rulesync 43.6.1 → 43.6.3

package/dist/{import-Safgeb1C.js → import-w0JlEoNl.js}

@@ -2269,6 +2269,190 @@ async function removeTempDirectory(tempDir) {
 		});
 	} catch {}
 }
+// src/utils/prototype-pollution.ts
+/**
+* Keys that, if walked into when constructing or merging objects from
+* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
+* chain) and propagate state to every other object in the runtime. Any code
+* that copies arbitrary user-supplied keys into a fresh object — frontmatter
+* parsing, MCP config conversion, settings round-trip — should skip these.
+*/
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPrototypePollutionKey(key) {
+	return PROTOTYPE_POLLUTION_KEYS.has(key);
+}
+/**
+* Returns a shallow copy of a record's own entries with every
+* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
+*
+* Use when copying a nested, user-supplied string map — an MCP server's `env`
+* or `headers` table — into freshly generated config. Carrying such a map by
+* reference, or re-assigning its keys via bracket notation, would let a literal
+* `__proto__` key ride along (and re-assigning it would mutate the target's
+* prototype). Walking the entries through this helper severs that path while
+* preserving every legitimate key.
+*/
+function omitPrototypePollutionKeys(record) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+/**
+* Like {@link omitPrototypePollutionKeys}, but recursive: every plain object
+* reachable through the value (directly, or through an array) is copied with
+* its prototype-pollution keys dropped. Scalars and arrays of scalars come back
+* as they are.
+*
+* Use when passing an unknown, user-supplied value through unchanged — an MCP
+* server field a tool documents that rulesync does not model — so a
+* `__proto__` key nested anywhere inside it cannot ride into the generated
+* config, where the consuming tool may merge the object without the same care.
+*/
+function omitPrototypePollutionKeysDeep(value) {
+	if (Array.isArray(value)) return value.map((entry) => omitPrototypePollutionKeysDeep(entry));
+	if (value === null || typeof value !== "object") return value;
+	const sanitized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = omitPrototypePollutionKeysDeep(entry);
+	}
+	return sanitized;
+}
+// src/utils/jsonc.ts
+/**
+* Rebuild the parsed value from its own enumerable entries, dropping
+* prototype-pollution keys (`__proto__`, `constructor`, `prototype`).
+* `jsonc-parser` assigns keys with plain `obj[key] = value` semantics, so a
+* literal `__proto__` key would replace the containing object's prototype
+* instead of becoming an own property; rebuilding gives every object a clean
+* `Object.prototype` again and severs that path.
+*/
+function deepSanitize(value) {
+	if (Array.isArray(value)) return value.map((item) => deepSanitize(item));
+	if (value !== null && typeof value === "object") {
+		const sanitized = {};
+		for (const [key, entry] of Object.entries(value)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			sanitized[key] = deepSanitize(entry);
+		}
+		return sanitized;
+	}
+	return value;
+}
+/**
+* Collect the paths of every prototype-pollution key in the document, walking
+* the syntax tree rather than the parsed value.
+*
+* The parsed value cannot answer this question for `__proto__`:
+* `obj["__proto__"] = "deny"` is discarded by the engine outright, and
+* `obj["__proto__"] = {...}` replaces the prototype instead of adding an own
+* property — either way the key is already gone by the time
+* {@link deepSanitize} could look for it, and only the source text still knows
+* the user wrote it. `constructor` and `prototype` do become own properties and
+* could be found in the parsed value, but they are collected here too so all
+* three keys are answered the same way.
+*
+* A pollution key's subtree is not descended into, matching
+* {@link deepSanitize}, which drops the whole value along with the key.
+*/
+function collectPollutionKeyPaths({ node, path, found }) {
+	if (node.type === "array") {
+		for (const [index, child] of (node.children ?? []).entries()) collectPollutionKeyPaths({
+			node: child,
+			path: `${path}[${index}]`,
+			found
+		});
+		return;
+	}
+	if (node.type !== "object") return;
+	for (const property of node.children ?? []) {
+		const [keyNode, valueNode] = property.children ?? [];
+		if (typeof keyNode?.value !== "string") continue;
+		const keyPath = path === "" ? keyNode.value : `${path}.${keyNode.value}`;
+		if (PROTOTYPE_POLLUTION_KEYS.has(keyNode.value)) {
+			found.push(keyPath);
+			continue;
+		}
+		if (valueNode !== void 0) collectPollutionKeyPaths({
+			node: valueNode,
+			path: keyPath,
+			found
+		});
+	}
+}
+/**
+* Parse a JSONC (JSON with Comments) document strictly.
+*
+* Unlike `jsonc-parser`'s bare `parse` (which silently tolerates syntax
+* errors and returns a best-effort value), this throws on any parse error so
+* a malformed source file fails loudly instead of generating half-empty tool
+* configs. Plain JSON is valid JSONC, so this is a drop-in replacement for
+* `JSON.parse` on files that may contain comments or trailing commas.
+*/
+function parseJsonc(content) {
+	return deepSanitize(parseStrict(content));
+}
+/**
+* The strict parse shared by both entry points. Kept separate from the syntax
+* tree walk so the many callers that never look at `droppedKeys` do not pay
+* for building a second representation of the document.
+*/
+function parseStrict(content) {
+	const errors = [];
+	const result = parse$1(content, errors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (errors.length > 0) {
+		const details = errors.map((e) => `${printParseErrorCode(e.error)} at offset ${e.offset}`).join(", ");
+		throw new SyntaxError(`Failed to parse JSONC content: ${details}`);
+	}
+	return result;
+}
+/**
+* The error a source document should fail with when
+* {@link parseJsoncReportingDroppedKeys} reports keys the parser removed.
+*
+* Shared by every source that reports them, so the three files a user can
+* author explain the same removal the same way rather than each inventing its
+* own wording.
+*/
+function droppedPollutionKeysError({ sourcePath, droppedKeys }) {
+	return /* @__PURE__ */ new Error(`${JSON.stringify(sourcePath)} uses ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")} as ${droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`);
+}
+/**
+* The same parse as {@link parseJsonc}, additionally reporting which
+* prototype-pollution keys were removed, as dotted paths
+* (`permission.bash.__proto__`).
+*
+* The parse itself is identical — the paths only let a caller tell the user
+* about entries that vanished, which they would otherwise have to notice by
+* comparing their source file against the generated output.
+*/
+function parseJsoncReportingDroppedKeys({ content }) {
+	const result = parseStrict(content);
+	const found = [];
+	const tree = parseTree(content, [], {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (tree !== void 0) collectPollutionKeyPaths({
+		node: tree,
+		path: "",
+		found
+	});
+	return {
+		value: deepSanitize(result),
+		droppedKeys: [...new Set(found)]
+	};
+}
 // src/types/json-output.ts
 /**
 * Error codes for CLI errors
@@ -3558,10 +3742,37 @@ const getDefaults = () => ({
 	inputRoots: void 0,
 	sources: []
 });
+/**
+* Parse the content of a config file (`rulesync.jsonc` / `rulesync.local.jsonc`)
+* through the same strict, sanitizing JSONC parser as every other rulesync
+* source.
+*
+* `jsonc-parser`'s bare `parse` recovers from syntax errors without reporting
+* them, which let a typo (a missing comma, unquoted keys, trailing garbage)
+* silently drop keys and run rulesync with a different config than the user
+* wrote. Prototype-pollution keys are rejected rather than silently removed,
+* matching the hooks, MCP and permissions sources.
+*/
+function parseConfigFileContent({ content, filePath }) {
+	let result;
+	try {
+		result = parseJsoncReportingDroppedKeys({ content });
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Error(`Failed to parse ${JSON.stringify(filePath)}: ${detail}`, { cause: error });
+	}
+	if (result.droppedKeys.length > 0) throw droppedPollutionKeysError({
+		sourcePath: filePath,
+		droppedKeys: result.droppedKeys
+	});
+	return result.value;
+}
 const loadConfigFromFile = async (filePath) => {
 	if (!await fileExists(filePath)) return {};
-	const fileContent = await readFileContent(filePath);
-	const jsonData = parse$1(fileContent);
+	const jsonData = parseConfigFileContent({
+		content: await readFileContent(filePath),
+		filePath
+	});
 	const { $schema: _schema, ...configParams } = ConfigFileSchema.parse(jsonData);
 	assertTargetsFeaturesExclusive({
 		targets: configParams.targets,
@@ -4174,62 +4385,6 @@ function createBoundedWalk({ subject, limits, root }) {
 		leave
 	};
 }
-// src/utils/prototype-pollution.ts
-/**
-* Keys that, if walked into when constructing or merging objects from
-* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
-* chain) and propagate state to every other object in the runtime. Any code
-* that copies arbitrary user-supplied keys into a fresh object — frontmatter
-* parsing, MCP config conversion, settings round-trip — should skip these.
-*/
-const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isPrototypePollutionKey(key) {
-	return PROTOTYPE_POLLUTION_KEYS.has(key);
-}
-/**
-* Returns a shallow copy of a record's own entries with every
-* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
-*
-* Use when copying a nested, user-supplied string map — an MCP server's `env`
-* or `headers` table — into freshly generated config. Carrying such a map by
-* reference, or re-assigning its keys via bracket notation, would let a literal
-* `__proto__` key ride along (and re-assigning it would mutate the target's
-* prototype). Walking the entries through this helper severs that path while
-* preserving every legitimate key.
