyle({ outputRoot, rulesyncRule, validate }) {
 		const frontmatter = rulesyncRule.getFrontmatter();
 		const sourcePath = rulesyncRule.getRelativeFilePath();
-		if (basename(sourcePath) !== sourcePath) throw new Error(`Rule '${sourcePath}' sets factorydroid.channel: output-style but is nested in a subdirectory: Factory Droid loads only direct .md children of .factory/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
-		const stem = basename(sourcePath, extname(sourcePath));
+		const stem = resolveTopLevelOutputStyleStem({
+			sourcePath,
+			message: `Rule '${sourcePath}' sets factorydroid.channel: output-style but is nested in a subdirectory: Factory Droid loads only direct .md children of .factory/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`
+		});
 		const name = frontmatter.factorydroid?.name;
 		const styleName = name ?? stem;
 		if (FACTORYDROID_RESERVED_OUTPUT_STYLE_NAMES.includes(styleName.trim().toLowerCase())) throw new Error(`Rule '${sourcePath}' sets factorydroid.channel: output-style with the style name '${styleName}', which is reserved: Factory Droid's built-in Default and Concise styles cannot be replaced. Rename the rule file or set factorydroid.name.`);
-		const styleFrontmatter = {
-			...name !== void 0 && { name },
-			...frontmatter.description !== void 0 && { description: frontmatter.description }
-		};
+		const styleFrontmatter = buildOutputStyleFrontmatter({
+			name,
+			description: frontmatter.description
+		});
 		const body = rulesyncRule.getBody();
 		return new FactorydroidRule({
 			outputRoot,
@@ -49380,12 +49568,19 @@ var QoderRule = class QoderRule extends ToolRule {
 	* `.qoder/output-styles/`, at either scope.
 	*/
 	static isOutputStylePath({ relativeDirPath, relativeFilePath }) {
-		return relativeDirPath === QODER_OUTPUT_STYLES_DIR_PATH && extname(relativeFilePath) === ".md" && basename(relativeFilePath) === relativeFilePath;
+		return isDirectMarkdownChild({
+			outputStylesDirPath: QODER_OUTPUT_STYLES_DIR_PATH,
+			relativeDirPath,
+			relativeFilePath
+		});
 	}
 	/** Whether a rule opts into the `output-style` channel (non-root only). */
 	static isOutputStyleRule(rulesyncRule) {
 		const frontmatter = rulesyncRule.getFrontmatter();
-		return !frontmatter.root && frontmatter.qoder?.channel === "output-style";
+		return isOutputStyleChannel({
+			root: frontmatter.root,
+			channel: frontmatter.qoder?.channel
+		});
 	}
 	/**
 	* The output-styles directory, enumerated for import only: it also holds
@@ -49496,16 +49691,18 @@ var QoderRule = class QoderRule extends ToolRule {
 	static buildOutputStyle({ outputRoot, rulesyncRule, validate }) {
 		const { description, qoder } = rulesyncRule.getFrontmatter();
 		const sourcePath = rulesyncRule.getRelativeFilePath();
-		if (basename(sourcePath) !== sourcePath) throw new Error(`Rule '${sourcePath}' sets qoder.channel: output-style but is nested in a subdirectory: Qoder reads only the files directly in .qoder/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
-		const name = qoder?.name;
+		const stem = resolveTopLevelOutputStyleStem({
+			sourcePath,
+			message: `Rule '${sourcePath}' sets qoder.channel: output-style but is nested in a subdirectory: Qoder reads only the files directly in .qoder/output-styles/, so move it to the top of ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`
+		});
 		return new QoderRule({
 			outputRoot,
 			relativeDirPath: QODER_OUTPUT_STYLES_DIR_PATH,
-			relativeFilePath: `${basename(sourcePath, extname(sourcePath))}.md`,
-			frontmatter: {
-				...name !== void 0 && { name },
-				...description !== void 0 && { description }
-			},
+			relativeFilePath: `${stem}.md`,
+			frontmatter: buildOutputStyleFrontmatter({
+				name: qoder?.name,
+				description
+			}),
 			body: rulesyncRule.getBody(),
 			validate,
 			root: false,
@@ -56183,9 +56380,9 @@ function groupDefinitionsByMatcher({ definitions, eventName, converterConfig, wa
 			});
 			translatedMatchers.set(normalizedMatcher, matcher);
 		}
-		const key = [matcher, ...subdividingFields.map(({ canonical, valueType }) => {
+		const key = [matcher, ...subdividingFields.map(({ canonical, valueType, events }) => {
 			const value = def[canonical];
-			return isGroupPassthroughValue(value, valueType) ? stableJson(value) : "";
+			return isGroupFieldOnEvent(events, eventName) && isGroupPassthroughValue(value, valueType) ? stableJson(value) : "";
 		})].join("\0");
 		const group = byMatcher.get(key);
 		if (group) group.defs.push(def);
@@ -56226,6 +56423,7 @@ function runsInPosixShell({ shell, converterConfig }) {
 * Apply the optional project directory variable prefix to a command string.
 */
 function applyCommandPrefix({ def, converterConfig }) {
+	if (converterConfig.stripsProjectDirVarOnImportOnly) return def.command;
 	const commandText = def.command;
 	const trimmedCommand = typeof commandText === "string" ? commandText.trimStart() : void 0;
 	const unquotedCommand = trimmedCommand?.replace(/^["']/, "");
@@ -56434,12 +56632,16 @@ const describeInvalidObject = ({ tool, canonical, value }) => isPlainObject(valu
 	value
 })} Importing it would fail validation on the next run.` : `Dropping "${tool}" while importing a hook: it must be an object.`;
 const describeInvalidRecord = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a map of strings whose keys are non-empty and free of "=", and whose keys and values carry no newline, carriage return or NUL characters.`;
+function isGroupFieldOnEvent(events, eventName) {
+	return events === void 0 || events.has(eventName);
+}
 /**
 * Check a value against the shape its field documents. A string field also
 * rejects control characters, matching the canonical `safeString` so an
 * imported value cannot fail validation on the next generate.
