rulesync 43.6.1 → 43.6.3

package/dist/{import-BzVkMPd5.cjs → import-DCvPujUW.cjs}

@@ -2291,6 +2291,190 @@ async function removeTempDirectory(tempDir) {
 		});
 	} catch {}
 }
+// src/utils/prototype-pollution.ts
+/**
+* Keys that, if walked into when constructing or merging objects from
+* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
+* chain) and propagate state to every other object in the runtime. Any code
+* that copies arbitrary user-supplied keys into a fresh object — frontmatter
+* parsing, MCP config conversion, settings round-trip — should skip these.
+*/
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPrototypePollutionKey(key) {
+	return PROTOTYPE_POLLUTION_KEYS.has(key);
+}
+/**
+* Returns a shallow copy of a record's own entries with every
+* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
+*
+* Use when copying a nested, user-supplied string map — an MCP server's `env`
+* or `headers` table — into freshly generated config. Carrying such a map by
+* reference, or re-assigning its keys via bracket notation, would let a literal
+* `__proto__` key ride along (and re-assigning it would mutate the target's
+* prototype). Walking the entries through this helper severs that path while
+* preserving every legitimate key.
+*/
+function omitPrototypePollutionKeys(record) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+/**
+* Like {@link omitPrototypePollutionKeys}, but recursive: every plain object
+* reachable through the value (directly, or through an array) is copied with
+* its prototype-pollution keys dropped. Scalars and arrays of scalars come back
+* as they are.
+*
+* Use when passing an unknown, user-supplied value through unchanged — an MCP
+* server field a tool documents that rulesync does not model — so a
+* `__proto__` key nested anywhere inside it cannot ride into the generated
+* config, where the consuming tool may merge the object without the same care.
+*/
+function omitPrototypePollutionKeysDeep(value) {
+	if (Array.isArray(value)) return value.map((entry) => omitPrototypePollutionKeysDeep(entry));
+	if (value === null || typeof value !== "object") return value;
+	const sanitized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = omitPrototypePollutionKeysDeep(entry);
+	}
+	return sanitized;
+}
+// src/utils/jsonc.ts
+/**
+* Rebuild the parsed value from its own enumerable entries, dropping
+* prototype-pollution keys (`__proto__`, `constructor`, `prototype`).
+* `jsonc-parser` assigns keys with plain `obj[key] = value` semantics, so a
+* literal `__proto__` key would replace the containing object's prototype
+* instead of becoming an own property; rebuilding gives every object a clean
+* `Object.prototype` again and severs that path.
+*/
+function deepSanitize(value) {
+	if (Array.isArray(value)) return value.map((item) => deepSanitize(item));
+	if (value !== null && typeof value === "object") {
+		const sanitized = {};
+		for (const [key, entry] of Object.entries(value)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			sanitized[key] = deepSanitize(entry);
+		}
+		return sanitized;
+	}
+	return value;
+}
+/**
+* Collect the paths of every prototype-pollution key in the document, walking
+* the syntax tree rather than the parsed value.
+*
+* The parsed value cannot answer this question for `__proto__`:
+* `obj["__proto__"] = "deny"` is discarded by the engine outright, and
+* `obj["__proto__"] = {...}` replaces the prototype instead of adding an own
+* property — either way the key is already gone by the time
+* {@link deepSanitize} could look for it, and only the source text still knows
+* the user wrote it. `constructor` and `prototype` do become own properties and
+* could be found in the parsed value, but they are collected here too so all
+* three keys are answered the same way.
+*
+* A pollution key's subtree is not descended into, matching
+* {@link deepSanitize}, which drops the whole value along with the key.
+*/
+function collectPollutionKeyPaths({ node, path, found }) {
+	if (node.type === "array") {
+		for (const [index, child] of (node.children ?? []).entries()) collectPollutionKeyPaths({
+			node: child,
+			path: `${path}[${index}]`,
+			found
+		});
+		return;
+	}
+	if (node.type !== "object") return;
+	for (const property of node.children ?? []) {
+		const [keyNode, valueNode] = property.children ?? [];
+		if (typeof keyNode?.value !== "string") continue;
+		const keyPath = path === "" ? keyNode.value : `${path}.${keyNode.value}`;
+		if (PROTOTYPE_POLLUTION_KEYS.has(keyNode.value)) {
+			found.push(keyPath);
+			continue;
+		}
+		if (valueNode !== void 0) collectPollutionKeyPaths({
+			node: valueNode,
+			path: keyPath,
+			found
+		});
+	}
+}
+/**
+* Parse a JSONC (JSON with Comments) document strictly.
+*
+* Unlike `jsonc-parser`'s bare `parse` (which silently tolerates syntax
+* errors and returns a best-effort value), this throws on any parse error so
+* a malformed source file fails loudly instead of generating half-empty tool
+* configs. Plain JSON is valid JSONC, so this is a drop-in replacement for
+* `JSON.parse` on files that may contain comments or trailing commas.
+*/
+function parseJsonc$6(content) {
+	return deepSanitize(parseStrict(content));
+}
+/**
+* The strict parse shared by both entry points. Kept separate from the syntax
+* tree walk so the many callers that never look at `droppedKeys` do not pay
+* for building a second representation of the document.
+*/
+function parseStrict(content) {
+	const errors = [];
+	const result = (0, jsonc_parser.parse)(content, errors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (errors.length > 0) {
+		const details = errors.map((e) => `${(0, jsonc_parser.printParseErrorCode)(e.error)} at offset ${e.offset}`).join(", ");
+		throw new SyntaxError(`Failed to parse JSONC content: ${details}`);
+	}
+	return result;
+}
+/**
+* The error a source document should fail with when
+* {@link parseJsoncReportingDroppedKeys} reports keys the parser removed.
+*
+* Shared by every source that reports them, so the three files a user can
+* author explain the same removal the same way rather than each inventing its
+* own wording.
+*/
+function droppedPollutionKeysError({ sourcePath, droppedKeys }) {
+	return /* @__PURE__ */ new Error(`${JSON.stringify(sourcePath)} uses ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")} as ${droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`);
+}
+/**
+* The same parse as {@link parseJsonc}, additionally reporting which
+* prototype-pollution keys were removed, as dotted paths
+* (`permission.bash.__proto__`).
+*
+* The parse itself is identical — the paths only let a caller tell the user
+* about entries that vanished, which they would otherwise have to notice by
+* comparing their source file against the generated output.
+*/
+function parseJsoncReportingDroppedKeys({ content }) {
+	const result = parseStrict(content);
+	const found = [];
+	const tree = (0, jsonc_parser.parseTree)(content, [], {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (tree !== void 0) collectPollutionKeyPaths({
+		node: tree,
+		path: "",
+		found
+	});
+	return {
+		value: deepSanitize(result),
+		droppedKeys: [...new Set(found)]
+	};
+}
 // src/types/json-output.ts
 /**
 * Error codes for CLI errors
@@ -3580,10 +3764,37 @@ const getDefaults = () => ({
 	inputRoots: void 0,
 	sources: []
 });
+/**
+* Parse the content of a config file (`rulesync.jsonc` / `rulesync.local.jsonc`)
+* through the same strict, sanitizing JSONC parser as every other rulesync
+* source.
+*
+* `jsonc-parser`'s bare `parse` recovers from syntax errors without reporting
+* them, which let a typo (a missing comma, unquoted keys, trailing garbage)
+* silently drop keys and run rulesync with a different config than the user
+* wrote. Prototype-pollution keys are rejected rather than silently removed,
+* matching the hooks, MCP and permissions sources.