-*/
-function omitPrototypePollutionKeys(record) {
-	const sanitized = {};
-	for (const [key, value] of Object.entries(record)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = value;
-	}
-	return sanitized;
-}
-/**
-* Like {@link omitPrototypePollutionKeys}, but recursive: every plain object
-* reachable through the value (directly, or through an array) is copied with
-* its prototype-pollution keys dropped. Scalars and arrays of scalars come back
-* as they are.
-*
-* Use when passing an unknown, user-supplied value through unchanged — an MCP
-* server field a tool documents that rulesync does not model — so a
-* `__proto__` key nested anywhere inside it cannot ride into the generated
-* config, where the consuming tool may merge the object without the same care.
-*/
-function omitPrototypePollutionKeysDeep(value) {
-	if (Array.isArray(value)) return value.map((entry) => omitPrototypePollutionKeysDeep(entry));
-	if (value === null || typeof value !== "object") return value;
-	const sanitized = {};
-	for (const [key, entry] of Object.entries(value)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = omitPrototypePollutionKeysDeep(entry);
-	}
-	return sanitized;
-}
 // src/utils/type-guards.ts
 /**
 * Type guard to check if a value is a plain object (Record<string, unknown>).
@@ -4857,6 +5012,24 @@ function lookupOwn({ record, key }) {
 	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
 /**
+* Return the value a map holds under its own `key`, first storing `create()`
+* there when it has none. A bracket read would find an inherited member for a
+* key such as `toString`, so an importer bucketing rules by a user-supplied
+* name would write into an `Object.prototype` function instead of a fresh
+* bucket.
+*/
+function getOrCreateOwn({ record, key, create }) {
+	if (Object.hasOwn(record, key)) return record[key];
+	const created = create();
+	Object.defineProperty(record, key, {
+		value: created,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+	return created;
+}
+/**
 * Swap the keys and values of a name map, e.g. a canonical-to-tool map into
 * the tool-to-canonical map an importer reads. When two keys share a value,
 * the later key wins.
@@ -6391,14 +6564,16 @@ const CANONICAL_TO_GOOSE_EVENT_NAMES = {
 * Hook events supported by Goose.
 *
 * Goose adopts the Open Plugins hooks spec: each plugin's `hooks/hooks.json`
-* maps PascalCase event names to matcher/handler arrays. Every Goose event has a
-* 1:1 canonical equivalent, so no new canonical events are required.
-*
-* Goose's `HookEvent` enum defines exactly these 11 events (v1.41.0). Notably it
-* has NO `SubagentStart`/`SubagentStop` arms — emitting them would write keys
-* Goose silently ignores, so `subagentStart`/`subagentStop` are intentionally
+* maps PascalCase event names to matcher/handler arrays.
+*
+* Goose's `HookEvent` enum defines these 11 events plus `PreToolUseResult`
+* (added in v1.48.0), which has no canonical equivalent: it is authored under
+* the `goose.hooks` override block by its native name, emitted verbatim, and
+* imported back into that block. Notably the enum has NO
+* `SubagentStart`/`SubagentStop` arms — emitting them would write keys Goose
+* silently ignores, so `subagentStart`/`subagentStop` are intentionally
 * excluded here and from `CANONICAL_TO_GOOSE_EVENT_NAMES`.
-* @see https://github.com/aaif-goose/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
+* @see https://github.com/aaif-goose/goose/blob/v1.48.0/crates/goose/src/hooks/mod.rs
 * @see https://goose-docs.ai/docs/guides/context-engineering/hooks/
 */
 const GOOSE_HOOK_EVENTS = eventsOf(CANONICAL_TO_GOOSE_EVENT_NAMES);
@@ -6876,134 +7051,6 @@ const GROKCLI_HOOK_EVENTS = eventsOf(CANONICAL_TO_GROKCLI_EVENT_NAMES);
 * Map Grok CLI PascalCase event names to canonical camelCase.
 */
 const GROKCLI_TO_CANONICAL_EVENT_NAMES = invertRecord(CANONICAL_TO_GROKCLI_EVENT_NAMES);
-// src/utils/jsonc.ts
-/**
-* Rebuild the parsed value from its own enumerable entries, dropping
-* prototype-pollution keys (`__proto__`, `constructor`, `prototype`).
-* `jsonc-parser` assigns keys with plain `obj[key] = value` semantics, so a
-* literal `__proto__` key would replace the containing object's prototype
-* instead of becoming an own property; rebuilding gives every object a clean
-* `Object.prototype` again and severs that path.
-*/
-function deepSanitize(value) {
-	if (Array.isArray(value)) return value.map((item) => deepSanitize(item));
-	if (value !== null && typeof value === "object") {
-		const sanitized = {};
-		for (const [key, entry] of Object.entries(value)) {
-			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			sanitized[key] = deepSanitize(entry);
-		}
-		return sanitized;
-	}
-	return value;
-}
-/**
-* Collect the paths of every prototype-pollution key in the document, walking
-* the syntax tree rather than the parsed value.
-*
-* The parsed value cannot answer this question for `__proto__`:
-* `obj["__proto__"] = "deny"` is discarded by the engine outright, and
-* `obj["__proto__"] = {...}` replaces the prototype instead of adding an own
-* property — either way the key is already gone by the time
-* {@link deepSanitize} could look for it, and only the source text still knows
-* the user wrote it. `constructor` and `prototype` do become own properties and
-* could be found in the parsed value, but they are collected here too so all
-* three keys are answered the same way.
-*
-* A pollution key's subtree is not descended into, matching
-* {@link deepSanitize}, which drops the whole value along with the key.
-*/
-function collectPollutionKeyPaths({ node, path, found }) {
-	if (node.type === "array") {
-		for (const [index, child] of (node.children ?? []).entries()) collectPollutionKeyPaths({
-			node: child,
-			path: `${path}[${index}]`,
-			found
-		});
-		return;
-	}
-	if (node.type !== "object") return;
-	for (const property of node.children ?? []) {
-		const [keyNode, valueNode] = property.children ?? [];
-		if (typeof keyNode?.value !== "string") continue;
-		const keyPath = path === "" ? keyNode.value : `${path}.${keyNode.value}`;
-		if (PROTOTYPE_POLLUTION_KEYS.has(keyNode.value)) {
-			found.push(keyPath);
-			continue;
-		}
-		if (valueNode !== void 0) collectPollutionKeyPaths({
-			node: valueNode,
-			path: keyPath,
-			found
-		});
-	}
-}
-/**
-* Parse a JSONC (JSON with Comments) document strictly.
-*
-* Unlike `jsonc-parser`'s bare `parse` (which silently tolerates syntax
-* errors and returns a best-effort value), this throws on any parse error so
-* a malformed source file fails loudly instead of generating half-empty tool
-* configs. Plain JSON is valid JSONC, so this is a drop-in replacement for
-* `JSON.parse` on files that may contain comments or trailing commas.
-*/
-function parseJsonc(content) {
-	return deepSanitize(parseStrict(content));
-}
-/**
-* The strict parse shared by both entry points. Kept separate from the syntax
-* tree walk so the many callers that never look at `droppedKeys` do not pay
-* for building a second representation of the document.
-*/
-function parseStrict(content) {
-	const errors = [];
-	const result = parse$1(content, errors, {
-		allowTrailingComma: true,
-		disallowComments: false
-	});
-	if (errors.length > 0) {
-		const details = errors.map((e) => `${printParseErrorCode(e.error)} at offset ${e.offset}`).join(", ");
-		throw new SyntaxError(`Failed to parse JSONC content: ${details}`);
-	}
-	return result;
-}
-/**
-* The error a source document should fail with when
-* {@link parseJsoncReportingDroppedKeys} reports keys the parser removed.
-*
-* Shared by every source that reports them, so the three files a user can
-* author explain the same removal the same way rather than each inventing its
-* own wording.
-*/
-function droppedPollutionKeysError({ sourcePath, droppedKeys }) {
-	return /* @__PURE__ */ new Error(`${JSON.stringify(sourcePath)} uses ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")} as ${droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`);
-}
-/**
-* The same parse as {@link parseJsonc}, additionally reporting which
-* prototype-pollution keys were removed, as dotted paths
-* (`permission.bash.__proto__`).
-*
-* The parse itself is identical — the paths only let a caller tell the user
-* about entries that vanished, which they would otherwise have to notice by
-* comparing their source file against the generated output.
-*/
-function parseJsoncReportingDroppedKeys({ content }) {
-	const result = parseStrict(content);
-	const found = [];
-	const tree = parseTree(content, [], {
-		allowTrailingComma: true,
-		disallowComments: false
-	});
-	if (tree !== void 0) collectPollutionKeyPaths({
-		node: tree,
-		path: "",
-		found
-	});
-	return {
-		value: deepSanitize(result),
-		droppedKeys: [...new Set(found)]
-	};
-}
 // src/utils/rulesync-source-path.ts
 /**
 * No `.rulesync/` source file exists for a feature at any of its candidate
@@ -9676,11 +9723,9 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 	* `PERMISSION_OVERRIDE_KEY_ALIASES`) is replaced wholesale, and removed when
 	* the import does not produce one: only that tool's import ever writes it, so
 	* a setting removed from the tool's own config has to disappear here too.
-	* Any other tool's override block the import carries (Hermes restores them
-	* from its provenance) merges one level down: an imported field replaces the
-	* existing field, fields the import does not name are kept, and a
-	* `permission` record inside the block merges per category. Every other
-	* top-level key — `$schema` included — is kept unless the import names it.