 */
 function isGroupPassthroughValue(value, valueType = "object") {
+	if (valueType === "number") return typeof value === "number" && Number.isFinite(value);
 	if (valueType === "string") return typeof value === "string" && !CONTROL_CHARS.some((char) => value.includes(char));
 	return isPlainObject(value);
 }
@@ -56449,10 +56651,14 @@ function isGroupPassthroughValue(value, valueType = "object") {
 */
 function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }) {
 	const emitted = {};
-	for (const { canonical, tool, valueType } of converterConfig.groupPassthroughFields ?? []) {
+	for (const { canonical, tool, valueType, events } of converterConfig.groupPassthroughFields ?? []) {
 		const carried = defs.map((def) => def[canonical]);
 		const first = carried.find((value) => isGroupPassthroughValue(value, valueType));
 		if (first === void 0) continue;
+		if (!isGroupFieldOnEvent(events, eventName)) {
+			logger?.warn(`"${canonical}" on "${eventName}" hooks is ignored — the tool supports "${tool}" only on ${[...events ?? []].map((event) => `"${event}"`).join(", ")} hooks.`);
+			continue;
+		}
 		const firstStable = stableJson(first);
 		const agrees = (value) => isGroupPassthroughValue(value, valueType) && stableJson(value) === firstStable;
 		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${quoteValueForWarning(first)} — including any that asked for something else, or for nothing.`);
@@ -56464,9 +56670,9 @@ function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }
 * Import the configured group-level passthrough fields onto a definition,
 * reversing {@link emitGroupPassthroughFields}.
 */
-function importGroupPassthroughFields({ rawEntry, converterConfig }) {
+function importGroupPassthroughFields({ rawEntry, eventName, converterConfig }) {
 	const entry = rawEntry;
-	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool, valueType }) => isGroupPassthroughValue(entry[tool], valueType)).map(({ canonical, tool }) => [canonical, entry[tool]]));
+	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool, valueType, events }) => isGroupFieldOnEvent(events, eventName) && isGroupPassthroughValue(entry[tool], valueType)).map(({ canonical, tool }) => [canonical, entry[tool]]));
 }
 /**
 * Emit the payload fields specific to a hook type — `url`/`headers`/
@@ -56792,19 +56998,23 @@ function stripCommandPrefix({ command, args, shell, converterConfig, warn }) {
 	const cmd = typeof command === "string" ? command : void 0;
 	const { projectDirVar } = converterConfig;
 	if (projectDirVar === "" || typeof cmd !== "string") return cmd;
-	const { command: stripped, unrestored, retained } = importProjectDirVariable({
-		command: cmd,
-		projectDirVar,
-		firstWordOnly: isExecFormHook({
-			args,
-			converterConfig
-		}) || !runsInPosixShell({
-			shell,
-			converterConfig
-		})
-	});
-	if (warn && unrestored) warn(`Hook command ${quoteValueForWarning(cmd)} was imported as ${quoteValueForWarning(stripped)}: a ${projectDirVar} path that is not a script the command runs becomes relative to the hook's working directory and is not restored on generate. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") to keep the variable.`);
-	if (warn && retained) warn(`Hook command ${quoteValueForWarning(cmd)} keeps ${projectDirVar} in an assignment or option value, or in a later word of a command whose later words are not normalized, so the imported command still refers to it and other tools that do not define it receive it verbatim. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") if other tools should not see it.`);
+	let stripped = cmd;
+	for (const variable of [projectDirVar, ...converterConfig.importedProjectDirVarAliases ?? []]) {
+		const result = importProjectDirVariable({
+			command: stripped,
+			projectDirVar: variable,
+			firstWordOnly: isExecFormHook({
+				args,
+				converterConfig
+			}) || !runsInPosixShell({
+				shell,
+				converterConfig
+			})
+		});
+		stripped = result.command;
+		if (warn && result.unrestored && !converterConfig.stripsProjectDirVarOnImportOnly) warn(`Hook command ${quoteValueForWarning(cmd)} was imported as ${quoteValueForWarning(stripped)}: a ${variable} path that is not a script the command runs becomes relative to the hook's working directory and is not restored on generate. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") to keep the variable.`);
+		if (warn && result.retained) warn(`Hook command ${quoteValueForWarning(cmd)} keeps ${variable} in an assignment or option value, or in a later word of a command whose later words are not normalized, so the imported command still refers to it and other tools that do not define it receive it verbatim. Put the exact command in a tool-specific hooks override (such as "claudecode.hooks") if other tools should not see it.`);
+	}
 	return stripped;
 }
 /**
@@ -56845,7 +57055,7 @@ function isStringRecord(value) {
 }
 /** Compare object values without letting key order decide the answer. */
 function stableJson(value) {
-	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value !== "object") return JSON.stringify(value);
 	return JSON.stringify(Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a.localeCompare(b))));
 }
 /**
@@ -57085,6 +57295,7 @@ function toolHookToCanonical({ h, rawEntry, eventName, converterConfig, warn })
 		}),
 		...importGroupPassthroughFields({
 			rawEntry,
+			eventName,
 			converterConfig
 		}),
 		...matcher !== void 0 && matcher !== null && matcher !== "" && { matcher }
@@ -57137,15 +57348,26 @@ function definingFields({ h, rawEntry, hookType, converterConfig }) {
 * is the group-level twin of `matcher`: importing the group without it would
 * widen every hook in it, so the group is skipped instead.