+*/
+function parseConfigFileContent({ content, filePath }) {
+	let result;
+	try {
+		result = parseJsoncReportingDroppedKeys({ content });
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Error(`Failed to parse ${JSON.stringify(filePath)}: ${detail}`, { cause: error });
+	}
+	if (result.droppedKeys.length > 0) throw droppedPollutionKeysError({
+		sourcePath: filePath,
+		droppedKeys: result.droppedKeys
+	});
+	return result.value;
+}
 const loadConfigFromFile = async (filePath) => {
 	if (!await fileExists(filePath)) return {};
-	const fileContent = await readFileContent(filePath);
-	const jsonData = (0, jsonc_parser.parse)(fileContent);
+	const jsonData = parseConfigFileContent({
+		content: await readFileContent(filePath),
+		filePath
+	});
 	const { $schema: _schema, ...configParams } = ConfigFileSchema.parse(jsonData);
 	assertTargetsFeaturesExclusive({
 		targets: configParams.targets,
@@ -4196,62 +4407,6 @@ function createBoundedWalk({ subject, limits, root }) {
 		leave
 	};
 }
-// src/utils/prototype-pollution.ts
-/**
-* Keys that, if walked into when constructing or merging objects from
-* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
-* chain) and propagate state to every other object in the runtime. Any code
-* that copies arbitrary user-supplied keys into a fresh object — frontmatter
-* parsing, MCP config conversion, settings round-trip — should skip these.
-*/
-const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isPrototypePollutionKey(key) {
-	return PROTOTYPE_POLLUTION_KEYS.has(key);
-}
-/**
-* Returns a shallow copy of a record's own entries with every
-* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
-*
-* Use when copying a nested, user-supplied string map — an MCP server's `env`
-* or `headers` table — into freshly generated config. Carrying such a map by
-* reference, or re-assigning its keys via bracket notation, would let a literal
-* `__proto__` key ride along (and re-assigning it would mutate the target's
-* prototype). Walking the entries through this helper severs that path while
-* preserving every legitimate key.
-*/
-function omitPrototypePollutionKeys(record) {
-	const sanitized = {};
-	for (const [key, value] of Object.entries(record)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = value;
-	}
-	return sanitized;
-}
-/**
-* Like {@link omitPrototypePollutionKeys}, but recursive: every plain object
-* reachable through the value (directly, or through an array) is copied with
-* its prototype-pollution keys dropped. Scalars and arrays of scalars come back
-* as they are.
-*
-* Use when passing an unknown, user-supplied value through unchanged — an MCP
-* server field a tool documents that rulesync does not model — so a
-* `__proto__` key nested anywhere inside it cannot ride into the generated
-* config, where the consuming tool may merge the object without the same care.
-*/
-function omitPrototypePollutionKeysDeep(value) {
-	if (Array.isArray(value)) return value.map((entry) => omitPrototypePollutionKeysDeep(entry));
-	if (value === null || typeof value !== "object") return value;
-	const sanitized = {};
-	for (const [key, entry] of Object.entries(value)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = omitPrototypePollutionKeysDeep(entry);
-	}
-	return sanitized;
-}
 // src/utils/type-guards.ts
 /**
 * Type guard to check if a value is a plain object (Record<string, unknown>).
@@ -4879,6 +5034,24 @@ function lookupOwn({ record, key }) {
 	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
 /**
+* Return the value a map holds under its own `key`, first storing `create()`
+* there when it has none. A bracket read would find an inherited member for a
+* key such as `toString`, so an importer bucketing rules by a user-supplied
+* name would write into an `Object.prototype` function instead of a fresh
+* bucket.
+*/
+function getOrCreateOwn({ record, key, create }) {
+	if (Object.hasOwn(record, key)) return record[key];
+	const created = create();
+	Object.defineProperty(record, key, {
+		value: created,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+	return created;
+}
+/**
 * Swap the keys and values of a name map, e.g. a canonical-to-tool map into
 * the tool-to-canonical map an importer reads. When two keys share a value,
 * the later key wins.
@@ -6413,14 +6586,16 @@ const CANONICAL_TO_GOOSE_EVENT_NAMES = {
 * Hook events supported by Goose.
 *
 * Goose adopts the Open Plugins hooks spec: each plugin's `hooks/hooks.json`
-* maps PascalCase event names to matcher/handler arrays. Every Goose event has a
-* 1:1 canonical equivalent, so no new canonical events are required.
-*
-* Goose's `HookEvent` enum defines exactly these 11 events (v1.41.0). Notably it
-* has NO `SubagentStart`/`SubagentStop` arms — emitting them would write keys
-* Goose silently ignores, so `subagentStart`/`subagentStop` are intentionally
+* maps PascalCase event names to matcher/handler arrays.
+*
+* Goose's `HookEvent` enum defines these 11 events plus `PreToolUseResult`
+* (added in v1.48.0), which has no canonical equivalent: it is authored under
+* the `goose.hooks` override block by its native name, emitted verbatim, and
+* imported back into that block. Notably the enum has NO
+* `SubagentStart`/`SubagentStop` arms — emitting them would write keys Goose
+* silently ignores, so `subagentStart`/`subagentStop` are intentionally
 * excluded here and from `CANONICAL_TO_GOOSE_EVENT_NAMES`.
-* @see https://github.com/aaif-goose/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
+* @see https://github.com/aaif-goose/goose/blob/v1.48.0/crates/goose/src/hooks/mod.rs
 * @see https://goose-docs.ai/docs/guides/context-engineering/hooks/
 */
 const GOOSE_HOOK_EVENTS = eventsOf(CANONICAL_TO_GOOSE_EVENT_NAMES);
@@ -6898,134 +7073,6 @@ const GROKCLI_HOOK_EVENTS = eventsOf(CANONICAL_TO_GROKCLI_EVENT_NAMES);
 * Map Grok CLI PascalCase event names to canonical camelCase.
 */
 const GROKCLI_TO_CANONICAL_EVENT_NAMES = invertRecord(CANONICAL_TO_GROKCLI_EVENT_NAMES);
-// src/utils/jsonc.ts
-/**
-* Rebuild the parsed value from its own enumerable entries, dropping
-* prototype-pollution keys (`__proto__`, `constructor`, `prototype`).
-* `jsonc-parser` assigns keys with plain `obj[key] = value` semantics, so a
-* literal `__proto__` key would replace the containing object's prototype
-* instead of becoming an own property; rebuilding gives every object a clean
-* `Object.prototype` again and severs that path.
-*/
-function deepSanitize(value) {
-	if (Array.isArray(value)) return value.map((item) => deepSanitize(item));
-	if (value !== null && typeof value === "object") {
-		const sanitized = {};
-		for (const [key, entry] of Object.entries(value)) {
-			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			sanitized[key] = deepSanitize(entry);
-		}
-		return sanitized;
-	}
-	return value;
-}
-/**
-* Collect the paths of every prototype-pollution key in the document, walking
-* the syntax tree rather than the parsed value.
-*
-* The parsed value cannot answer this question for `__proto__`:
-* `obj["__proto__"] = "deny"` is discarded by the engine outright, and
-* `obj["__proto__"] = {...}` replaces the prototype instead of adding an own
-* property — either way the key is already gone by the time
-* {@link deepSanitize} could look for it, and only the source text still knows
-* the user wrote it. `constructor` and `prototype` do become own properties and
-* could be found in the parsed value, but they are collected here too so all
-* three keys are answered the same way.
-*
-* A pollution key's subtree is not descended into, matching
-* {@link deepSanitize}, which drops the whole value along with the key.
-*/
-function collectPollutionKeyPaths({ node, path, found }) {
-	if (node.type === "array") {
-		for (const [index, child] of (node.children ?? []).entries()) collectPollutionKeyPaths({
-			node: child,
-			path: `${path}[${index}]`,
-			found
-		});
-		return;
-	}
-	if (node.type !== "object") return;
-	for (const property of node.children ?? []) {
-		const [keyNode, valueNode] = property.children ?? [];
-		if (typeof keyNode?.value !== "string") continue;
-		const keyPath = path === "" ? keyNode.value : `${path}.${keyNode.value}`;
-		if (PROTOTYPE_POLLUTION_KEYS.has(keyNode.value)) {
-			found.push(keyPath);
-			continue;
-		}
-		if (valueNode !== void 0) collectPollutionKeyPaths({
-			node: valueNode,
-			path: keyPath,
-			found
-		});
-	}
-}
-/**
-* Parse a JSONC (JSON with Comments) document strictly.