+	* Every other top-level key — `$schema` included — is kept unless the import
+	* names it, in which case the imported value replaces it. No importer emits
+	* another tool's override block, so those blocks are never touched here.
 	*/
 	static mergeImportedJson({ existing, imported, toolTarget }) {
 		const ownOverrideKey = PERMISSION_OVERRIDE_KEY_ALIASES[toolTarget] ?? toolTarget;
@@ -9692,14 +9737,7 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 				existing: current,
 				imported: value
 			});
-			else if (isRecord(current) && isRecord(value)) {
-				const block = { ...current };
-				for (const [field, fieldValue] of Object.entries(value)) block[field] = field === "permission" ? mergePermissionCategories({
-					existing: block[field],
-					imported: fieldValue
-				}) : fieldValue;
-				merged[key] = block;
-			} else merged[key] = value;
+			else merged[key] = value;
 		}
 		return merged;
 	}
@@ -19558,9 +19596,6 @@ var KiloCommand = class extends FrontmatterMarkdownToolCommand {
 	static getFrontmatterSchema() {
 		return KiloCommandFrontmatterSchema;
 	}
-	getRulesyncOutputRoot() {
-		return process.cwd();
-	}
 	/**
 	* Refuse to write a command Kilo reserves (see
 	* {@link KILO_RESERVED_COMMAND_NAMES}). The name Kilo loads is the file
@@ -20849,9 +20884,6 @@ var OpenCodeCommand = class extends FrontmatterMarkdownToolCommand {
 			...Object.keys(restFields).length > 0 && { [toolTarget]: restFields }
 		};
 	}
-	getRulesyncOutputRoot() {
-		return process.cwd();
-	}
 	/**
 	* Imports commands defined inline in `opencode.json` / `opencode.jsonc` (and,
 	* at project scope, `.opencode/opencode.json(c)`, which OpenCode merges over
@@ -52366,6 +52398,29 @@ var AmpHooks = class AmpHooks extends ToolHooks {
 		});
 	}
 };
+// src/features/hooks/hook-matcher-tool-names.ts
+const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
+function isMatcherName(token) {
+	return !token.startsWith("\\") && !token.startsWith("[");
+}
+/**
+* The distinct whole names in a matcher that start with a capital letter, for
+* adapters whose runtime tool names are all lowercase: after translation, such
+* a name has no runtime equivalent and can never match.
+*/
+function capitalizedMatcherNames(matcher) {
+	const names = [...matcher.matchAll(MATCHER_TOKEN_PATTERN)].map(([token]) => token).filter((token) => isMatcherName(token) && /^[A-Z]/.test(token));
+	return [...new Set(names)];
+}
+/**
+* Rewrites the whole tool names inside a hook `matcher` regex through `names`,
+* leaving escapes, character classes and unknown names as written. Used by
+* adapters whose runtime tool names differ from the canonical (Claude Code)
+* spelling.
+*/
+function replaceMatcherNames(matcher, names) {
+	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
+}
 // src/utils/object.ts
 /**
 * Return a shallow copy of `obj` keeping only the entries whose value is
@@ -54286,6 +54341,48 @@ const ANTIGRAVITY_FLAT_HANDLER_EVENTS = new Set([...ANTIGRAVITY_NO_MATCHER_EVENT
 	record: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
 	key: event
 }) ?? event));
+const CANONICAL_TO_ANTIGRAVITY_TOOL_NAMES = {
+	Bash: "run_command",
+	Read: "(?:read_file|view_file)",
+	Write: "(?:write_file|write_to_file)",
+	Edit: "(?:edit_file|replace_file_content)",
+	WebSearch: "search_web"
+};
+const ANTIGRAVITY_TO_CANONICAL_TOOL_NAMES = {
+	run_command: "Bash",
+	read_file: "Read",
+	view_file: "Read",
+	write_file: "Write",
+	write_to_file: "Write",
+	edit_file: "Edit",
+	replace_file_content: "Edit",
+	search_web: "WebSearch"
+};
+const ANTIGRAVITY_GROUP_TO_CANONICAL_TOOL_NAMES = Object.entries(CANONICAL_TO_ANTIGRAVITY_TOOL_NAMES).filter(([, name]) => name.startsWith("(?:")).map(([canonical, group]) => [group, canonical]);
+const ANTIGRAVITY_DOCUMENTED_TOOL_CANDIDATES = {
+	Grep: "grep_search",
+	Glob: "find_by_name",
+	WebFetch: "read_url_content",
+	MultiEdit: "multi_replace_file_content"
+};
+function canonicalToAntigravityMatcher({ matcher, eventName, warn }) {
+	const translated = replaceMatcherNames(matcher, CANONICAL_TO_ANTIGRAVITY_TOOL_NAMES);
+	const unmatched = capitalizedMatcherNames(translated);
+	if (unmatched.length > 0) {
+		const candidates = unmatched.flatMap((name) => {
+			const candidate = lookupOwn({
+				record: ANTIGRAVITY_DOCUMENTED_TOOL_CANDIDATES,
+				key: name
+			});
+			return candidate ? [`\`${candidate}\` for ${quoteValueForWarning(name)}`] : [];
+		});
+		warn(`Antigravity reports lowercase tool names in the hook payload (\`toolCall.name\`), and ${unmatched.map((name) => quoteValueForWarning(name)).join(", ")} in the "${eventName}" matcher ${quoteValueForWarning(matcher)} has no verified Antigravity equivalent, so it is written as-is and will likely never match. Use the tool name Antigravity reports instead` + (candidates.length > 0 ? ` (the Antigravity hooks docs list ${candidates.join(", ")}, unverified).` : "."));
+	}
+	return translated;
+}
+function antigravityToCanonicalMatcher(matcher) {
+	return replaceMatcherNames(ANTIGRAVITY_GROUP_TO_CANONICAL_TOOL_NAMES.reduce((current, [group, canonical]) => current.split(group).join(canonical), matcher), ANTIGRAVITY_TO_CANONICAL_TOOL_NAMES);
+}
 /**
 * Antigravity uses a Claude-Code-like `hooks.json`. The `PreToolUse` /
 * `PostToolUse` events use the matcher-based group shape, while `SessionStart`,
@@ -54299,7 +54396,11 @@ const ANTIGRAVITY_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: ANTIGRAVITY_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	noMatcherEvents: ANTIGRAVITY_NO_MATCHER_EVENTS,
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
+	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	matcherTranslation: {
+		toTool: canonicalToAntigravityMatcher,
+		toCanonical: antigravityToCanonicalMatcher
+	}
 };
 /**
 * Turn the shared converter's matcher-group output into Antigravity's shape:
@@ -57332,20 +57433,6 @@ var CopilotcliHooks = class CopilotcliHooks extends ToolHooks {
 		}), null, 2) });
 	}
 };
-// src/features/hooks/hook-matcher-tool-names.ts
-const MATCHER_TOKEN_PATTERN = /\\.|\[(?:\\.|[^\]\\])*\]|(?<=^|[^\w\\]|\\\w)[A-Za-z_]\w*(?!\w)/gs;
-function isMatcherName(token) {
-	return !token.startsWith("\\") && !token.startsWith("[");
-}
-/**
-* Rewrites the whole tool names inside a hook `matcher` regex through `names`,
-* leaving escapes, character classes and unknown names as written. Used by
-* adapters whose runtime tool names differ from the canonical (Claude Code)
-* spelling.