 */
-function describeGroupSkipReason({ rawEntry, converterConfig }) {
+function describeGroupSkipReason({ rawEntry, eventName, converterConfig }) {
 	const entry = rawEntry;
-	for (const { tool, valueType, subdividesGroup } of converterConfig.groupPassthroughFields ?? []) {
+	for (const { tool, valueType, subdividesGroup, events, onInvalidImport } of converterConfig.groupPassthroughFields ?? []) {
 		const value = entry[tool];
-		if (subdividesGroup !== true || value === void 0) continue;
+		if (subdividesGroup !== true || onInvalidImport === "drop-field" || value === void 0 || !isGroupFieldOnEvent(events, eventName)) continue;
 		if (!isGroupPassthroughValue(value, valueType)) return `Skipping the hooks of a matcher group while importing: its "${tool}" (${quoteValueForWarning(value)}) is unusable, and these hooks run only where it matches. Importing them without it would widen when they fire, so they are skipped.`;
 	}
 }
 /**
+* Warn about each `"drop-field"` group value that is present but unusable;
+* {@link importGroupPassthroughFields} leaves it off the imported hooks.
+*/
+function warnDroppedGroupFields({ rawEntry, eventName, converterConfig, warn }) {
+	const entry = rawEntry;
+	for (const { tool, valueType, events, onInvalidImport } of converterConfig.groupPassthroughFields ?? []) {
+		const value = entry[tool];
+		if (onInvalidImport === "drop-field" && value !== void 0 && isGroupFieldOnEvent(events, eventName) && !isGroupPassthroughValue(value, valueType)) warn?.(`Dropping the unusable "${tool}" (${quoteValueForWarning(value)}) of a "${eventName}" matcher group while importing; its hooks are imported without it.`);
+	}
+}
+/**
 * Why this hook cannot be imported, or `undefined` when it can.
 */
 function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
@@ -57172,12 +57394,19 @@ function toolMatcherEntryToCanonical({ rawEntry, eventName, converterConfig, war
 	const hookDefs = rawEntry.hooks ?? [];
 	const groupSkipReason = describeGroupSkipReason({
 		rawEntry,
+		eventName,
 		converterConfig
 	});
 	if (groupSkipReason !== void 0) {
 		warn?.(groupSkipReason);
 		return [];
 	}
+	warnDroppedGroupFields({
+		rawEntry,
+		eventName,
+		converterConfig,
+		warn
+	});
 	const definitions = [];
 	for (const h of hookDefs) {
 		const skipReason = describeHookSkipReason({
@@ -60516,6 +60745,23 @@ var CopilotcliHooks = class CopilotcliHooks extends ToolHooks {
 		});
 	}
 };
+// src/features/hooks/hook-matcher-tool-names.ts
+const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
+function isMatcherName(token) {
+	return !token.startsWith("\\") && !token.startsWith("[");
+}
+/**
+* Rewrites the whole tool names inside a hook `matcher` regex through `names`,
+* leaving escapes, character classes and unknown names as written. Used by
+* adapters whose runtime tool names differ from the canonical (Claude Code)
+* spelling.
+*/
+function replaceMatcherNames(matcher, names) {
+	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
+}
+function invertToolNames(names) {
+	return Object.fromEntries(Object.entries(names).map(([canonical, tool]) => [tool, canonical]));
+}
 // src/features/hooks/cortexcode-hooks.ts
 const CORTEXCODE_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]);
 const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
@@ -60526,14 +60772,7 @@ const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
 	Grep: "grep",
 	Glob: "glob"
 };
-const CORTEXCODE_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CORTEXCODE_TOOL_NAMES).map(([canonical, tool]) => [tool, canonical]));
-const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
-function isMatcherName(token) {
-	return !token.startsWith("\\") && !token.startsWith("[");
-}
-function replaceMatcherNames(matcher, names) {
-	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
-}
+const CORTEXCODE_TO_CANONICAL_TOOL_NAMES = invertToolNames(CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
 function canonicalToCortexcodeMatcher({ matcher, eventName, warn }) {
 	const translated = replaceMatcherNames(matcher, CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
 	const unmatched = [...translated.matchAll(MATCHER_TOKEN_PATTERN)].map(([token]) => token).filter((token) => isMatcherName(token) && /^[A-Z]/.test(token));
@@ -65694,6 +65933,61 @@ var TabnineHooks = class TabnineHooks extends ToolHooks {
 		});
 	}
 };
+// src/features/hooks/trae-hooks.ts
+const TRAE_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"sessionStart",
+	"beforeSubmitPrompt",
+	"stop"
+]);
+const CANONICAL_TO_TRAE_TOOL_NAMES = { Bash: "RunCommand" };
+const TRAE_TO_CANONICAL_TOOL_NAMES = invertToolNames(CANONICAL_TO_TRAE_TOOL_NAMES);
+const TRAE_SPEC = {
+	displayName: "TRAE",
+	overrideKey: "trae",
+	converterConfig: {
+		supportedEvents: TRAE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_TRAE_EVENT_NAMES,
+		toolToCanonicalEventNames: TRAE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$TRAE_PROJECT_DIR",
+		stripsProjectDirVarOnImportOnly: true,
+		importedProjectDirVarAliases: ["$CLAUDE_PROJECT_DIR"],
+		noMatcherEvents: TRAE_NO_MATCHER_EVENTS,
+		supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+		groupPassthroughFields: [{
+			canonical: "loop_limit",
+			tool: "loop_limit",
+			valueType: "number",
+			events: /* @__PURE__ */ new Set(["stop"]),
+			subdividesGroup: true,
+			onInvalidImport: "drop-field"
+		}],
+		matcherTranslation: {
+			toTool: ({ matcher }) => replaceMatcherNames(matcher, CANONICAL_TO_TRAE_TOOL_NAMES),
+			toCanonical: (matcher) => replaceMatcherNames(matcher, TRAE_TO_CANONICAL_TOOL_NAMES)
+		}
+	}
+};
+/**
+* TRAE hooks.