-*
-* Unlike `jsonc-parser`'s bare `parse` (which silently tolerates syntax
-* errors and returns a best-effort value), this throws on any parse error so
-* a malformed source file fails loudly instead of generating half-empty tool
-* configs. Plain JSON is valid JSONC, so this is a drop-in replacement for
-* `JSON.parse` on files that may contain comments or trailing commas.
-*/
-function parseJsonc$6(content) {
-	return deepSanitize(parseStrict(content));
-}
-/**
-* The strict parse shared by both entry points. Kept separate from the syntax
-* tree walk so the many callers that never look at `droppedKeys` do not pay
-* for building a second representation of the document.
-*/
-function parseStrict(content) {
-	const errors = [];
-	const result = (0, jsonc_parser.parse)(content, errors, {
-		allowTrailingComma: true,
-		disallowComments: false
-	});
-	if (errors.length > 0) {
-		const details = errors.map((e) => `${(0, jsonc_parser.printParseErrorCode)(e.error)} at offset ${e.offset}`).join(", ");
-		throw new SyntaxError(`Failed to parse JSONC content: ${details}`);
-	}
-	return result;
-}
-/**
-* The error a source document should fail with when
-* {@link parseJsoncReportingDroppedKeys} reports keys the parser removed.
-*
-* Shared by every source that reports them, so the three files a user can
-* author explain the same removal the same way rather than each inventing its
-* own wording.
-*/
-function droppedPollutionKeysError({ sourcePath, droppedKeys }) {
-	return /* @__PURE__ */ new Error(`${JSON.stringify(sourcePath)} uses ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")} as ${droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`);
-}
-/**
-* The same parse as {@link parseJsonc}, additionally reporting which
-* prototype-pollution keys were removed, as dotted paths
-* (`permission.bash.__proto__`).
-*
-* The parse itself is identical — the paths only let a caller tell the user
-* about entries that vanished, which they would otherwise have to notice by
-* comparing their source file against the generated output.
-*/
-function parseJsoncReportingDroppedKeys({ content }) {
-	const result = parseStrict(content);
-	const found = [];
-	const tree = (0, jsonc_parser.parseTree)(content, [], {
-		allowTrailingComma: true,
-		disallowComments: false
-	});
-	if (tree !== void 0) collectPollutionKeyPaths({
-		node: tree,
-		path: "",
-		found
-	});
-	return {
-		value: deepSanitize(result),
-		droppedKeys: [...new Set(found)]
-	};
-}
 // src/utils/rulesync-source-path.ts
 /**
 * No `.rulesync/` source file exists for a feature at any of its candidate
@@ -9698,11 +9745,9 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 	* `PERMISSION_OVERRIDE_KEY_ALIASES`) is replaced wholesale, and removed when
 	* the import does not produce one: only that tool's import ever writes it, so
 	* a setting removed from the tool's own config has to disappear here too.
-	* Any other tool's override block the import carries (Hermes restores them
-	* from its provenance) merges one level down: an imported field replaces the
-	* existing field, fields the import does not name are kept, and a
-	* `permission` record inside the block merges per category. Every other
-	* top-level key — `$schema` included — is kept unless the import names it.
+	* Every other top-level key — `$schema` included — is kept unless the import
+	* names it, in which case the imported value replaces it. No importer emits
+	* another tool's override block, so those blocks are never touched here.
 	*/
 	static mergeImportedJson({ existing, imported, toolTarget }) {
 		const ownOverrideKey = PERMISSION_OVERRIDE_KEY_ALIASES[toolTarget] ?? toolTarget;
@@ -9714,14 +9759,7 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 				existing: current,
 				imported: value
 			});
-			else if (isRecord(current) && isRecord(value)) {
-				const block = { ...current };
-				for (const [field, fieldValue] of Object.entries(value)) block[field] = field === "permission" ? mergePermissionCategories({
-					existing: block[field],
-					imported: fieldValue
-				}) : fieldValue;
-				merged[key] = block;
-			} else merged[key] = value;
+			else merged[key] = value;
 		}
 		return merged;
 	}
@@ -19580,9 +19618,6 @@ var KiloCommand = class extends FrontmatterMarkdownToolCommand {
 	static getFrontmatterSchema() {
 		return KiloCommandFrontmatterSchema;
 	}
-	getRulesyncOutputRoot() {
-		return process.cwd();
-	}
 	/**
 	* Refuse to write a command Kilo reserves (see
 	* {@link KILO_RESERVED_COMMAND_NAMES}). The name Kilo loads is the file
@@ -20871,9 +20906,6 @@ var OpenCodeCommand = class extends FrontmatterMarkdownToolCommand {
 			...Object.keys(restFields).length > 0 && { [toolTarget]: restFields }
 		};
 	}
-	getRulesyncOutputRoot() {
-		return process.cwd();
-	}
 	/**
 	* Imports commands defined inline in `opencode.json` / `opencode.jsonc` (and,
 	* at project scope, `.opencode/opencode.json(c)`, which OpenCode merges over
@@ -52388,6 +52420,29 @@ var AmpHooks = class AmpHooks extends ToolHooks {
 		});
 	}
 };
+// src/features/hooks/hook-matcher-tool-names.ts
+const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
+function isMatcherName(token) {
+	return !token.startsWith("\\") && !token.startsWith("[");
+}
+/**
+* The distinct whole names in a matcher that start with a capital letter, for
+* adapters whose runtime tool names are all lowercase: after translation, such
+* a name has no runtime equivalent and can never match.
+*/
+function capitalizedMatcherNames(matcher) {
+	const names = [...matcher.matchAll(MATCHER_TOKEN_PATTERN)].map(([token]) => token).filter((token) => isMatcherName(token) && /^[A-Z]/.test(token));
+	return [...new Set(names)];
+}
+/**
+* Rewrites the whole tool names inside a hook `matcher` regex through `names`,
+* leaving escapes, character classes and unknown names as written. Used by
+* adapters whose runtime tool names differ from the canonical (Claude Code)
+* spelling.
+*/
+function replaceMatcherNames(matcher, names) {
+	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
+}
 // src/utils/object.ts
 /**
 * Return a shallow copy of `obj` keeping only the entries whose value is
@@ -54308,6 +54363,48 @@ const ANTIGRAVITY_FLAT_HANDLER_EVENTS = new Set([...ANTIGRAVITY_NO_MATCHER_EVENT
 	record: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
 	key: event
 }) ?? event));
+const CANONICAL_TO_ANTIGRAVITY_TOOL_NAMES = {
+	Bash: "run_command",
+	Read: "(?:read_file|view_file)",
+	Write: "(?:write_file|write_to_file)",
+	Edit: "(?:edit_file|replace_file_content)",
+	WebSearch: "search_web"
+};
+const ANTIGRAVITY_TO_CANONICAL_TOOL_NAMES = {
+	run_command: "Bash",
+	read_file: "Read",
+	view_file: "Read",
+	write_file: "Write",
+	write_to_file: "Write",
+	edit_file: "Edit",
+	replace_file_content: "Edit",
+	search_web: "WebSearch"
+};
+const ANTIGRAVITY_GROUP_TO_CANONICAL_TOOL_NAMES = Object.entries(CANONICAL_TO_ANTIGRAVITY_TOOL_NAMES).filter(([, name]) => name.startsWith("(?:")).map(([canonical, group]) => [group, canonical]);
+const ANTIGRAVITY_DOCUMENTED_TOOL_CANDIDATES = {
+	Grep: "grep_search",
+	Glob: "find_by_name",
+	WebFetch: "read_url_content",
+	MultiEdit: "multi_replace_file_content"
+};
+function canonicalToAntigravityMatcher({ matcher, eventName, warn }) {
+	const translated = replaceMatcherNames(matcher, CANONICAL_TO_ANTIGRAVITY_TOOL_NAMES);
+	const unmatched = capitalizedMatcherNames(translated);
+	if (unmatched.length > 0) {
+		const candidates = unmatched.flatMap((name) => {
+			const candidate = lookupOwn({
+				record: ANTIGRAVITY_DOCUMENTED_TOOL_CANDIDATES,
+				key: name
+			});
+			return candidate ? [`\`${candidate}\` for ${quoteValueForWarning(name)}`] : [];
+		});
+		warn(`Antigravity reports lowercase tool names in the hook payload (\`toolCall.name\`), and ${unmatched.map((name) => quoteValueForWarning(name)).join(", ")} in the "${eventName}" matcher ${quoteValueForWarning(matcher)} has no verified Antigravity equivalent, so it is written as-is and will likely never match. Use the tool name Antigravity reports instead` + (candidates.length > 0 ? ` (the Antigravity hooks docs list ${candidates.join(", ")}, unverified).` : "."));
+	}
+	return translated;
+}
+function antigravityToCanonicalMatcher(matcher) {
+	return replaceMatcherNames(ANTIGRAVITY_GROUP_TO_CANONICAL_TOOL_NAMES.reduce((current, [group, canonical]) => current.split(group).join(canonical), matcher), ANTIGRAVITY_TO_CANONICAL_TOOL_NAMES);
+}
 /**
 * Antigravity uses a Claude-Code-like `hooks.json`. The `PreToolUse` /
 * `PostToolUse` events use the matcher-based group shape, while `SessionStart`,
@@ -54321,7 +54418,11 @@ const ANTIGRAVITY_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: ANTIGRAVITY_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	noMatcherEvents: ANTIGRAVITY_NO_MATCHER_EVENTS,
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
+	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	matcherTranslation: {
+		toTool: canonicalToAntigravityMatcher,
+		toCanonical: antigravityToCanonicalMatcher
+	}
 };
 /**
 * Turn the shared converter's matcher-group output into Antigravity's shape:
@@ -57354,20 +57455,6 @@ var CopilotcliHooks = class CopilotcliHooks extends ToolHooks {
 		}), null, 2) });
 	}
 };
-// src/features/hooks/hook-matcher-tool-names.ts
-const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
-function isMatcherName(token) {
-	return !token.startsWith("\\") && !token.startsWith("[");
-}
-/**
-* Rewrites the whole tool names inside a hook `matcher` regex through `names`,
-* leaving escapes, character classes and unknown names as written. Used by
-* adapters whose runtime tool names differ from the canonical (Claude Code)
-* spelling.