-*/
-function replaceMatcherNames(matcher, names) {
-	return matcher.replace(MATCHER_TOKEN_PATTERN, (token) => isMatcherName(token) && Object.hasOwn(names, token) ? names[token] ?? token : token);
-}
 // src/features/hooks/cortexcode-hooks.ts
 const CORTEXCODE_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]);
 const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
@@ -57359,8 +57446,8 @@ const CANONICAL_TO_CORTEXCODE_TOOL_NAMES = {
 const CORTEXCODE_TO_CANONICAL_TOOL_NAMES = invertRecord(CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
 function canonicalToCortexcodeMatcher({ matcher, eventName, warn }) {
 	const translated = replaceMatcherNames(matcher, CANONICAL_TO_CORTEXCODE_TOOL_NAMES);
-	const unmatched = [...translated.matchAll(MATCHER_TOKEN_PATTERN)].map(([token]) => token).filter((token) => isMatcherName(token) && /^[A-Z]/.test(token));
-	if (unmatched.length > 0) warn(`Cortex Code matches hook matchers case-sensitively against lowercase runtime tool names, and ${[...new Set(unmatched)].map((name) => quoteValueForWarning(name)).join(", ")} in the "${eventName}" matcher ${quoteValueForWarning(matcher)} is not a tool Cortex Code documents a runtime ID for, so it is written as-is and will likely never match. Replace it with the lowercase name Cortex Code uses for that tool, if it has one.`);
+	const unmatched = capitalizedMatcherNames(translated);
+	if (unmatched.length > 0) warn(`Cortex Code matches hook matchers case-sensitively against lowercase runtime tool names, and ${unmatched.map((name) => quoteValueForWarning(name)).join(", ")} in the "${eventName}" matcher ${quoteValueForWarning(matcher)} is not a tool Cortex Code documents a runtime ID for, so it is written as-is and will likely never match. Replace it with the lowercase name Cortex Code uses for that tool, if it has one.`);
 	return translated;
 }
 function cortexcodeToCanonicalMatcher(matcher) {
@@ -58608,12 +58695,11 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 		});
 	}
 	toRulesyncHooks({ logger } = {}) {
-		const parsed = this.parseFileContentOrThrow({
-			displayName: "Goose",
-			parse: (fileContent) => JSON.parse(fileContent)
-		});
 		const hooks = toolHooksToCanonical({
-			hooks: parsed.hooks && typeof parsed.hooks === "object" && !Array.isArray(parsed.hooks) ? Object.fromEntries(Object.entries(parsed.hooks).filter(([eventName]) => Object.hasOwn(GOOSE_TO_CANONICAL_EVENT_NAMES, eventName))) : parsed.hooks,
+			hooks: this.parseFileContentOrThrow({
+				displayName: "Goose",
+				parse: (fileContent) => JSON.parse(fileContent)
+			}).hooks,
 			converterConfig: GOOSE_CONVERTER_CONFIG,
 			logger
 		});
@@ -61880,12 +61966,14 @@ var ReasonixHooks = class ReasonixHooks extends ToolHooks {
 		const paths = ReasonixHooks.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		let settings;
+		let parsed;
 		try {
-			settings = JSON.parse(existingContent);
+			parsed = JSON.parse(existingContent);
 		} catch (error) {
 			throw new Error(`Failed to parse existing Reasonix settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		if (!isPlainObject(parsed)) throw new Error(`Failed to parse existing Reasonix settings at ${filePath}: expected a mapping at the root`);
+		const settings = parsed;
 		const config = rulesyncHooks.getJson();
 		const reasonixHooks = canonicalToReasonixHooks({
 			config,
@@ -62844,15 +62932,18 @@ function emittedEventsWithHook(params) {
 }
 /**
 * The capabilities an adapter built on the shared hooks converter already
-* declares in its converter config: the events it emits and the hook types it
-* keeps. Reading them from there keeps the processor's skip warnings in step
-* with what the converter actually writes.
+* declares in its converter config: the events it emits, the hook types it
+* keeps, and whether it writes the per-hook `enabled` flag. Reading them from
+* there keeps the processor's skip and dropped-field warnings in step with
+* what the converter actually writes.
 */
 function converterCapabilities(config) {
 	if (!config.supportedHookTypes) throw new Error("Hooks converter config must declare its supportedHookTypes");
+	const passesThroughEnabled = (config.booleanPassthroughFields ?? []).some((field) => field.canonical === "enabled");
 	return {
 		supportedEvents: config.supportedEvents,
-		supportedHookTypes: [...config.supportedHookTypes]
+		supportedHookTypes: [...config.supportedHookTypes],
+		...passesThroughEnabled ? { supportsPerHookEnabled: true } : {}
 	};
 }
 const toolHooksFactories = /* @__PURE__ */ new Map([
@@ -63474,8 +63565,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		},
 		...converterCapabilities(ZCODE_CONVERTER_CONFIG),
-		supportsMatcher: true,
-		supportsPerHookEnabled: true
+		supportsMatcher: true
 	}],
 	["zcode-plugin", {
 		class: ZcodePluginHooks,
@@ -63485,10 +63575,12 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		},
 		...converterCapabilities(ZCODE_PLUGIN_CONVERTER_CONFIG),
-		supportsMatcher: true,
-		supportsPerHookEnabled: true
+		supportsMatcher: true
 	}]
 ]);
+function targetsSupporting(capability) {
+	return [...toolHooksFactories.entries()].filter(([, f]) => f[capability]).map(([t]) => t).join(" / ");
+}
 const hooksProcessorToolTargets = [...toolHooksFactories.entries()].filter(([, f]) => f.meta.supportsProject).map(([t]) => t);
 const hooksProcessorToolTargetsGlobal = [...toolHooksFactories.entries()].filter(([, f]) => f.meta.supportsGlobal).map(([t]) => t);
 const hooksProcessorToolTargetsImportable = [...toolHooksFactories.entries()].filter(([, f]) => f.meta.supportsProject && f.meta.supportsImport).map(([t]) => t);
@@ -63649,7 +63741,7 @@ var HooksProcessor = class extends FeatureProcessor {
 				effectiveHooks,
 				predicate: (def) => def.enabled === false
 			});
-			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the ${targetsSupporting("supportsPerHookEnabled")} hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
 		}
 		if (!factory.supportsPerHookConfirm) {
 			const eventsWithConfirmHooks = emittedEventsWithHook({
@@ -63658,7 +63750,7 @@ var HooksProcessor = class extends FeatureProcessor {
 				effectiveHooks,
 				predicate: (def) => def.confirm !== void 0
 			});
-			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the kiro-cli / kiro-ide hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
+			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the ${targetsSupporting("supportsPerHookConfirm")} hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
 		}
 	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
@@ -64921,12 +65013,7 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 	}
 	toRulesyncIgnore() {
 		const rulesyncPatterns = uniq(this.patterns.map((entry) => readDenyPatternOf(entry)).filter((pattern) => pattern !== null && pattern.length > 0));
-		return new RulesyncIgnore({
-			outputRoot: this.outputRoot,
-			relativeDirPath: RulesyncIgnore.getSettablePaths().recommended.relativeDirPath,
-			relativeFilePath: RulesyncIgnore.getSettablePaths().recommended.relativeFilePath,
-			fileContent: rulesyncPatterns.join("\n")
-		});
+		return this.toRulesyncIgnoreDefault({ fileContent: rulesyncPatterns.join("\n") });
 	}
 	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false, logger }) {
 		await warnIfReasonixNestedProjectConfigShadowed({
@@ -78633,11 +78720,17 @@ function convertAmpToRulesync({ disable, permissions }) {
 	const assign = (tool, pattern, action) => {
 		if (isPrototypePollutionKey(tool)) return;
 		if (isPrototypePollutionKey(pattern)) return;
-		const bucket = permission[tool] ??= {};
-		const existing = bucket[pattern];
+		const bucket = getOrCreateOwn({
+			record: permission,
+			key: tool,
+			create: () => ({})
+		});
 		if (isStricterAction({
 			action,
-			existing
+			existing: lookupOwn({
+				record: bucket,
+				key: pattern
+			})
 		})) bucket[pattern] = action;
 	};
 	for (const tool of disable) assign(tool, "*", "deny");
@@ -80040,8 +80133,12 @@ function convertAntigravityToRulesyncPermissions({ allow, ask, deny, toCategory,
 				logger,
 				toolLabel
 			}) : target;
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(allow, "allow");
@@ -80109,10 +80206,16 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 };
 function toAntigravityCliToolName(canonical) {
 	if (canonical.startsWith("mcp__")) return "mcp";
-	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$9(cliName) {
-	return ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES[cliName] ?? cliName;
+	return lookupOwn({
+		record: ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES,
+		key: cliName
+	}) ?? cliName;
 }
 /**
 * Permissions generator for the Google Antigravity CLI (`agy`, Antigravity 2.0).
@@ -80275,10 +80378,16 @@ const IDE_ACTION_TO_CANONICAL = {
 };
 function toIdeAction(canonical) {
 	if (canonical.startsWith("mcp__")) return "mcp";
-	return CANONICAL_TO_IDE_ACTION[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_IDE_ACTION,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalCategory$2(ideAction) {
-	return IDE_ACTION_TO_CANONICAL[ideAction] ?? ideAction;
+	return lookupOwn({
+		record: IDE_ACTION_TO_CANONICAL,
+		key: ideAction
+	}) ?? ideAction;
 }
 /**
 * Permissions generator for the Google Antigravity IDE (Antigravity 2.0).