+*
+* Hooks live under the top-level `hooks` key of the dedicated `.trae/hooks.json`
+* (project) and `~/.trae/hooks.json` (user scope). The IDE also writes a
+* `version` key there, so generation merges the `hooks` key into the file (see
+* `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
+*
+* @see https://docs.trae.ai/ide/hook-configuration-reference?_lang=en
+*/
+var TraeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return TRAE_SPEC;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: TRAE_DIR,
+			relativeFilePath: TRAE_HOOKS_FILE_NAME
+		};
+	}
+};
 // src/features/hooks/vibe-hooks.ts
 const VIBE_DIR = ".vibe";
 const VIBE_HOOKS_FILE_NAME = "hooks.toml";
@@ -66878,6 +67172,21 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command"],
 		supportsMatcher: true
 	}],
+	["trae", {
+		class: TraeHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		...converterCapabilities(TraeHooks.getConverterConfig()),
+		supportsMatcher: true,
+		matcherEvents: [
+			"preToolUse",
+			"postToolUse",
+			"notification"
+		]
+	}],
 	["vibe", {
 		class: VibeHooks,
 		meta: {
@@ -68986,69 +69295,6 @@ var AiassistantMcp = class extends ToolMcp {
 		});
 	}
 };
-// src/features/shared/amp-settings.ts
-/**
-* Parse an Amp `settings.json` / `settings.jsonc` document.
-*
-* Shared by the MCP and permissions adapters because both read the very same
-* file. Two separately maintained copies drifted once already: the permissions
-* side was hardened while the MCP side kept calling `jsonc-parser` directly,
-* which left it importing MCP servers reachable only through an injected
-* `__proto__`.
-*
-* {@link parseJsonc} is the strict, sanitizing parser: it throws on any syntax
-* error instead of returning `jsonc-parser`'s best-effort value, and it
-* rebuilds every object from its own enumerable entries, so a root `__proto__`
-* cannot swap the returned object's prototype and `constructor` / `prototype`
-* never survive as own keys, at any depth.
-*
-* Removal is silent, matching every other tool-side adapter (opencode, kilo,
-* copilot). Reporting the removed keys through `droppedPollutionKeysError` is
-* reserved for the three files a user authors under `.rulesync/`, whose whole
-* purpose is to be turned into tool config — a key that vanishes there needs
-* explaining, whereas here the surrounding settings are the user's own file
-* and are left alone.
-*
-* Note the consequence for a root `__proto__`: sanitizing runs before the
-* plain-object check, so such a document parses successfully with the key
-* stripped rather than failing that check. That is deliberate — dropping the
-* one poisoned key keeps the user's unrelated settings — and matches the
-* sanitize-before-the-root-check design the shared config gateway documents.
-*/
-function parseAmpSettings({ fileContent }) {
-	let parsed;
-	try {
-		parsed = parseJsonc(fileContent || "{}");
-	} catch (error) {
-		throw new Error(`Failed to parse Amp settings: ${formatError(error)}`, { cause: error });
-	}
-	if (!isPlainObject(parsed)) throw new Error("Amp settings must be a JSON object");
-	return parsed;
-}
-/**
-* Probe `<jsonDir>/settings.jsonc` first, falling back to `settings.json`, so
-* an existing user file is read-modified-written in place instead of a fresh
-* `.json` sibling being created next to a hand-authored `.jsonc`. Defaults to
-* `settings.json` when neither file exists: Amp's canonically documented
-* settings file (`.amp/settings.json`), shared by the MCP and permissions
-* adapters, so generating both on a clean repo writes a single settings file.
-*/
-async function resolveAmpSettingsFile(jsonDir) {
-	const jsoncContent = await readFileContentOrNull(join(jsonDir, AMP_SETTINGS_JSONC_FILE_NAME));
-	if (jsoncContent !== null) return {
-		fileContent: jsoncContent,
-		relativeFilePath: AMP_SETTINGS_JSONC_FILE_NAME
-	};
-	const jsonContent = await readFileContentOrNull(join(jsonDir, AMP_SETTINGS_FILE_NAME));
-	if (jsonContent !== null) return {
-		fileContent: jsonContent,
-		relativeFilePath: AMP_SETTINGS_FILE_NAME
-	};
-	return {
-		fileContent: null,
-		relativeFilePath: AMP_SETTINGS_FILE_NAME
-	};
-}
 // src/features/mcp/amp-mcp.ts
 const AMP_MCP_SERVERS_KEY = "amp.mcpServers";
 function filterMcpServers(mcpServers) {
@@ -72034,7 +72280,7 @@ var CopilotMcp = class CopilotMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { servers: convertToCopilotFormat(mcpServers) },
+				patch: { servers: undefinedWhenEmpty(convertToCopilotFormat(mcpServers)) },
 				filePath,
 				logger
 			}),
@@ -74355,14 +74601,20 @@ function resolveGooseUrl(config) {
 }
 /**
 * Determines the Goose `type` for a server based on its command/url/transport.
+*
+* Goose no longer has an SSE extension type (it skips a `type: sse` entry as
+* unsupported), so every remote server is written as `streamable_http`.