-*/
-function replaceMatcherNames(matcher, names) {
-	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
-}
 // src/features/hooks/cortexcode-hooks.ts
 const CORTEXCODE_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]);
 const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
@@ -57381,8 +57468,8 @@ const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
 const CORTEXCODE_TO_CANONICAL_TOOL_NAMES = invertRecord(CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
 function canonicalToCortexcodeMatcher({ matcher, eventName, warn }) {
 	const translated = replaceMatcherNames(matcher, CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
-	const unmatched = [...translated.matchAll(MATCHER_TOKEN_PATTERN)].map(([token]) => token).filter((token) => isMatcherName(token) && /^[A-Z]/.test(token));
-	if (unmatched.length > 0) warn(`Cortex Code matches hook matchers case-sensitively against lowercase runtime tool names, and ${[...new Set(unmatched)].map((name) => quoteValueForWarning(name)).join(", ")} in the "${eventName}" matcher ${quoteValueForWarning(matcher)} is not a tool Cortex Code documents a runtime ID for, so it is written as-is and will likely never match. Replace it with the lowercase name Cortex Code uses for that tool, if it has one.`);
+	const unmatched = capitalizedMatcherNames(translated);
+	if (unmatched.length > 0) warn(`Cortex Code matches hook matchers case-sensitively against lowercase runtime tool names, and ${unmatched.map((name) => quoteValueForWarning(name)).join(", ")} in the "${eventName}" matcher ${quoteValueForWarning(matcher)} is not a tool Cortex Code documents a runtime ID for, so it is written as-is and will likely never match. Replace it with the lowercase name Cortex Code uses for that tool, if it has one.`);
 	return translated;
 }
 function cortexcodeToCanonicalMatcher(matcher) {
@@ -58630,12 +58717,11 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 		});
 	}
 	toRulesyncHooks({ logger } = {}) {
-		const parsed = this.parseFileContentOrThrow({
-			displayName: "Goose",
-			parse: (fileContent) => JSON.parse(fileContent)
-		});
 		const hooks = toolHooksToCanonical({
-			hooks: parsed.hooks && typeof parsed.hooks === "object" && !Array.isArray(parsed.hooks) ? Object.fromEntries(Object.entries(parsed.hooks).filter(([eventName]) => Object.hasOwn(GOOSE_TO_CANONICAL_EVENT_NAMES, eventName))) : parsed.hooks,
+			hooks: this.parseFileContentOrThrow({
+				displayName: "Goose",
+				parse: (fileContent) => JSON.parse(fileContent)
+			}).hooks,
 			converterConfig: GOOSE_CONVERTER_CONFIG,
 			logger
 		});
@@ -61902,12 +61988,14 @@ var ReasonixHooks = class ReasonixHooks extends ToolHooks {
 		const paths = ReasonixHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		let settings;
+		let parsed;
 		try {
-			settings = JSON.parse(existingContent);
+			parsed = JSON.parse(existingContent);
 		} catch (error) {
 			throw new Error(`Failed to parse existing Reasonix settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		if (!isPlainObject(parsed)) throw new Error(`Failed to parse existing Reasonix settings at ${filePath}: expected a mapping at the root`);
+		const settings = parsed;
 		const config = rulesyncHooks.getJson();
 		const reasonixHooks = canonicalToReasonixHooks({
 			config,
@@ -62866,15 +62954,18 @@ function emittedEventsWithHook(params) {
 }
 /**
 * The capabilities an adapter built on the shared hooks converter already
-* declares in its converter config: the events it emits and the hook types it
-* keeps. Reading them from there keeps the processor's skip warnings in step
-* with what the converter actually writes.
+* declares in its converter config: the events it emits, the hook types it
+* keeps, and whether it writes the per-hook `enabled` flag. Reading them from
+* there keeps the processor's skip and dropped-field warnings in step with
+* what the converter actually writes.