@@ -81817,10 +81926,16 @@ const CANONICAL_TO_CLAUDE_TOOL_NAMES = {
 */
 const CLAUDE_TO_CANONICAL_TOOL_NAMES = invertRecord(CANONICAL_TO_CLAUDE_TOOL_NAMES);
 function toClaudeToolName(canonical) {
-	return CANONICAL_TO_CLAUDE_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_CLAUDE_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$7(claudeName) {
-	return CLAUDE_TO_CANONICAL_TOOL_NAMES[claudeName] ?? claudeName;
+	return lookupOwn({
+		record: CLAUDE_TO_CANONICAL_TOOL_NAMES,
+		key: claudeName
+	}) ?? claudeName;
 }
 /**
 * Merge `patch` into `base`, recursing into plain objects so a sibling key at
@@ -82792,7 +82907,10 @@ const CLAUDE_PATH_RULE_ALIASES = {
 */
 function buildClaudePermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
-	return `${CLAUDE_PATH_RULE_ALIASES[toolName] ?? toolName}(${pattern})`;
+	return `${lookupOwn({
+		record: CLAUDE_PATH_RULE_ALIASES,
+		key: toolName
+	}) ?? toolName}(${pattern})`;
 }
 /**
 * The Claude tool names the canonical config manages. Deliberately the tool
@@ -83030,8 +83148,12 @@ function convertClaudeToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalToolName$7(toolName);
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -83613,11 +83735,17 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 		for (const action of CODEBUDDY_RULE_LISTS) for (const rule of toStringArray$1(permissions[action])) {
 			const parsed = parseCodebuddyRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.category) || isPrototypePollutionKey(parsed.pattern)) continue;
-			const rules = permission[parsed.category] ??= {};
-			const existing = rules[parsed.pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: parsed.category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: parsed.pattern
+				})
 			})) rules[parsed.pattern] = action;
 		}
 		const codebuddy = liftCodebuddyOverride({
@@ -84127,7 +84255,10 @@ const CODEWHALE_WRITE_RESTRICTION_TOOLS = ["write_file", "apply_patch"];
 /** The Codewhale tools a canonical path rule is written for. */
 function pathCategoryTools(category, action) {
 	if (category === "write" && action !== "allow") return CODEWHALE_WRITE_RESTRICTION_TOOLS;
-	return CODEWHALE_PATH_CATEGORY_TOOLS[category] ?? [];
+	return lookupOwn({
+		record: CODEWHALE_PATH_CATEGORY_TOOLS,
+		key: category
+	}) ?? [];
 }
 /** The canonical path categories a Codewhale file tool's rule can come from. */
 const CODEWHALE_TOOL_TO_PATH_CATEGORIES = {
@@ -84446,7 +84577,10 @@ function canonicalToCodewhaleRules({ config, preservedRules, logger }) {
 	});
 	for (const [category, rules] of Object.entries(config.permission)) {
 		if (category === "bash" || category === "*") continue;
-		if (CODEWHALE_PATH_CATEGORY_TOOLS[category] === void 0) {
+		if (lookupOwn({
+			record: CODEWHALE_PATH_CATEGORY_TOOLS,
+			key: category
+		}) === void 0) {
 			if (Object.keys(rules).length > 0) logger?.warn(`Codewhale permissions: skipping unsupported category "${category}"; Codewhale evaluates permission rules only for shell commands and file tools.`);
 			continue;
 		}
@@ -84556,7 +84690,10 @@ function toImportCandidates(rule) {
 	}
 	const pattern = pathRuleToPattern(rule);
 	if (pattern === null) return [];
-	return (CODEWHALE_TOOL_TO_PATH_CATEGORIES[rule.tool] ?? []).map((category) => ({
+	return (lookupOwn({
+		record: CODEWHALE_TOOL_TO_PATH_CATEGORIES,
+		key: rule.tool
+	}) ?? []).map((category) => ({
 		category,
 		pattern,
 		rule
@@ -86164,10 +86301,17 @@ function parseCommandcodeRuleLists(permissions) {
 				rule,
 				category
 			})) fallbackLogger.warn(`Command Code matches '${rule}' in "${action}" against MCP tool names case-insensitively, but the '${category}' rule generated from it matches the server and tool names exactly as written; spell the rule the way the tool is registered if they differ.`);
-			const rules = permission[category] ??= {};
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing: rules[pattern]
+				existing: lookupOwn({
+					record: rules,
+					key: pattern
+				})
 			})) rules[pattern] = action;
 		}
 	}
@@ -86528,9 +86672,12 @@ function convertContinuePermissionsToRulesync(lists) {
 			const parsedEntry = parseContinuePermissionEntry(entry);
 			if (parsedEntry === void 0) continue;
 			if (isPrototypePollutionKey(parsedEntry.toolName) || isPrototypePollutionKey(parsedEntry.pattern)) continue;
-			const category = toCanonicalToolName$6(parsedEntry.toolName);
-			permission[category] ??= {};
-			permission[category][parsedEntry.pattern] ??= action;
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: toCanonicalToolName$6(parsedEntry.toolName),
+				create: () => ({})
+			});
+			if (!Object.hasOwn(rules, parsedEntry.pattern)) rules[parsedEntry.pattern] = action;
 		}
 	}
 	return { permission };
@@ -87159,7 +87306,9 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		const settings = this.parseSettings();
 		const rules = {};
 		for (const pattern of toUrlList(settings[DENIED_URLS_KEY])) rules[pattern] = "deny";
-		if (this.global) for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) rules[pattern] ??= "allow";
+		if (this.global) {
+			for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) if (!Object.hasOwn(rules, pattern)) rules[pattern] = "allow";
+		}
 		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY$1]: rules } : {};
 		const defaultPermissionMode = this.global ? settings[DEFAULT_PERMISSION_MODE_KEY] : void 0;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
@@ -87506,7 +87655,10 @@ function isMcpScopedCategory(canonical) {
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
-	return CANONICAL_TO_CURSOR_TYPE[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_CURSOR_TYPE,
+		key: canonical
+	}) ?? canonical;
 }
 /**
 * For per-tool MCP canonical categories like `mcp__puppeteer__navigate`, the
@@ -87538,9 +87690,15 @@ function toCanonicalCategory$1(cursorType, pattern) {
 			const tool = match[2] ?? "*";
 			return `${MCP_CATEGORY_PREFIX}${server}__${tool}`;
 		}
-		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
+		return lookupOwn({
+			record: CURSOR_TYPE_TO_CANONICAL,
+			key: cursorType
+		}) ?? cursorType.toLowerCase();
 	}
-	return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
+	return lookupOwn({
+		record: CURSOR_TYPE_TO_CANONICAL,
+		key: cursorType
+	}) ?? cursorType.toLowerCase();
 }
 /**
 * Narrow `JSON.parse` output to a plain object before treating it as a Cursor
@@ -87785,9 +87943,13 @@ function convertCursorToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { toolName: type, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
-			if (!permission[canonical]) permission[canonical] = {};
 			const canonicalPattern = type === "Mcp" && canonical.startsWith("mcp__") ? "*" : pattern;
-			permission[canonical][canonicalPattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(canonicalPattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[canonicalPattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -88714,10 +88876,16 @@ const DEVIN_SCOPE_TO_CANONICAL = {
 */
 const DEVIN_BARE_ONLY_SCOPES = /* @__PURE__ */ new Set(["web_search"]);
 function toDevinScope(canonical) {
-	return CANONICAL_TO_DEVIN_SCOPE[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_DEVIN_SCOPE,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalCategory(devinScope) {
-	return DEVIN_SCOPE_TO_CANONICAL[devinScope] ?? devinScope;
+	return lookupOwn({
+		record: DEVIN_SCOPE_TO_CANONICAL,
+		key: devinScope
+	}) ?? devinScope;
 }
 function asDevinRecord(value) {
 	return isRecord(value) ? { ...value } : {};
@@ -89069,7 +89237,11 @@ function convertDevinToRulesyncPermissions(params) {
 			const { toolName: scope, pattern } = parseToolPatternEntry(entry);
 			if (isPrototypePollutionKey(scope) || isPrototypePollutionKey(pattern)) continue;
 			const canonical = toCanonicalCategory(scope);
-			(permission[canonical] ??= {})[pattern] = action;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -89375,7 +89547,10 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	};
 	const assigned = /* @__PURE__ */ new Map();
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
-		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
+		const toolName = lookupOwn({
+			record: RULESYNC_TO_GOOSE_TOOL_NAME,
+			key: category
+		}) ?? category;
 		for (const [pattern, action] of Object.entries(rules)) if (pattern !== "*") logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 		const { action, downgraded } = failSafeCatchAllAction({
 			rules,
@@ -89407,9 +89582,16 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
 		const toolNames = isStringArray(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
-		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
-			permission[category] ??= {};
-			permission[category]["*"] = action;
+		for (const toolName of toolNames) for (const category of lookupOwn({
+			record: GOOSE_TO_RULESYNC_TOOL_NAMES,
+			key: toolName
+		}) ?? [toolName]) {
+			if (isPrototypePollutionKey(category)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			})["*"] = action;
 		}
 	}
 	return { permission };
@@ -89490,7 +89672,10 @@ function buildGrokEntry(category, pattern) {
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
 	if (category === "mcp") return pattern === "*" || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
-	const tool = CATEGORY_TO_GROK_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_GROK_TOOL,
+		key: category
+	});
 	if (tool === void 0) return null;
 	return pattern === "*" || pattern === "" ? tool : `${tool}(${toGrokPathPattern(category, pattern)})`;
 }
@@ -89524,7 +89709,10 @@ function parseGrokEntry(entry) {
 		category: "mcp",
 		pattern: "*"
 	};
-	const category = GROK_TOOL_TO_CATEGORY[tool];
+	const category = lookupOwn({
+		record: GROK_TOOL_TO_CATEGORY,
+		key: tool
+	});
 	if (category === void 0) return null;
 	return {
 		category,
@@ -89845,11 +90033,17 @@ function parseGrokPermissionArrays(permission) {
 	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) + (rules?.length ?? 0) === 0) return null;
 	const result = {};
 	const record = ({ category, pattern, action }) => {
-		const bucket = result[category] ??= {};
-		const existing = bucket[pattern];
+		const bucket = getOrCreateOwn({
+			record: result,
+			key: category,
+			create: () => ({})
+		});
 		if (isStricterAction({
 			action,
-			existing
+			existing: lookupOwn({
+				record: bucket,
+				key: pattern
+			})
 		})) bucket[pattern] = action;
 	};
 	const applyEntries = (entries, action) => {
@@ -89906,7 +90100,11 @@ function deleteRulesByAction(rules, action) {
 	for (const [pattern, currentAction] of Object.entries(rules)) if (currentAction === action) delete rules[pattern];
 }
 function ensureCategory(permission, category) {
-	return permission[category] ??= {};
+	return getOrCreateOwn({
+		record: permission,
+		key: category,
+		create: () => ({})
+	});
 }
 function removeEmptyCategories(permission) {
 	for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
@@ -90087,6 +90285,22 @@ function unmanagedMcpAllowlistEntries({ existing, previousPermission, nextPermis
 		return category === null || !Object.hasOwn(previousPermission, category) && !Object.hasOwn(nextPermission, category);
 	});
 }
+/** Hermes's override key in the canonical document (`hermes`). */
+const HERMES_OVERRIDE_KEY = PERMISSION_OVERRIDE_KEY_ALIASES.hermesagent ?? "hermesagent";
+/**
+* The part of a canonical permissions document Hermes keeps as provenance: the
+* `$schema`, the canonical `permission` block, and Hermes's own override.