 */
 function resolveGooseType(config, url) {
 	if (config.command !== void 0) return "stdio";
-	if (url !== void 0) return canonicalTransport(config) === "sse" ? "sse" : "streamable_http";
+	if (url !== void 0) return "streamable_http";
 	return canonicalTransport(config) === "builtin" ? "builtin" : "stdio";
 }
 /**
-* The Goose extension types that carry an MCP server. Goose also documents
+* The Goose extension types that carry an MCP server. `sse` is no longer one
+* Goose reads, but it stays here so a stale `type: sse` entry is still
+* recognized: imported as canonical `sse` and replaced by the regenerated
+* same-name `streamable_http` entry. Goose also documents
 * `builtin`, `platform`, `frontend` and `inline_python` extensions, which have
 * no canonical MCP counterpart: they name capabilities Goose provides itself
 * rather than a server rulesync could describe.
@@ -74422,7 +74674,8 @@ function convertServerToGooseExtension(name, config, logger) {
 			warnWithFallback(logger, `Goose extension "${name}" has no command to run; skipping it rather than writing a stdio extension Goose cannot start to ~/.config/goose/config.yaml.`);
 			return;
 		}
-	} else if (gooseType === "sse" || gooseType === "streamable_http") {
+	} else if (gooseType === "streamable_http") {
+		if (canonicalTransport(config) === "sse") warnWithFallback(logger, `Goose extension "${name}" uses SSE, which Goose no longer supports; writing it as streamable_http, which only works if the server also speaks Streamable HTTP.`);
 		if (url !== void 0) ext.uri = url;
 		if (isPlainObject(config.headers)) ext.headers = omitPrototypePollutionKeys(config.headers);
 	}
@@ -74435,8 +74688,9 @@ function convertServerToGooseExtension(name, config, logger) {
 * Converts rulesync canonical MCP servers into Goose `extensions:` entries.
 *
 * Goose uses a non-standard schema: `name`, `type` (`stdio` | `streamable_http`
-* | `sse` | `builtin`), `cmd`/`args`/`envs` for stdio, `uri`/`headers` for
-* remote, plus `enabled` and `timeout`.
+* | `builtin`), `cmd`/`args`/`envs` for stdio, `uri`/`headers` for remote, plus
+* `enabled` and `timeout`. A canonical `sse` server is written as
+* `streamable_http` with a warning, since Goose dropped SSE support.
 *
 * `extensions:` is co-owned: alongside the MCP servers rulesync manages it also
 * holds Goose's own `builtin`/`platform`/`frontend`/`inline_python` extensions
@@ -74567,7 +74821,8 @@ function convertToGoosePluginMcpServers(mcpServers, logger) {
 *   `~/.config/goose/config.yaml`. That file also holds other Goose settings
 *   (model, provider, ...), so generation merges the `extensions:` block into the
 *   existing config instead of overwriting it, and the file is never deleted.
-*   This location supports both stdio and remote (http/sse) servers.
+*   This location supports both stdio and remote servers (SSE is written as
+*   `streamable_http`, since Goose no longer reads `type: sse`).
 * - **Project**: a stdio-only open-plugin manifest at
 *   `.agents/plugins/rulesync/.mcp.json` (Goose v1.39.0+), reusing the same
 *   `.agents/plugins/rulesync/` tree as Goose hooks. The manifest uses the
@@ -79285,6 +79540,7 @@ var VibeMcp = class VibeMcp extends ToolMcp {
 		const managedNames = new Set(Object.keys(rulesyncServers));
 		const mcpServers = Object.entries(rulesyncServers).map(([name, server]) => rulesyncMcpServerToVibe(name, server, existingByName.get(name)));
 		const unmanagedServers = existingServers.filter((server) => !managedNames.has(server.name));
+		const servers = [...mcpServers, ...unmanagedServers];
 		return new VibeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -79293,7 +79549,7 @@ var VibeMcp = class VibeMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { mcp_servers: [...mcpServers, ...unmanagedServers] },
+				patch: { mcp_servers: servers.length > 0 ? servers : void 0 },
 				filePath
 			}),
 			validate,
@@ -82717,6 +82973,20 @@ function isUnicodeClass(rest) {
 	}));
 }
 /**
+* Return a function that, for a `[:` at `index`, gives the position of the
+* next `:]` (Go reads everything between as the class name), or -1. The
+* position is cached and `index` only grows, so a long run of `[:` with no
+* `:]` costs linear time rather than a scan to the end at each one.
+*/
+function posixEndFinder(source) {
+	let next = -2;
+	return (index) => {
+		if (!source.startsWith("[:", index)) return -1;
+		if (next !== -1 && next < index + 2) next = source.indexOf(":]", index + 2);
+		return next;
+	};
+}
+/**
 * Replace each POSIX class (`[:alpha:]`) inside a bracket class with a plain
 * character, so JavaScript can compile the rest, or return `undefined` for an
 * unknown one. Only inside a bracket is `[:name:]` a POSIX class; a bare
@@ -82726,6 +82996,7 @@ function replacePosixClasses(source) {
 	let result = "";
 	let inClass = false;
 	let index = 0;
+	const findPosixEnd = posixEndFinder(source);
 	while (index < source.length) {
 		const character = source[index] ?? "";
 		if (character === "\\") {
@@ -82750,11 +83021,11 @@ function replacePosixClasses(source) {
 			}
 			continue;
 		}
-		const posix = /^\[:\^?([\s\S]*?):\]/.exec(source.slice(index));
-		if (posix !== null) {
-			if (!POSIX_CLASSES.has(posix[1] ?? "")) return;
+		const posixEnd = findPosixEnd(index);
+		if (posixEnd !== -1) {
+			if (!POSIX_CLASSES.has(source.slice(index + 2, posixEnd).replace(/^\^/, ""))) return;
 			result += "a";
-			index += posix[0].length;
+			index = posixEnd + 2;
 			continue;
 		}
 		if (character === "]") inClass = false;
@@ -82833,6 +83104,7 @@ function hasClassEscapeRangeEnd(source) {
 	let inClass = false;
 	let afterCharacter = false;
 	let index = 0;
+	const findPosixEnd = posixEndFinder(source);
 	while (index < source.length) {
 		const character = source[index] ?? "";
 		if (character === "\\") {
@@ -82848,7 +83120,7 @@ function hasClassEscapeRangeEnd(source) {
 			});
 			continue;
 		}
-		const posixEnd = source.startsWith("[:", index) ? source.indexOf(":]", index + 2) : -1;
+		const posixEnd = findPosixEnd(index);
 		if (character === "]" || posixEnd !== -1) {
 			inClass = character !== "]";
 			afterCharacter = false;
@@ -83410,6 +83682,8 @@ function buildToolPatternEntry({ toolName, pattern }) {
 * - `execute_url` takes a domain, like `read_url`.