 */
 function converterCapabilities(config) {
 	if (!config.supportedHookTypes) throw new Error("Hooks converter config must declare its supportedHookTypes");
+	const passesThroughEnabled = (config.booleanPassthroughFields ?? []).some((field) => field.canonical === "enabled");
 	return {
 		supportedEvents: config.supportedEvents,
-		supportedHookTypes: [...config.supportedHookTypes]
+		supportedHookTypes: [...config.supportedHookTypes],
+		...passesThroughEnabled ? { supportsPerHookEnabled: true } : {}
 	};
 }
 const toolHooksFactories = /* @__PURE__ */ new Map([
@@ -63496,8 +63587,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		},
 		...converterCapabilities(ZCODE_CONVERTER_CONFIG),
-		supportsMatcher: true,
-		supportsPerHookEnabled: true
+		supportsMatcher: true
 	}],
 	["zcode-plugin", {
 		class: ZcodePluginHooks,
@@ -63507,10 +63597,12 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		},
 		...converterCapabilities(ZCODE_PLUGIN_CONVERTER_CONFIG),
-		supportsMatcher: true,
-		supportsPerHookEnabled: true
+		supportsMatcher: true
 	}]
 ]);
+function targetsSupporting(capability) {
+	return [...toolHooksFactories.entries()].filter(([, f]) => f[capability]).map(([t]) => t).join(" / ");
+}
 const hooksProcessorToolTargets = [...toolHooksFactories.entries()].filter(([, f]) => f.meta.supportsProject).map(([t]) => t);
 const hooksProcessorToolTargetsGlobal = [...toolHooksFactories.entries()].filter(([, f]) => f.meta.supportsGlobal).map(([t]) => t);
 const hooksProcessorToolTargetsImportable = [...toolHooksFactories.entries()].filter(([, f]) => f.meta.supportsProject && f.meta.supportsImport).map(([t]) => t);
@@ -63671,7 +63763,7 @@ var HooksProcessor = class extends FeatureProcessor {
 				effectiveHooks,
 				predicate: (def) => def.enabled === false
 			});
-			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the ${targetsSupporting("supportsPerHookEnabled")} hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
 		}
 		if (!factory.supportsPerHookConfirm) {
 			const eventsWithConfirmHooks = emittedEventsWithHook({
@@ -63680,7 +63772,7 @@ var HooksProcessor = class extends FeatureProcessor {
 				effectiveHooks,
 				predicate: (def) => def.confirm !== void 0
 			});
-			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the kiro-cli / kiro-ide hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
+			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the ${targetsSupporting("supportsPerHookConfirm")} hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
 		}
 	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
@@ -64943,12 +65035,7 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 	}
 	toRulesyncIgnore() {
 		const rulesyncPatterns = (0, es_toolkit.uniq)(this.patterns.map((entry) => readDenyPatternOf(entry)).filter((pattern) => pattern !== null && pattern.length > 0));
-		return new RulesyncIgnore({
-			outputRoot: this.outputRoot,
-			relativeDirPath: RulesyncIgnore.getSettablePaths().recommended.relativeDirPath,
-			relativeFilePath: RulesyncIgnore.getSettablePaths().recommended.relativeFilePath,
-			fileContent: rulesyncPatterns.join("\n")
-		});
+		return this.toRulesyncIgnoreDefault({ fileContent: rulesyncPatterns.join("\n") });
 	}
 	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false, logger }) {
 		await warnIfReasonixNestedProjectConfigShadowed({
@@ -78655,11 +78742,17 @@ function convertAmpToRulesync({ disable, permissions }) {
 	const assign = (tool, pattern, action) => {
 		if (isPrototypePollutionKey(tool)) return;
 		if (isPrototypePollutionKey(pattern)) return;
-		const bucket = permission[tool] ??= {};
-		const existing = bucket[pattern];
+		const bucket = getOrCreateOwn({
+			record: permission,
+			key: tool,
+			create: () => ({})
+		});
 		if (isStricterAction({
 			action,
-			existing
+			existing: lookupOwn({
+				record: bucket,
+				key: pattern
+			})
 		})) bucket[pattern] = action;
 	};
 	for (const tool of disable) assign(tool, "*", "deny");
@@ -80062,8 +80155,12 @@ function convertAntigravityToRulesyncPermissions({ allow, ask, deny, toCategory,
 				logger,
 				toolLabel
 			}) : target;
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(allow, "allow");
@@ -80131,10 +80228,16 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 };
 function toAntigravityCliToolName(canonical) {
 	if (canonical.startsWith("mcp__")) return "mcp";
-	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$9(cliName) {
-	return ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES[cliName] ?? cliName;
+	return lookupOwn({
+		record: ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES,
+		key: cliName
+	}) ?? cliName;
 }
 /**
 * Permissions generator for the Google Antigravity CLI (`agy`, Antigravity 2.0).
@@ -80297,10 +80400,16 @@ const IDE_ACTION_TO_CANONICAL = {
 };
 function toIdeAction(canonical) {
 	if (canonical.startsWith("mcp__")) return "mcp";
-	return CANONICAL_TO_IDE_ACTION[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_IDE_ACTION,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalCategory$2(ideAction) {
-	return IDE_ACTION_TO_CANONICAL[ideAction] ?? ideAction;
+	return lookupOwn({
+		record: IDE_ACTION_TO_CANONICAL,
+		key: ideAction
+	}) ?? ideAction;
 }
 /**
 * Permissions generator for the Google Antigravity IDE (Antigravity 2.0).
@@ -81839,10 +81948,16 @@ const CANONICAL_TO_CLAUDE_TOOL_NAMES = {
 */
 const CLAUDE_TO_CANONICAL_TOOL_NAMES = invertRecord(CANONICAL_TO_CLAUDE_TOOL_NAMES);
 function toClaudeToolName(canonical) {
-	return CANONICAL_TO_CLAUDE_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_CLAUDE_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$7(claudeName) {
-	return CLAUDE_TO_CANONICAL_TOOL_NAMES[claudeName] ?? claudeName;
+	return lookupOwn({
+		record: CLAUDE_TO_CANONICAL_TOOL_NAMES,
+		key: claudeName
+	}) ?? claudeName;
 }
 /**
 * Merge `patch` into `base`, recursing into plain objects so a sibling key at
@@ -82814,7 +82929,10 @@ const CLAUDE_PATH_RULE_ALIASES = {
 */
 function buildClaudePermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
-	return `${CLAUDE_PATH_RULE_ALIASES[toolName] ?? toolName}(${pattern})`;
+	return `${lookupOwn({
+		record: CLAUDE_PATH_RULE_ALIASES,
+		key: toolName
+	}) ?? toolName}(${pattern})`;
 }
 /**
 * The Claude tool names the canonical config manages. Deliberately the tool
@@ -83052,8 +83170,12 @@ function convertClaudeToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalToolName$7(toolName);
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -83635,11 +83757,17 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 		for (const action of CODEBUDDY_RULE_LISTS) for (const rule of toStringArray$1(permissions[action])) {
 			const parsed = parseCodebuddyRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.category) || isPrototypePollutionKey(parsed.pattern)) continue;
-			const rules = permission[parsed.category] ??= {};
-			const existing = rules[parsed.pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: parsed.category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: parsed.pattern
+				})
 			})) rules[parsed.pattern] = action;
 		}
 		const codebuddy = liftCodebuddyOverride({
@@ -84149,7 +84277,10 @@ const CODEWHALE_WRITE_RESTRICTION_TOOLS = ["write_file", "apply_patch"];
 /** The Codewhale tools a canonical path rule is written for. */
 function pathCategoryTools(category, action) {
 	if (category === "write" && action !== "allow") return CODEWHALE_WRITE_RESTRICTION_TOOLS;
-	return CODEWHALE_PATH_CATEGORY_TOOLS[category] ?? [];
+	return lookupOwn({
+		record: CODEWHALE_PATH_CATEGORY_TOOLS,
+		key: category
+	}) ?? [];
 }
 /** The canonical path categories a Codewhale file tool's rule can come from. */
 const CODEWHALE_TOOL_TO_PATH_CATEGORIES = {
@@ -84468,7 +84599,10 @@ function canonicalToCodewhaleRules({ config, preservedRules, logger }) {
 	});
 	for (const [category, rules] of Object.entries(config.permission)) {
 		if (category === "bash" || category === "*") continue;
-		if (CODEWHALE_PATH_CATEGORY_TOOLS[category] === void 0) {
+		if (lookupOwn({
+			record: CODEWHALE_PATH_CATEGORY_TOOLS,
+			key: category
+		}) === void 0) {
 			if (Object.keys(rules).length > 0) logger?.warn(`Codewhale permissions: skipping unsupported category "${category}"; Codewhale evaluates permission rules only for shell commands and file tools.`);
 			continue;
 		}
@@ -84578,7 +84712,10 @@ function toImportCandidates(rule) {
 	}