+*/
+function hermesProvenanceOf(permissions) {
+	const source = permissions;
+	const provenance = {};
+	for (const key of [
+		"$schema",
+		"permission",
+		HERMES_OVERRIDE_KEY
+	]) if (source[key] !== void 0) provenance[key] = source[key];
+	return provenance;
+}
 /** The validated canonical `permission` block of a config's `permissions.rulesync` blob. */
 function canonicalPermissionOf(config) {
 	const parsed = RulesyncPermissionsFileSchema.safeParse({ permission: provenancePermissionOf(config) });
@@ -90254,10 +90468,10 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			patterns: websiteBlocklist.enabled === true && isStringArray(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
-		const { permission: _permission, hermes: _hermes, ...otherProvenance } = provenance;
 		const hermes = buildHermesOverride(config, provenance);
+		const { $schema } = provenance;
 		const imported = {
-			...otherProvenance,
+			...$schema !== void 0 && { $schema },
 			permission,
 			...Object.keys(hermes).length > 0 && { hermes }
 		};
@@ -90315,7 +90529,7 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			base: config,
 			patch: permissions.hermes
 		});
-		config.permissions = { rulesync: permissions };
+		config.permissions = { rulesync: hermesProvenanceOf(permissions) };
 		return new HermesagentPermissions({
 			outputRoot,
 			fileContent: stringifySharedConfig({
@@ -90549,7 +90763,10 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 function convertRulesyncToJunieRules({ config, logger, existingRules, overrideSecretFile, overrideRuleDefaults }) {
 	const ruleLists = {};
 	for (const [category, patterns] of Object.entries(honorAllToolsOnBash(config.permission))) {
-		const group = CANONICAL_TO_JUNIE_GROUP[category];
+		const group = lookupOwn({
+			record: CANONICAL_TO_JUNIE_GROUP,
+			key: category
+		});
 		if (!group) {
 			if (Object.keys(patterns).length > 0) logger?.warn(`Junie allowlist only models executables/fileEditing/mcpTools/readOutsideProject (canonical bash/edit/write/read/mcp); '${category}' rules cannot be represented and were skipped.`);
 			continue;
@@ -90947,7 +91164,10 @@ const CATEGORY_TO_KIMI_CODE_TOOL = {
 function buildKimiCodePattern(category, pattern) {
 	if (category.startsWith("mcp__")) return pattern === "*" || pattern === "" ? category : null;
 	if (category === "mcp") return pattern === "*" || pattern === "" ? "mcp__*" : `mcp__${pattern}`;
-	const tool = CATEGORY_TO_KIMI_CODE_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_KIMI_CODE_TOOL,
+		key: category
+	});
 	if (!tool) return null;
 	return pattern === "*" || pattern === "" ? tool : `${tool}(${pattern})`;
 }
@@ -91043,7 +91263,10 @@ function canonicalToKimiCodeRules({ config, logger }) {
 	const canonicalRules = [];
 	const overrideRules = config["kimi-code"]?.rules ?? [];
 	for (const [category, rules] of Object.entries(config.permission)) {
-		if (!(category === "mcp" || category.startsWith("mcp__") || CATEGORY_TO_KIMI_CODE_TOOL[category] !== void 0)) {
+		if (!(category === "mcp" || category.startsWith("mcp__") || lookupOwn({
+			record: CATEGORY_TO_KIMI_CODE_TOOL,
+			key: category
+		}) !== void 0)) {
 			if (Object.keys(rules).length > 0) logger?.warn(`Kimi Code permissions: skipping unsupported category "${category}".`);
 			continue;
 		}
@@ -91860,9 +92083,16 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 			if (!isImportableRule(rule) || !isRecord(rule) || !isPermissionAction(rule.effect)) continue;
 			const category = KIRO_CAPABILITY_TO_CANONICAL[rule.capability];
 			const patterns = rule.match === void 0 ? ["*"] : isStringArray(rule.match) ? rule.match : [];
-			const categoryRules = permission[category] ??= {};
+			const categoryRules = getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			});
 			for (const pattern of patterns) {
-				const previous = categoryRules[pattern];
+				const previous = lookupOwn({
+					record: categoryRules,
+					key: pattern
+				});
 				if (isStricterAction({
 					action: rule.effect,
 					existing: previous
@@ -91880,7 +92110,10 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 function buildKiroCapabilityRules({ config, logger }) {
 	const buckets = /* @__PURE__ */ new Map();
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
-		const capability = CANONICAL_TO_KIRO_CAPABILITY[category];
+		const capability = lookupOwn({
+			record: CANONICAL_TO_KIRO_CAPABILITY,
+			key: category
+		});
 		if (capability === void 0) {
 			logger?.warn(`Kiro permissions.yaml has no capability for category: ${category}. Skipping.`);
 			continue;
@@ -92040,7 +92273,10 @@ function toLettacodeBashPayload({ pattern, action, logger }) {
 	return prefix === "" ? "" : `${prefix}${PREFIX_SUFFIX}`;
 }
 function toLettacodeRule({ category, pattern, action, logger }) {
-	const tool = CATEGORY_TO_LETTACODE_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_LETTACODE_TOOL,
+		key: category
+	});
 	if (tool === void 0) return null;
 	const payload = category === "bash" ? toLettacodeBashPayload({
 		pattern,
@@ -92195,11 +92431,17 @@ var LettacodePermissions = class LettacodePermissions extends ToolPermissions {
 		for (const [key, action] of Object.entries(LIST_TO_ACTION)) for (const rule of toStringArray$1(permissions[key])) {
 			const parsed = fromLettacodeRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.pattern)) continue;
-			const rules = permission[parsed.category] ??= {};
-			const existing = rules[parsed.pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: parsed.category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: parsed.pattern
+				})
 			})) rules[parsed.pattern] = action;
 		}
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
@@ -92386,7 +92628,13 @@ function getOpencodeMcpServerNames(mcp) {
 	return isRecord(lowered) ? Object.keys(lowered) : [];
 }
 function toOpencodePermissionKey(canonical) {
-	return CANONICAL_TO_OPENCODE_PERMISSION_KEYS[canonical] ?? CANONICAL_TO_OPENCODE_FOLDED_PERMISSION_KEYS[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_OPENCODE_PERMISSION_KEYS,
+		key: canonical
+	}) ?? lookupOwn({
+		record: CANONICAL_TO_OPENCODE_FOLDED_PERMISSION_KEYS,
+		key: canonical
+	}) ?? canonical;
 }
 /**
 * Merge two canonical pattern maps that land on the same OpenCode key.
@@ -92410,7 +92658,10 @@ function mergePatternRules(base, incoming) {
 	return Object.fromEntries(Object.entries(merged).toSorted(([, a], [, b]) => PERMISSION_ACTION_PRIORITY[a] - PERMISSION_ACTION_PRIORITY[b]));
 }
 function toCanonicalPermissionKey(opencodeKey) {
-	return OPENCODE_TO_CANONICAL_PERMISSION_KEYS[opencodeKey] ?? opencodeKey;
+	return lookupOwn({
+		record: OPENCODE_TO_CANONICAL_PERMISSION_KEYS,
+		key: opencodeKey
+	}) ?? opencodeKey;
 }
 function isSharedPermissionCategory(category) {
 	return category === "*" || CANONICAL_PERMISSION_CATEGORIES$1.has(category) || category.startsWith("mcp__");
@@ -93692,7 +93943,14 @@ function importPoolTool({ toolConfig, bucket }) {
 	const denied = isStringArray(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
 	const allowed = isStringArray(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
 	for (const pattern of denied.filter(isUsablePattern)) bucket[pattern] = "deny";
-	for (const pattern of allowed.filter(isUsablePattern)) bucket[pattern] ??= "allow";
+	for (const pattern of allowed.filter(isUsablePattern)) if (!Object.hasOwn(bucket, pattern)) bucket[pattern] = "allow";
+}
+/**
+* Record `allow` for a path no deny has claimed. The check is on own
+* properties, so a path such as `toString` is not mistaken for a stored rule.
+*/
+function allowUnlessSet(bucket, path) {
+	if (!Object.hasOwn(bucket, path)) bucket[path] = "allow";
 }
 /**
 * Convert Pool's `tools` and `paths` blocks back into a rulesync config.