 * - `command` and `unsandboxed` take literal words or a per-word `regex:`,
 *   matched word by word (see `antigravity-command-patterns.ts`).
+* - `mcp` takes `server/tool` or `server/*`, matched exactly. A canonical
+*   `mcp__<server>__<tool>` category is written as that target.
 *
 * A glob copied verbatim (`read_file(**\/*.env)`) is a literal path that
 * matches nothing, so a deny written that way blocks nothing. A pattern with
@@ -83433,7 +83707,8 @@ const DENY_HINTS = {
 	read_file: "deny a directory or file path instead",
 	write_file: "deny a directory or file path instead",
 	command: "deny the first words of the command instead",
-	unsandboxed: "deny the first words of the command instead"
+	unsandboxed: "deny the first words of the command instead",
+	mcp: "deny the whole MCP server or tool instead"
 };
 function hasGlob(pattern) {
 	return BRACE_ALTERNATIVES.test(pattern) || parseGlobPattern(pattern).steps.some((step) => step.kind !== "literal");
@@ -83489,6 +83764,40 @@ function toTarget(action, pattern) {
 	if (URL_ACTIONS.has(action)) return toUrlTarget(pattern);
 	return { target: pattern };
 }
+const MCP_CATEGORY_PREFIX = "mcp__";
+const MCP_TARGET_SEPARATORS = /[/()]/;
+/**
+* The `mcp` target of a canonical `mcp__<server>__<tool>` category:
+* `<server>/<tool>`, `<server>/*` for a whole server (`mcp__<server>`,
+* `mcp__<server>__*`), or `*` for every MCP tool (`mcp__*`, `mcp__*__*`). The
+* server ends at the first `__`, as elsewhere in rulesync. Antigravity matches
+* names exactly, so a glob, an empty name, or a `/` or parenthesis in a name
+* has no target; when only the tool part is at fault, its server is the `lead`
+* a deny widens to.
+*/
+function toMcpTarget(category) {
+	const remainder = category.slice(5);
+	const separator = remainder.indexOf("__");
+	const server = separator === -1 ? remainder : remainder.slice(0, separator);
+	const tool = separator === -1 ? "*" : remainder.slice(separator + 2);
+	if (server === "*" && tool === "*") return { target: "*" };
+	const skipReason = "Antigravity MCP targets name one server or one tool exactly. Only `mcp__<server>`, `mcp__<server>__*`, `mcp__<server>__<tool>` or `mcp__*` can be expressed";
+	if (server.length === 0 || MCP_TARGET_SEPARATORS.test(server) || hasGlob(server)) return { skipReason };
+	if (tool === "*") return { target: `${server}/*` };
+	return tool.length === 0 || MCP_TARGET_SEPARATORS.test(tool) || hasGlob(tool) ? {
+		skipReason,
+		lead: `${server}/*`
+	} : { target: `${server}/${tool}` };
+}
+/** The target of a canonical `mcp__...` rule, with the `lead` a deny widens to. */
+function toMcpRuleTarget(category, pattern) {
+	const target = toMcpTarget(category);
+	if (pattern === "*" || !("target" in target)) return target;
+	return {
+		skipReason: "Antigravity MCP targets name a server or a tool, not the tool's arguments",
+		lead: target.target
+	};
+}
 /**
 * The leading directories of a path glob (`src` for `src/*.ts`), or
 * `undefined` when it has none. A directory target covers everything inside
@@ -83511,6 +83820,20 @@ function toWidenedDenyTarget(action, pattern) {
 	if (ANTIGRAVITY_COMMAND_ACTIONS.has(action)) return toAntigravityCommandLiteralPrefix(pattern);
 	if (PATH_ACTIONS.has(action)) return toPathLiteralPrefix(pattern);
 }
+/** The entry a deny is widened to, and what it now blocks. */
+function describeWidenedDeny({ action, prefix, isMcp }) {
+	if (isMcp) return prefix === "*" ? {
+		entry: action,
+		scope: "every MCP tool"
+	} : {
+		entry: `${action}(${prefix})`,
+		scope: `every call of \`${action}(${prefix})\``
+	};
+	return {
+		entry: `${action}(${prefix})`,
+		scope: PATH_ACTIONS.has(action) ? `every path under \`${prefix}\`` : `every command that starts with \`${prefix}\``
+	};
+}
 /**
 * Warn about a path target that is a home or variable reference. Antigravity
 * documents absolute and workspace-relative paths only, so such a reference
@@ -83532,14 +83855,20 @@ function warnHomeOrVariablePath({ action, target, rule, decision, logger, toolLa
 * nothing enforces it, and a widened one is warned about too, because it
 * blocks more than it says.