 	const pattern = pathRuleToPattern(rule);
 	if (pattern === null) return [];
-	return (CODEWHALE_TOOL_TO_PATH_CATEGORIES[rule.tool] ?? []).map((category) => ({
+	return (lookupOwn({
+		record: CODEWHALE_TOOL_TO_PATH_CATEGORIES,
+		key: rule.tool
+	}) ?? []).map((category) => ({
 		category,
 		pattern,
 		rule
@@ -86186,10 +86323,17 @@ function parseCommandcodeRuleLists(permissions) {
 				rule,
 				category
 			})) fallbackLogger.warn(`Command Code matches '${rule}' in "${action}" against MCP tool names case-insensitively, but the '${category}' rule generated from it matches the server and tool names exactly as written; spell the rule the way the tool is registered if they differ.`);
-			const rules = permission[category] ??= {};
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing: rules[pattern]
+				existing: lookupOwn({
+					record: rules,
+					key: pattern
+				})
 			})) rules[pattern] = action;
 		}
 	}
@@ -86550,9 +86694,12 @@ function convertContinuePermissionsToRulesync(lists) {
 			const parsedEntry = parseContinuePermissionEntry(entry);
 			if (parsedEntry === void 0) continue;
 			if (isPrototypePollutionKey(parsedEntry.toolName) || isPrototypePollutionKey(parsedEntry.pattern)) continue;
-			const category = toCanonicalToolName$6(parsedEntry.toolName);
-			permission[category] ??= {};
-			permission[category][parsedEntry.pattern] ??= action;
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: toCanonicalToolName$6(parsedEntry.toolName),
+				create: () => ({})
+			});
+			if (!Object.hasOwn(rules, parsedEntry.pattern)) rules[parsedEntry.pattern] = action;
 		}
 	}
 	return { permission };
@@ -87181,7 +87328,9 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		const settings = this.parseSettings();
 		const rules = {};
 		for (const pattern of toUrlList(settings[DENIED_URLS_KEY])) rules[pattern] = "deny";
-		if (this.global) for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) rules[pattern] ??= "allow";
+		if (this.global) {
+			for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) if (!Object.hasOwn(rules, pattern)) rules[pattern] = "allow";
+		}
 		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY$1]: rules } : {};
 		const defaultPermissionMode = this.global ? settings[DEFAULT_PERMISSION_MODE_KEY] : void 0;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
@@ -87528,7 +87677,10 @@ function isMcpScopedCategory(canonical) {
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
-	return CANONICAL_TO_CURSOR_TYPE[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_CURSOR_TYPE,
+		key: canonical
+	}) ?? canonical;
 }
 /**
 * For per-tool MCP canonical categories like `mcp__puppeteer__navigate`, the
@@ -87560,9 +87712,15 @@ function toCanonicalCategory$1(cursorType, pattern) {
 			const tool = match[2] ?? "*";
 			return `${MCP_CATEGORY_PREFIX}${server}__${tool}`;
 		}
-		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
+		return lookupOwn({
+			record: CURSOR_TYPE_TO_CANONICAL,
+			key: cursorType
+		}) ?? cursorType.toLowerCase();
 	}
-	return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
+	return lookupOwn({
+		record: CURSOR_TYPE_TO_CANONICAL,
+		key: cursorType
+	}) ?? cursorType.toLowerCase();
 }
 /**
 * Narrow `JSON.parse` output to a plain object before treating it as a Cursor
@@ -87807,9 +87965,13 @@ function convertCursorToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { toolName: type, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
-			if (!permission[canonical]) permission[canonical] = {};
 			const canonicalPattern = type === "Mcp" && canonical.startsWith("mcp__") ? "*" : pattern;
-			permission[canonical][canonicalPattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(canonicalPattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[canonicalPattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -88736,10 +88898,16 @@ const DEVIN_SCOPE_TO_CANONICAL = {
 */
 const DEVIN_BARE_ONLY_SCOPES = /* @__PURE__ */ new Set(["web_search"]);
 function toDevinScope(canonical) {
-	return CANONICAL_TO_DEVIN_SCOPE[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_DEVIN_SCOPE,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalCategory(devinScope) {
-	return DEVIN_SCOPE_TO_CANONICAL[devinScope] ?? devinScope;
+	return lookupOwn({
+		record: DEVIN_SCOPE_TO_CANONICAL,
+		key: devinScope
+	}) ?? devinScope;
 }
 function asDevinRecord(value) {
 	return isRecord(value) ? { ...value } : {};
@@ -89091,7 +89259,11 @@ function convertDevinToRulesyncPermissions(params) {
 			const { toolName: scope, pattern } = parseToolPatternEntry(entry);
 			if (isPrototypePollutionKey(scope) || isPrototypePollutionKey(pattern)) continue;
 			const canonical = toCanonicalCategory(scope);
-			(permission[canonical] ??= {})[pattern] = action;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -89397,7 +89569,10 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	};
 	const assigned = /* @__PURE__ */ new Map();
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
-		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
+		const toolName = lookupOwn({
+			record: RULESYNC_TO_GOOSE_TOOL_NAME,
+			key: category
+		}) ?? category;
 		for (const [pattern, action] of Object.entries(rules)) if (pattern !== "*") logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 		const { action, downgraded } = failSafeCatchAllAction({
 			rules,
@@ -89429,9 +89604,16 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
 		const toolNames = isStringArray(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
-		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
-			permission[category] ??= {};
-			permission[category]["*"] = action;
+		for (const toolName of toolNames) for (const category of lookupOwn({
+			record: GOOSE_TO_RULESYNC_TOOL_NAMES,
+			key: toolName
+		}) ?? [toolName]) {
+			if (isPrototypePollutionKey(category)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			})["*"] = action;
 		}
 	}
 	return { permission };
@@ -89512,7 +89694,10 @@ function buildGrokEntry(category, pattern) {
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
 	if (category === "mcp") return pattern === "*" || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
-	const tool = CATEGORY_TO_GROK_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_GROK_TOOL,
+		key: category
+	});
 	if (tool === void 0) return null;
 	return pattern === "*" || pattern === "" ? tool : `${tool}(${toGrokPathPattern(category, pattern)})`;
 }
@@ -89546,7 +89731,10 @@ function parseGrokEntry(entry) {
 		category: "mcp",
 		pattern: "*"
 	};
-	const category = GROK_TOOL_TO_CATEGORY[tool];
+	const category = lookupOwn({
+		record: GROK_TOOL_TO_CATEGORY,
+		key: tool
+	});
 	if (category === void 0) return null;
 	return {
 		category,
@@ -89867,11 +90055,17 @@ function parseGrokPermissionArrays(permission) {
 	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) + (rules?.length ?? 0) === 0) return null;
 	const result = {};
 	const record = ({ category, pattern, action }) => {
-		const bucket = result[category] ??= {};
-		const existing = bucket[pattern];
+		const bucket = getOrCreateOwn({
+			record: result,
+			key: category,
+			create: () => ({})
+		});
 		if (isStricterAction({
 			action,
-			existing
+			existing: lookupOwn({
+				record: bucket,
+				key: pattern
+			})
 		})) bucket[pattern] = action;
 	};
 	const applyEntries = (entries, action) => {
@@ -89928,7 +90122,11 @@ function deleteRulesByAction(rules, action) {
 	for (const [pattern, currentAction] of Object.entries(rules)) if (currentAction === action) delete rules[pattern];
 }
 function ensureCategory(permission, category) {
-	return permission[category] ??= {};
+	return getOrCreateOwn({
+		record: permission,
+		key: category,
+		create: () => ({})
+	});
 }
 function removeEmptyCategories(permission) {
 	for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
@@ -90109,6 +90307,22 @@ function unmanagedMcpAllowlistEntries({ existing, previousPermission, nextPermis
 		return category === null || !Object.hasOwn(previousPermission, category) && !Object.hasOwn(nextPermission, category);
 	});
 }
+/** Hermes's override key in the canonical document (`hermes`). */
+const HERMES_OVERRIDE_KEY = PERMISSION_OVERRIDE_KEY_ALIASES.hermesagent ?? "hermesagent";
+/**
+* The part of a canonical permissions document Hermes keeps as provenance: the
+* `$schema`, the canonical `permission` block, and Hermes's own override.