@@ -93727,8 +93985,8 @@ function convertPoolToRulesync({ tools, paths }) {
 	for (const entry of allowEntries) {
 		const path = pathOfEntry(entry);
 		if (path === void 0) continue;
-		bucketFor(READ_CATEGORY)[path] ??= "allow";
-		if (isRecord(entry) && entry[POOL_WRITE_KEY] === true) for (const category of WRITE_CATEGORIES) bucketFor(category)[path] ??= "allow";
+		allowUnlessSet(bucketFor(READ_CATEGORY), path);
+		if (isRecord(entry) && entry[POOL_WRITE_KEY] === true) for (const category of WRITE_CATEGORIES) allowUnlessSet(bucketFor(category), path);
 	}
 	return { permission };
 }
@@ -93857,7 +94115,10 @@ function toQoderRule({ category, pattern, logger }) {
 		logger?.warn(`Qoder permissions: skipping the '${category}' rule '${pattern}' — Qoder matches MCP tools by name only.`);
 		return null;
 	}
-	const tool = CATEGORY_TO_QODER_TOOL[category];
+	const tool = lookupOwn({
+		record: CATEGORY_TO_QODER_TOOL,
+		key: category
+	});
 	if (tool === void 0) return null;
 	if (pattern === "*") return tool;
 	return `${QODER_PATH_RULE_ALIASES[tool] ?? tool}(${pattern})`;
@@ -94143,11 +94404,17 @@ var QoderPermissions = class QoderPermissions extends ToolPermissions {
 		for (const action of ACTIONS) for (const rule of toStringArray$1(permissions[action])) {
 			const parsed = fromQoderRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.category) || isPrototypePollutionKey(parsed.pattern)) continue;
-			const rules = permission[parsed.category] ??= {};
-			const existing = rules[parsed.pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: parsed.category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: parsed.pattern
+				})
 			})) rules[parsed.pattern] = action;
 		}
 		const outputStyle = settings[QODER_OUTPUT_STYLE_KEY];
@@ -94211,10 +94478,16 @@ const CANONICAL_TO_QWEN_TOOL_NAMES = {
 };
 const QWEN_TO_CANONICAL_TOOL_NAMES = invertRecord(CANONICAL_TO_QWEN_TOOL_NAMES);
 function toQwenToolName(canonical) {
-	return CANONICAL_TO_QWEN_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_QWEN_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$3(qwenName) {
-	return QWEN_TO_CANONICAL_TOOL_NAMES[qwenName] ?? qwenName;
+	return lookupOwn({
+		record: QWEN_TO_CANONICAL_TOOL_NAMES,
+		key: qwenName
+	}) ?? qwenName;
 }
 function parseQwenPermissionEntry(entry, options = {}) {
 	const parenIndex = entry.indexOf("(");
@@ -94830,15 +95103,23 @@ function convertQwenToRulesyncPermissions(params) {
 			if (!parsed.ok) {
 				if (action === "deny") {
 					const canonical = toCanonicalToolName$3(parsed.toolName);
-					if (!permission[canonical]) permission[canonical] = {};
-					permission[canonical]["*"] = action;
+					if (isPrototypePollutionKey(canonical)) continue;
+					getOrCreateOwn({
+						record: permission,
+						key: canonical,
+						create: () => ({})
+					})["*"] = action;
 				}
 				continue;
 			}
 			const { toolName, pattern } = parsed;
 			const canonical = toCanonicalToolName$3(toolName);
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -94902,15 +95183,24 @@ const REASONIX_TO_CANONICAL_TOOL_NAMES = {
 };
 /** Every Reasonix tool name a canonical category owns on generate. */
 function reasonixToolNamesOf(canonical) {
-	const legacy = CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES[canonical];
+	const legacy = lookupOwn({
+		record: CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES,
+		key: canonical
+	});
 	const current = toReasonixToolName(canonical);
 	return legacy === void 0 ? [current] : [current, legacy];
 }
 function toReasonixToolName(canonical) {
-	return CANONICAL_TO_REASONIX_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_REASONIX_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName$2(reasonixName) {
-	return REASONIX_TO_CANONICAL_TOOL_NAMES[reasonixName] ?? reasonixName;
+	return lookupOwn({
+		record: REASONIX_TO_CANONICAL_TOOL_NAMES,
+		key: reasonixName
+	}) ?? reasonixName;
 }
 /**
 * Whether an entry uses the first-class `Tool=<literal>` exact-command form
@@ -95533,8 +95823,12 @@ function convertReasonixToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalToolName$2(toolName);
-			if (!permission[canonical]) permission[canonical] = {};
-			permission[canonical][pattern] = action;
+			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+			getOrCreateOwn({
+				record: permission,
+				key: canonical,
+				create: () => ({})
+			})[pattern] = action;
 		}
 	};
 	processEntries(params.allow, "allow");
@@ -96086,7 +96380,10 @@ function convertRulesyncToRovodevToolPermissions({ config, logger }) {
 			if (bash) toolPermissions.bash = bash;
 			continue;
 		}
-		const toolKeys = CATEGORY_TO_TOOL_KEYS[category];
+		const toolKeys = lookupOwn({
+			record: CATEGORY_TO_TOOL_KEYS,
+			key: category
+		});
 		if (!toolKeys) {
 			logger?.warn(`Rovo Dev permissions have no target for the "${category}" category. Skipping it.`);
 			markSharedToolKeyRestriction({
@@ -96234,7 +96531,7 @@ function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 	}
 	if (isStringArray(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
 		permission.read ??= {};
-		permission.read[path] ??= "allow";
+		if (!Object.hasOwn(permission.read, path)) permission.read[path] = "allow";
 	}
 	return { permission };
 }
@@ -97971,11 +98268,17 @@ var TraePermissions = class TraePermissions extends ToolPermissions {
 		const permission = {};
 		const put = (category, pattern, action) => {
 			if (isPrototypePollutionKey(category) || isPrototypePollutionKey(pattern)) return;
-			const rules = permission[category] ??= {};
-			const existing = rules[pattern];
+			const rules = getOrCreateOwn({
+				record: permission,
+				key: category,
+				create: () => ({})
+			});
 			if (isStricterAction({
 				action,
-				existing
+				existing: lookupOwn({
+					record: rules,
+					key: pattern
+				})
 			})) rules[pattern] = action;
 		};
 		for (const [key, value] of Object.entries(readRecord(customProfiles, COMMAND_RULES_PATH))) {
@@ -100318,7 +100621,10 @@ function toZedToolName(canonical) {
 		const address = toolParts.length > 0 ? `${server}:${toolParts.join("__")}` : server ?? "";
 		return `${MCP_ZED_PREFIX}${address}`;
 	}
-	return CANONICAL_TO_ZED_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_ZED_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
 function toCanonicalToolName(zedName) {
 	if (zedName.startsWith(MCP_ZED_PREFIX)) {
@@ -100326,7 +100632,10 @@ function toCanonicalToolName(zedName) {
 		const address = toolParts.length > 0 ? `${server}__${toolParts.join(":")}` : server ?? "";
 		return `${MCP_CATEGORY_PREFIX}${address}`;
 	}
-	return ZED_TO_CANONICAL_TOOL_NAMES[zedName] ?? zedName;
+	return lookupOwn({
+		record: ZED_TO_CANONICAL_TOOL_NAMES,
+		key: zedName
+	}) ?? zedName;
 }
 /**
 * Zed matches `always_allow`/`always_deny`/`always_confirm` regexes against the
@@ -100638,7 +100947,10 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		const globalDefault = parsed.success ? parsed.data.default : void 0;
 		const permission = {};
 		const ensure = (category) => {
-			const existing = permission[category];
+			const existing = lookupOwn({
+				record: permission,
+				key: category
+			});
 			if (existing) return existing;
 			const created = {};
 			permission[category] = created;
@@ -101265,7 +101577,7 @@ function resolveToolOutputRoot({ outputRoot, toolTarget, global }) {
 async function convertFromTool(params) {
 	resetRunWarningState();
 	const packagingTarget = [params.fromTool, ...params.toTools].find(isPackagingToolTarget);
-	if (packagingTarget) throw new Error(`Plugin packaging target '${packagingTarget}' is not supported by convert. Use import and generate with explicit plugin directories.`);
+	if (packagingTarget) throw new Error(`Plugin packaging target '${packagingTarget}' is not supported by convert. Use import with the plugin directory as outputRoot (--output-root) and generate with it in outputRoots (--output-roots).`);
 	const ctx = params;
 	const [rulesCount, ignoreCount, mcpCount, commandsCount, subagentsCount, skillsCount, hooksCount, permissionsCount, checksCount] = [
 		await runFeatureConvert(ctx, buildRulesStrategy(ctx)),
@@ -103745,6 +104057,6 @@ const CHECKS_IMPORT_STRATEGY = {
 	missingLabel: "check files",
 	createdLabel: "check files"
 };