 */
-function buildAntigravityPermissionEntry({ action, category, pattern, decision, logger, toolLabel }) {
-	const result = pattern === "*" ? { target: "*" } : toTarget(action, pattern);
+function buildAntigravityPermissionEntry({ action: toolAction, category, pattern, decision, logger, toolLabel }) {
+	const isMcp = category.startsWith(MCP_CATEGORY_PREFIX);
+	const action = isMcp ? "mcp" : toolAction;
+	const result = isMcp ? toMcpRuleTarget(category, pattern) : pattern === "*" ? { target: "*" } : toTarget(action, pattern);
 	const rule = `${category}: { "${pattern}": "${decision}" }`;
 	if ("skipReason" in result) {
-		const prefix = decision === "deny" ? toWidenedDenyTarget(action, pattern) : void 0;
+		const prefix = decision !== "deny" ? void 0 : isMcp ? result.lead : toWidenedDenyTarget(action, pattern);
 		if (prefix !== void 0) {
-			const scope = PATH_ACTIONS.has(action) ? `every path under \`${prefix}\`` : `every command that starts with \`${prefix}\``;
-			logger.warn(`${toolLabel} permissions: widening ${rule} to ${action}(${prefix}). ${result.skipReason}. The deny now blocks ${scope}, overriding any allow or ask for them.`);
+			const { entry, scope } = describeWidenedDeny({
+				action,
+				prefix,
+				isMcp
+			});
+			logger.warn(`${toolLabel} permissions: widening ${rule} to ${entry}. ${result.skipReason}. The deny now blocks ${scope}, overriding any allow or ask for them.`);
 			warnHomeOrVariablePath({
 				action,
 				target: prefix,
@@ -83548,7 +83877,7 @@ function buildAntigravityPermissionEntry({ action, category, pattern, decision,
 				logger,
 				toolLabel
 			});
-			return `${action}(${prefix})`;
+			return entry;
 		}
 		const consequence = decision === "deny" ? `This deny is NOT enforced in ${toolLabel}; ${DENY_HINTS[action] ?? "write it in a form Antigravity can match"}` : decision === "ask" ? `${toolLabel} falls back to its default for it, so it runs without a prompt when ${toolLabel} is set to always proceed` : `${toolLabel} falls back to its default for it`;
 		logger.warn(`${toolLabel} permissions: skipping ${rule}. ${result.skipReason}. ${consequence}.`);
@@ -83692,6 +84021,7 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 	mcp: "mcp"
 };
 function toAntigravityCliToolName(canonical) {
+	if (canonical.startsWith("mcp__")) return "mcp";
 	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
 }
 function toCanonicalToolName$9(cliName) {
@@ -83754,10 +84084,11 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			logger
 		});
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toAntigravityCliToolName(category)));
+		const isManagedToolName = (toolName) => managedToolNames.has(toolName) || managedToolNames.has("mcp") && toolName.startsWith("mcp__");
 		const existingPermissions = settings.permissions ?? {};
-		const preservedAllow = (existingPermissions.allow ?? []).filter((entry) => !managedToolNames.has(parseToolPatternEntry(entry).toolName));
-		const preservedAsk = (existingPermissions.ask ?? []).filter((entry) => !managedToolNames.has(parseToolPatternEntry(entry).toolName));
-		const preservedDeny = (existingPermissions.deny ?? []).filter((entry) => !managedToolNames.has(parseToolPatternEntry(entry).toolName));
+		const preservedAllow = (existingPermissions.allow ?? []).filter((entry) => !isManagedToolName(parseToolPatternEntry(entry).toolName));
+		const preservedAsk = (existingPermissions.ask ?? []).filter((entry) => !isManagedToolName(parseToolPatternEntry(entry).toolName));
+		const preservedDeny = (existingPermissions.deny ?? []).filter((entry) => !isManagedToolName(parseToolPatternEntry(entry).toolName));
 		const mergedPermissions = { ...existingPermissions };
 		const mergedAllow = uniq([...preservedAllow, ...allow].toSorted());
 		const mergedAsk = uniq([...preservedAsk, ...ask].toSorted());
@@ -83866,6 +84197,7 @@ const IDE_ACTION_TO_CANONICAL = {
 	mcp: "mcp"
 };
 function toIdeAction(canonical) {
+	if (canonical.startsWith("mcp__")) return "mcp";
 	return CANONICAL_TO_IDE_ACTION[canonical] ?? canonical;
 }
 function toCanonicalCategory$2(ideAction) {
@@ -83922,8 +84254,9 @@ var AntigravityIdePermissions = class AntigravityIdePermissions extends ToolPerm
 			logger
 		});
 		const managedActions = new Set(Object.keys(config.permission).map((category) => toIdeAction(category)));
+		const isManagedAction = (action) => managedActions.has(action) || managedActions.has("mcp") && action.startsWith("mcp__");
 		const existingPermissions = settings.permissions ?? {};
-		const preserve = (entries) => (entries ?? []).filter((entry) => !managedActions.has(parseToolPatternEntry(entry).toolName));
+		const preserve = (entries) => (entries ?? []).filter((entry) => !isManagedAction(parseToolPatternEntry(entry).toolName));
 		const mergedPermissions = { ...existingPermissions };
 		const mergedAllow = uniq([...preserve(existingPermissions.allow), ...allow].toSorted());
 		const mergedAsk = uniq([...preserve(existingPermissions.ask), ...ask].toSorted());
@@ -107934,4 +108267,4 @@ async function importChecksCore(params) {
 }