+*/
+function hermesProvenanceOf(permissions) {
+	const source = permissions;
+	const provenance = {};
+	for (const key of [
+		"$schema",
+		"permission",
+		HERMES_OVERRIDE_KEY
+	]) if (source[key] !== void 0) provenance[key] = source[key];
+	return provenance;
+}
 /** The validated canonical `permission` block of a config's `permissions.rulesync` blob. */
 function canonicalPermissionOf(config) {
 	const parsed = RulesyncPermissionsFileSchema.safeParse({ permission: provenancePermissionOf(config) });
@@ -90276,10 +90490,10 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			patterns: websiteBlocklist.enabled === true && isStringArray(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
-		const { permission: _permission, hermes: _hermes, ...otherProvenance } = provenance;
 		const hermes = buildHermesOverride(config, provenance);
+		const { $schema } = provenance;
 		const imported = {
-			...otherProvenance,
+			...$schema !== void 0 && { $schema },
 			permission,
 			...Object.keys(hermes).length > 0 && { hermes }
 		};
@@ -90337,7 +90551,7 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			base: config,
 			patch: permissions.hermes
 		});
-		config.permissions = { rulesync: permissions };
+		config.permissions = { rulesync: hermesProvenanceOf(permissions) };
 		return new HermesagentPermissions({
 			outputRoot,
 			fileContent: stringifySharedConfig({
@@ -90571,7 +90785,10 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 function convertRulesyncToJunieRules({ config, logger, existingRules, overrideSecretFile, overrideRuleDefaults }) {
 	const ruleLists = {};
 	for (const [category, patterns] of Object.entries(honorAllToolsOnBash(config.permission))) {
-		const group = CANONICAL_TO_JUNIE_GROUP[category];
+		const group = lookupOwn({
+			record: CANONICAL_TO_JUNIE_GROUP,
+			key: category
+		});
 		if (!group) {
 			if (Object.keys(patterns).length > 0) logger?.warn(`Junie allowlist only models executables/fileEditing/mcpTools/readOutsideProject (canonical bash/edit/write/read/mcp); '${category}' rules cannot be represented and were skipped.`);
 			continue;
@@ -90969,7 +91186,10 @@ const CATEGORY_TO_KIMI_CODE_TOOL = {
 function buildKimiCodePattern(category, pattern) {
 	if (category.startsWith("mcp__")) return pattern === "*" || pattern === "" ? category : null;
 	if (category === "mcp") return pattern === "*" || pattern === "" ? "mcp__*" : `mcp__${pattern}`;
-	const tool = CATEGORY_TO_KIMI_CODE_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_KIMI_CODE_TOOL,
+		key: category
+	});
 	if (!tool) return null;
 	return pattern === "*" || pattern === "" ? tool : `${tool}(${pattern})`;
 }
@@ -91065,7 +91285,10 @@ function canonicalToKimiCodeRules({ config, logger }) {
 	const canonicalRules = [];
 	const overrideRules = config["kimi-code"]?.rules ?? [];
 	for (const [category, rules] of Object.entries(config.permission)) {
-		if (!(category === "mcp" || category.startsWith("mcp__") || CATEGORY_TO_KIMI_CODE_TOOL[category] !== void 0)) {
+		if (!(category === "mcp" || category.startsWith("mcp__") || lookupOwn({
+			record: CATEGORY_TO_KIMI_CODE_TOOL,
+			key: category
+		}) !== void 0)) {
 			if (Object.keys(rules).length > 0) logger?.warn(`Kimi Code permissions: skipping unsupported category "${category}".`);
 			continue;
 		}
@@ -91882,9 +92105,16 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 			if (!isImportableRule(rule) || !isRecord(rule) || !isPermissionAction(rule.effect)) continue;
 			const category = KIRO_CAPABILITY_TO_CANONICAL[rule.capability];
 			const patterns = rule.match === void 0 ? ["*"] : isStringArray(rule.match) ? rule.match : [];
-			const categoryRules = permission[category] ??= {};
+			const categoryRules = getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			});
 			for (const pattern of patterns) {
-				const previous = categoryRules[pattern];
+				const previous = lookupOwn({
+					record: categoryRules,
+					key: pattern
+				});
 				if (isStricterAction({
 					action: rule.effect,
 					existing: previous
@@ -91902,7 +92132,10 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 function buildKiroCapabilityRules({ config, logger }) {
 	const buckets = /* @__PURE__ */ new Map();
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
-		const capability = CANONICAL_TO_KIRO_CAPABILITY[category];
+		const capability = lookupOwn({
+			record: CANONICAL_TO_KIRO_CAPABILITY,
+			key: category
+		});
 		if (capability === void 0) {
 			logger?.warn(`Kiro permissions.yaml has no capability for category: ${category}. Skipping.`);
 			continue;
@@ -92062,7 +92295,10 @@ function toLettacodeBashPayload({ pattern, action, logger }) {
 	return prefix === "" ? "" : `${prefix}${PREFIX_SUFFIX}`;
 }
 function toLettacodeRule({ category, pattern, action, logger }) {
-	const tool = CATEGORY_TO_LETTACODE_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_LETTACODE_TOOL,
+		key: category
+	});
 	if (tool === void 0) return null;
 	const payload = category === "bash" ? toLettacodeBashPayload({
 		pattern,
@@ -92217,11 +92453,17 @@ var LettacodePermissions = class LettacodePermissions extends ToolPermissions {
 		for (const [key, action] of Object.entries(LIST_TO_ACTION)) for (const rule of toStringArray$1(permissions[key])) {
 			const parsed = fromLettacodeRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.pattern)) continue;
-			const rules = permission[parsed.category] ??= {};
-			const existing = rules[parsed.pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: parsed.category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: parsed.pattern
+				})
 			})) rules[parsed.pattern] = action;
 		}
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
@@ -92408,7 +92650,13 @@ function getOpencodeMcpServerNames(mcp) {
 	return isRecord(lowered) ? Object.keys(lowered) : [];
 }
 function toOpencodePermissionKey(canonical) {
-	return CANONICAL_TO_OPENCODE_PERMISSION_KEYS[canonical] ?? CANONICAL_TO_OPENCODE_FOLDED_PERMISSION_KEYS[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_OPENCODE_PERMISSION_KEYS,
+		key: canonical
+	}) ?? lookupOwn({
+		record: CANONICAL_TO_OPENCODE_FOLDED_PERMISSION_KEYS,
+		key: canonical
+	}) ?? canonical;
 }
 /**
 * Merge two canonical pattern maps that land on the same OpenCode key.
@@ -92432,7 +92680,10 @@ function mergePatternRules(base, incoming) {
 	return Object.fromEntries(Object.entries(merged).toSorted(([, a], [, b]) => PERMISSION_ACTION_PRIORITY[a] - PERMISSION_ACTION_PRIORITY[b]));
 }
 function toCanonicalPermissionKey(opencodeKey) {
-	return OPENCODE_TO_CANONICAL_PERMISSION_KEYS[opencodeKey] ?? opencodeKey;
+	return lookupOwn({
+		record: OPENCODE_TO_CANONICAL_PERMISSION_KEYS,
+		key: opencodeKey
+	}) ?? opencodeKey;
 }
 function isSharedPermissionCategory(category) {
 	return category === "*" || CANONICAL_PERMISSION_CATEGORIES$1.has(category) || category.startsWith("mcp__");
@@ -93714,7 +93965,14 @@ function importPoolTool({ toolConfig, bucket }) {
 	const denied = isStringArray(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
 	const allowed = isStringArray(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
 	for (const pattern of denied.filter(isUsablePattern)) bucket[pattern] = "deny";
-	for (const pattern of allowed.filter(isUsablePattern)) bucket[pattern] ??= "allow";
+	for (const pattern of allowed.filter(isUsablePattern)) if (!Object.hasOwn(bucket, pattern)) bucket[pattern] = "allow";
+}
+/**
+* Record `allow` for a path no deny has claimed. The check is on own
+* properties, so a path such as `toString` is not mistaken for a stored rule.
+*/
+function allowUnlessSet(bucket, path) {
+	if (!Object.hasOwn(bucket, path)) bucket[path] = "allow";
 }
 /**
 * Convert Pool's `tools` and `paths` blocks back into a rulesync config.