 export { RulesyncPermissions as $, formatError as $n, isSymlink as $t, CODEBUDDY_DIR as A, MAX_FILE_SIZE as An, withFallbackLoggerTarget as At, CLAUDECODE_LOCAL_RULE_FILE_NAME as B, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Bn, assertTreeContainsNoSymlinks as Bt, QWENCODE_LOCAL_RULE_FILE_NAME as C, PACKAGING_TOOL_TARGETS as Cn, getSourceTransport as Ct, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as D, DEPRECATED_FEATURE_REPLACEMENTS as Dn, WarningCollectingLogger as Dt, FACTORYDROID_DIR as E, ALL_FEATURES_WITH_WILDCARD as En, JsonLogger as Et, groupSpellingsByCaseFoldedIdentity as F, RULESYNC_CONFIG_SCHEMA_URL as Fn, PathOutsideRootError as Ft, toInstructionBudgetFile as G, RULESYNC_PERMISSIONS_SCHEMA_URL as Gn, ensureDir as Gt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as H, RULESYNC_MCP_SCHEMA_URL as Hn, checkPathTraversal as Ht, CODEXCLI_BASH_RULES_FILE_NAME as I, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as In, applyFileMode as It, RulesyncSubagentFrontmatterSchema as J, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Jn, findFilesByGlobs as Jt, getLocalSkillDirNames as K, RULESYNC_RELATIVE_DIR_PATH as Kn, fileExists as Kt, CODEXCLI_DIR as L, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Ln, assertDirectoryIfExists as Lt, AUGMENTCODE_DIR as M, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Mn, withWarnOnceScope as Mt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as N, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Nn, CLIError as Nt, COMMANDCODE_DIR as O, CURATED_RULES_FEATURE_SUBDIR as On, fallbackLogger as Ot, caseFoldIdentity as P, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Pn, ErrorCodes as Pt, RulesyncRuleFrontmatterSchema as Q, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Qn, isFileSystemError as Qt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as R, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Rn, assertNoSymlinkBelowRoot as Rt, QWENCODE_DIR as S, ALL_TOOL_TARGETS_WITH_WILDCARD as Sn, assertTargetsFeaturesExclusive as St, LETTACODE_SETTINGS_LOCAL_FILE_NAME as T, ALL_FEATURES as Tn, ConsoleLogger as Tt, CLAUDECODE_SKILLS_DIR_PATH as U, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Un, createTempDirectory as Ut, CLAUDECODE_MEMORIES_DIR_NAME as V, RULESYNC_MCP_RELATIVE_FILE_PATH as Vn, assertWritablePathInsideRoot as Vt, findProjectInstructionBudgetFindings as W, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Wn, directoryExists as Wt, RulesyncSkillFrontmatterSchema as X, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Xn, getHomeDirectory as Xt, RulesyncSkill as Y, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Yn, getFileSizeAndExecutableBit as Yt, RulesyncRule as Z, RULESYNC_USER_CONFIG_DIR_NAME as Zn, isFileNotFoundError as Zt, SubagentsProcessor as _, toPosixPath as _n, resolveEffectiveInputRoots as _t, convertFromTool as a, readFileContent as an, stripControlCharactersKeepingLineFeeds as ar, parseJsonc as at, CommandsProcessor as b, mapWithConcurrency as bn, GITIGNORE_DESTINATION_KEY as bt, parseCommaSeparatedList as c, removeDirectoryStrict as cn, RulesyncCheck as ct, shortenToWidth as d, removeFileWithoutFollowingSymlinks as dn, loadYaml as dt, listDirectoryEntryNames as en, truncateText as er, RulesyncMcp as et, McpProcessor as f, removeTempDirectory as fn, isRecord as ft, RulesProcessor as g, splitPathSegments as gn, mergeInputRootConfigs as gt, ChecksProcessor as h, runWithDirectoryRollback as hn, ConfigResolver as ht, inspectInputRoots as i, posixRelativePathEscapesRoot as in, stripControlCharacters as ir, resolveRulesyncSourceWritePath as it, CODEBUDDY_LOCAL_RULE_FILE_NAME as j, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as jn, resetRunWarningState as jt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as k, FEATURE_SOURCE_TREE_ENTRIES as kn, warnOnConflictingFlags as kt, ELLIPSIS_WIDTH as l, removeFile as ln, RulesyncCheckFrontmatterSchema as lt, HooksProcessor as m, resolvedRelativePath as mn, SKILL_FILE_NAME as mt, formatSourceLoadFailure as n, listSubdirectoryNames as nn, hasEnclosingMarkOutsideKeycap as nr, RulesyncHooks as nt, isPackagingToolTarget as o, readFileContentOrNull as on, stripControlCharactersKeepingLineFeedsAndTabs as or, RulesyncCommand as ot, IgnoreProcessor as p, resolvePath as pn, SHARED_USER_MANAGED_CONFIG_PATHS as pt, RulesyncSubagent as q, RULESYNC_RULES_RELATIVE_DIR_PATH as qn, fileExistsStrict as qt, generate as r, pathEscapesRoot as rn, quoteForLog as rr, getRulesyncSourceCandidates as rt, getProcessorRegistryEntry as s, removeDirectory as sn, stripHiddenCharacters as sr, RulesyncCommandFrontmatterSchema as st, importFromTool as t, listFilePathsRecursively as tn, hasDeceptiveHiddenCharacters as tr, RulesyncIgnore as tt, displayWidthOf as u, removeFileStrict as un, stringifyFrontmatter as ut, SkillsProcessor as v, writeFileBuffer as vn, CONFLICTING_TARGET_PAIRS as vt, LETTACODE_DIR as w, ToolTargetSchema as wn, findControlCharacter as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, ALL_TOOL_TARGETS as xn, SourceEntrySchema as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, writeFileContent as yn, ConfigFileSchema as yt, CLAUDECODE_DIR as z, RULESYNC_IGNORE_RELATIVE_FILE_PATH as zn, assertPathResolvesInsideRoot as zt };
 
-//# sourceMappingURL=import-C_XK2L62.js.map
+//# sourceMappingURL=import--Y_A56qx.js.map