@@ -93749,8 +94007,8 @@ function convertPoolToRulesync({ tools, paths }) {
 	for (const entry of allowEntries) {
 		const path = pathOfEntry(entry);
 		if (path === void 0) continue;
-		bucketFor(READ_CATEGORY)[path] ??= "allow";
-		if (isRecord(entry) && entry[POOL_WRITE_KEY] === true) for (const category of WRITE_CATEGORIES) bucketFor(category)[path] ??= "allow";
+		allowUnlessSet(bucketFor(READ_CATEGORY), path);
+		if (isRecord(entry) && entry[POOL_WRITE_KEY] === true) for (const category of WRITE_CATEGORIES) allowUnlessSet(bucketFor(category), path);
 	}
 	return { permission };
 }
@@ -93879,7 +94137,10 @@ function toQoderRule({ category, pattern, logger }) {
 		logger?.warn(`Qoder permissions: skipping the '${category}' rule '${pattern}' — Qoder matches MCP tools by name only.`);
 		return null;
 	}
-	const tool = CATEGORY_TO_QODER_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_QODER_TOOL,
+		key: category
+	});
 	if (tool === void 0) return null;
 	if (pattern === "*") return tool;
 	return `${QODER_PATH_RULE_ALIASES[tool] ?? tool}(${pattern})`;
@@ -94165,11 +94426,17 @@ var QoderPermissions = class QoderPermissions extends ToolPermissions {
 		for (const action of ACTIONS) for (const rule of toStringArray$1(permissions[action])) {
 			const parsed = fromQoderRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.category) || isPrototypePollutionKey(parsed.pattern)) continue;
-			const rules = permission[parsed.category] ??= {};
-			const existing = rules[parsed.pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: parsed.category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: parsed.pattern
+				})
 			})) rules[parsed.pattern] = action;
 		}
 		const outputStyle = settings[QODER_OUTPUT_STYLE_KEY];
@@ -94233,10 +94500,16 @@ const CANONICAL_TO_QWEN_TOOL_NAMES = {
 };
 const QWEN_TO_CANONICAL_TOOL_NAMES = invertRecord(CANONICAL_TO_QWEN_TOOL_NAMES);
 function toQwenToolName(canonical) {
-	return CANONICAL_TO_QWEN_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_QWEN_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$3(qwenName) {
-	return QWEN_TO_CANONICAL_TOOL_NAMES[qwenName] ?? qwenName;
+	return lookupOwn({
+		record: QWEN_TO_CANONICAL_TOOL_NAMES,
+		key: qwenName
+	}) ?? qwenName;
 }
 function parseQwenPermissionEntry(entry, options = {}) {
 	const parenIndex = entry.indexOf("(");
@@ -94852,15 +95125,23 @@ function convertQwenToRulesyncPermissions(params) {
 			if (!parsed.ok) {
 				if (action === "deny") {
 					const canonical = toCanonicalToolName$3(parsed.toolName);
-					if (!permission[canonical]) permission[canonical] = {};
-					permission[canonical]["*"] = action;
+					if (isPrototypePollutionKey(canonical)) continue;
+					getOrCreateOwn({
+						record: permission,
+						key: canonical,
+						create: () => ({})
+					})["*"] = action;
 				}
 				continue;
 			}
 			const { toolName, pattern } = parsed;
 			const canonical = toCanonicalToolName$3(toolName);
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -94924,15 +95205,24 @@ const REASONIX_TO_CANONICAL_TOOL_NAMES = {
 };
 /** Every Reasonix tool name a canonical category owns on generate. */
 function reasonixToolNamesOf(canonical) {
-	const legacy = CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES[canonical];
+	const legacy = lookupOwn({
+		record: CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES,
+		key: canonical
+	});
 	const current = toReasonixToolName(canonical);
 	return legacy === void 0 ? [current] : [current, legacy];
 }
 function toReasonixToolName(canonical) {
-	return CANONICAL_TO_REASONIX_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_REASONIX_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$2(reasonixName) {
-	return REASONIX_TO_CANONICAL_TOOL_NAMES[reasonixName] ?? reasonixName;
+	return lookupOwn({
+		record: REASONIX_TO_CANONICAL_TOOL_NAMES,
+		key: reasonixName
+	}) ?? reasonixName;
 }
 /**
 * Whether an entry uses the first-class `Tool=<literal>` exact-command form
@@ -95555,8 +95845,12 @@ function convertReasonixToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalToolName$2(toolName);
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -96108,7 +96402,10 @@ function convertRulesyncToRovodevToolPermissions({ config, logger }) {
 			if (bash) toolPermissions.bash = bash;
 			continue;
 		}
-		const toolKeys = CATEGORY_TO_TOOL_KEYS[category];
+		const toolKeys = lookupOwn({
+			record: CATEGORY_TO_TOOL_KEYS,
+			key: category
+		});
 		if (!toolKeys) {
 			logger?.warn(`Rovo Dev permissions have no target for the "${category}" category. Skipping it.`);
 			markSharedToolKeyRestriction({
@@ -96256,7 +96553,7 @@ function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 	}
 	if (isStringArray(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
 		permission.read ??= {};
-		permission.read[path] ??= "allow";
+		if (!Object.hasOwn(permission.read, path)) permission.read[path] = "allow";
 	}
 	return { permission };
 }
@@ -97993,11 +98290,17 @@ var TraePermissions = class TraePermissions extends ToolPermissions {
 		const permission = {};
 		const put = (category, pattern, action) => {
 			if (isPrototypePollutionKey(category) || isPrototypePollutionKey(pattern)) return;
-			const rules = permission[category] ??= {};
-			const existing = rules[pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: pattern
+				})
 			})) rules[pattern] = action;
 		};
 		for (const [key, value] of Object.entries(readRecord(customProfiles, COMMAND_RULES_PATH))) {
@@ -100340,7 +100643,10 @@ function toZedToolName(canonical) {
 		const address = toolParts.length > 0 ? `${server}:${toolParts.join("__")}` : server ?? "";
 		return `${MCP_ZED_PREFIX}${address}`;
 	}
-	return CANONICAL_TO_ZED_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_ZED_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName(zedName) {
 	if (zedName.startsWith(MCP_ZED_PREFIX)) {
@@ -100348,7 +100654,10 @@ function toCanonicalToolName(zedName) {
 		const address = toolParts.length > 0 ? `${server}__${toolParts.join(":")}` : server ?? "";
 		return `${MCP_CATEGORY_PREFIX}${address}`;
 	}
-	return ZED_TO_CANONICAL_TOOL_NAMES[zedName] ?? zedName;
+	return lookupOwn({
+		record: ZED_TO_CANONICAL_TOOL_NAMES,
+		key: zedName
+	}) ?? zedName;
 }
 /**
 * Zed matches `always_allow`/`always_deny`/`always_confirm` regexes against the
@@ -100660,7 +100969,10 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		const globalDefault = parsed.success ? parsed.data.default : void 0;
 		const permission = {};
 		const ensure = (category) => {
-			const existing = permission[category];
+			const existing = lookupOwn({
+				record: permission,
+				key: category
+			});
 			if (existing) return existing;
 			const created = {};
 			permission[category] = created;
@@ -101287,7 +101599,7 @@ function resolveToolOutputRoot({ outputRoot, toolTarget, global }) {
 async function convertFromTool(params) {
 	resetRunWarningState();
 	const packagingTarget = [params.fromTool, ...params.toTools].find(isPackagingToolTarget);
-	if (packagingTarget) throw new Error(`Plugin packaging target '${packagingTarget}' is not supported by convert. Use import and generate with explicit plugin directories.`);
+	if (packagingTarget) throw new Error(`Plugin packaging target '${packagingTarget}' is not supported by convert. Use import with the plugin directory as outputRoot (--output-root) and generate with it in outputRoots (--output-roots).`);
 	const ctx = params;
 	const [rulesCount, ignoreCount, mcpCount, commandsCount, subagentsCount, skillsCount, hooksCount, permissionsCount, checksCount] = [
 		await runFeatureConvert(ctx, buildRulesStrategy(ctx)),
@@ -104535,12 +104847,6 @@ Object.defineProperty(exports, "isFileSystemError", {
 		return isFileSystemError;
 	}
 });
-Object.defineProperty(exports, "isPackagingToolTarget", {
-	enumerable: true,
-	get: function() {
-		return isPackagingToolTarget;
-	}
-});
 Object.defineProperty(exports, "isRecord", {
 	enumerable: true,
 	get: function() {
@@ -104607,6 +104913,12 @@ Object.defineProperty(exports, "parseCommaSeparatedList", {
 		return parseCommaSeparatedList;
 	}
 });
+Object.defineProperty(exports, "parseConfigFileContent", {
+	enumerable: true,
+	get: function() {
+		return parseConfigFileContent;
+	}
+});
 Object.defineProperty(exports, "parseJsonc", {
 	enumerable: true,
 	get: function() {