-export { RulesyncPermissions as $, RULESYNC_USER_CONFIG_DIR_NAME as $n, isRootDirPath as $t, CODEBUDDY_DIR as A, CURATED_RULES_FEATURE_SUBDIR as An, withFallbackLoggerTarget as At, CLAUDECODE_LOCAL_RULE_FILE_NAME as B, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Bn, assertTreeContainsNoSymlinks as Bt, QWENCODE_LOCAL_RULE_FILE_NAME as C, ALL_TOOL_TARGETS as Cn, getSourceTransport as Ct, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as D, ALL_FEATURES as Dn, WarningCollectingLogger as Dt, FACTORYDROID_DIR as E, ToolTargetSchema as En, JsonLogger as Et, groupSpellingsByCaseFoldedIdentity as F, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Fn, PathOutsideRootError as Ft, toInstructionBudgetFile as G, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Gn, ensureDir as Gt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as H, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Hn, checkPathTraversal as Ht, CODEXCLI_BASH_RULES_FILE_NAME as I, RULESYNC_CONFIG_RELATIVE_FILE_PATH as In, applyFileMode as It, RulesyncSubagentFrontmatterSchema as J, RULESYNC_RELATIVE_DIR_PATH as Jn, findFilesByGlobs as Jt, getLocalSkillDirNames as K, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Kn, fileExists as Kt, CODEXCLI_DIR as L, RULESYNC_CONFIG_SCHEMA_URL as Ln, assertDirectoryIfExists as Lt, AUGMENTCODE_DIR as M, MAX_FILE_SIZE as Mn, withWarnOnceScope as Mt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as N, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Nn, CLIError as Nt, COMMANDCODE_DIR as O, ALL_FEATURES_WITH_WILDCARD as On, fallbackLogger as Ot, caseFoldIdentity as P, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Pn, ErrorCodes as Pt, RulesyncRuleFrontmatterSchema as Q, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Qn, isFileSystemError as Qt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as R, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Rn, assertNoSymlinkBelowRoot as Rt, QWENCODE_DIR as S, mapWithConcurrency as Sn, assertTargetsFeaturesExclusive as St, LETTACODE_SETTINGS_LOCAL_FILE_NAME as T, PACKAGING_TOOL_TARGETS as Tn, ConsoleLogger as Tt, CLAUDECODE_SKILLS_DIR_PATH as U, RULESYNC_MCP_RELATIVE_FILE_PATH as Un, createTempDirectory as Ut, CLAUDECODE_MEMORIES_DIR_NAME as V, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Vn, assertWritablePathInsideRoot as Vt, findProjectInstructionBudgetFindings as W, RULESYNC_MCP_SCHEMA_URL as Wn, directoryExists as Wt, RulesyncSkillFrontmatterSchema as X, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Xn, getHomeDirectory as Xt, RulesyncSkill as Y, RULESYNC_RULES_RELATIVE_DIR_PATH as Yn, getFileSizeAndExecutableBit as Yt, RulesyncRule as Z, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Zn, isFileNotFoundError as Zt, SubagentsProcessor as _, runWithDirectoryRollback as _n, resolveEffectiveInputRoots as _t, convertFromTool as a, pathEscapesRoot as an, hasEnclosingMarkOutsideKeycap as ar, parseJsonc as at, CommandsProcessor as b, writeFileBuffer as bn, GITIGNORE_DESTINATION_KEY as bt, parseCommaSeparatedList as c, readFileContentOrNull as cn, stripControlCharactersKeepingLineFeeds as cr, RulesyncCheck as ct, shortenToWidth as d, removeFile as dn, loadYaml as dt, isSymlink as en, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as er, RulesyncMcp as et, McpProcessor as f, removeFileStrict as fn, isRecord as ft, RulesProcessor as g, resolvedRelativePath as gn, mergeInputRootConfigs as gt, ChecksProcessor as h, resolvePath as hn, ConfigResolver as ht, inspectInputRoots as i, normalizePosixDirPath as in, hasDeceptiveHiddenCharacters as ir, resolveRulesyncSourceWritePath as it, CODEBUDDY_LOCAL_RULE_FILE_NAME as j, FEATURE_SOURCE_TREE_ENTRIES as jn, resetRunWarningState as jt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as k, DEPRECATED_FEATURE_REPLACEMENTS as kn, warnOnConflictingFlags as kt, ELLIPSIS_WIDTH as l, removeDirectory as ln, stripControlCharactersKeepingLineFeedsAndTabs as lr, RulesyncCheckFrontmatterSchema as lt, HooksProcessor as m, removeTempDirectory as mn, SKILL_FILE_NAME as mt, formatSourceLoadFailure as n, listFilePathsRecursively as nn, formatError as nr, RulesyncHooks as nt, isPackagingToolTarget as o, posixRelativePathEscapesRoot as on, quoteForLog as or, RulesyncCommand as ot, IgnoreProcessor as p, removeFileWithoutFollowingSymlinks as pn, SHARED_USER_MANAGED_CONFIG_PATHS as pt, RulesyncSubagent as q, RULESYNC_PERMISSIONS_SCHEMA_URL as qn, fileExistsStrict as qt, generate as r, listSubdirectoryNames as rn, truncateText as rr, getRulesyncSourceCandidates as rt, getProcessorRegistryEntry as s, readFileContent as sn, stripControlCharacters as sr, RulesyncCommandFrontmatterSchema as st, importFromTool as t, listDirectoryEntryNames as tn, formatMegabytes as tr, RulesyncIgnore as tt, displayWidthOf as u, removeDirectoryStrict as un, stripHiddenCharacters as ur, stringifyFrontmatter as ut, SkillsProcessor as v, splitPathSegments as vn, CONFLICTING_TARGET_PAIRS as vt, LETTACODE_DIR as w, ALL_TOOL_TARGETS_WITH_WILDCARD as wn, findControlCharacter as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, writeFileContent as xn, SourceEntrySchema as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, toPosixPath as yn, ConfigFileSchema as yt, CLAUDECODE_DIR as z, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as zn, assertPathResolvesInsideRoot as zt };
+export { RulesyncMcp as $, RULESYNC_USER_CONFIG_DIR_NAME as $n, isRootDirPath as $t, CODEBUDDY_LOCAL_RULE_FILE_NAME as A, CURATED_RULES_FEATURE_SUBDIR as An, resetRunWarningState as At, CLAUDECODE_MEMORIES_DIR_NAME as B, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Bn, assertTreeContainsNoSymlinks as Bt, LETTACODE_DIR as C, ALL_TOOL_TARGETS as Cn, findControlCharacter as Ct, COMMANDCODE_DIR as D, ALL_FEATURES as Dn, fallbackLogger as Dt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as E, ToolTargetSchema as En, WarningCollectingLogger as Et, CODEXCLI_BASH_RULES_FILE_NAME as F, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Fn, PathOutsideRootError as Ft, getLocalSkillDirNames as G, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Gn, ensureDir as Gt, CLAUDECODE_SKILLS_DIR_PATH as H, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Hn, checkPathTraversal as Ht, CODEXCLI_DIR as I, RULESYNC_CONFIG_RELATIVE_FILE_PATH as In, applyFileMode as It, RulesyncSkill as J, RULESYNC_RELATIVE_DIR_PATH as Jn, findFilesByGlobs as Jt, RulesyncSubagent as K, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Kn, fileExists as Kt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as L, RULESYNC_CONFIG_SCHEMA_URL as Ln, assertDirectoryIfExists as Lt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as M, MAX_FILE_SIZE as Mn, CLIError as Mt, caseFoldIdentity as N, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Nn, ErrorCodes as Nt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as O, ALL_FEATURES_WITH_WILDCARD as On, warnOnConflictingFlags as Ot, groupSpellingsByCaseFoldedIdentity as P, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Pn, parseJsonc as Pt, RulesyncPermissions as Q, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Qn, isFileSystemError as Qt, CLAUDECODE_DIR as R, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Rn, assertNoSymlinkBelowRoot as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, mapWithConcurrency as Sn, getSourceTransport as St, FACTORYDROID_DIR as T, PACKAGING_TOOL_TARGETS as Tn, JsonLogger as Tt, findProjectInstructionBudgetFindings as U, RULESYNC_MCP_RELATIVE_FILE_PATH as Un, createTempDirectory as Ut, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as V, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Vn, assertWritablePathInsideRoot as Vt, toInstructionBudgetFile as W, RULESYNC_MCP_SCHEMA_URL as Wn, directoryExists as Wt, RulesyncRule as X, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Xn, getHomeDirectory as Xt, RulesyncSkillFrontmatterSchema as Y, RULESYNC_RULES_RELATIVE_DIR_PATH as Yn, getFileSizeAndExecutableBit as Yt, RulesyncRuleFrontmatterSchema as Z, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Zn, isFileNotFoundError as Zt, SkillsProcessor as _, runWithDirectoryRollback as _n, CONFLICTING_TARGET_PAIRS as _t, convertFromTool as a, pathEscapesRoot as an, hasEnclosingMarkOutsideKeycap as ar, RulesyncCommandFrontmatterSchema as at, REASONIX_LOCAL_RULE_FILE_NAME as b, writeFileBuffer as bn, SourceEntrySchema as bt, ELLIPSIS_WIDTH as c, readFileContentOrNull as cn, stripControlCharactersKeepingLineFeeds as cr, stringifyFrontmatter as ct, McpProcessor as d, removeFile as dn, SHARED_USER_MANAGED_CONFIG_PATHS as dt, isSymlink as en, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as er, RulesyncIgnore as et, IgnoreProcessor as f, removeFileStrict as fn, SKILL_FILE_NAME as ft, SubagentsProcessor as g, resolvedRelativePath as gn, resolveEffectiveInputRoots as gt, RulesProcessor as h, resolvePath as hn, parseConfigFileContent as ht, inspectInputRoots as i, normalizePosixDirPath as in, hasDeceptiveHiddenCharacters as ir, RulesyncCommand as it, AUGMENTCODE_DIR as j, FEATURE_SOURCE_TREE_ENTRIES as jn, withWarnOnceScope as jt, CODEBUDDY_DIR as k, DEPRECATED_FEATURE_REPLACEMENTS as kn, withFallbackLoggerTarget as kt, displayWidthOf as l, removeDirectory as ln, stripControlCharactersKeepingLineFeedsAndTabs as lr, loadYaml as lt, ChecksProcessor as m, removeTempDirectory as mn, mergeInputRootConfigs as mt, formatSourceLoadFailure as n, listFilePathsRecursively as nn, formatError as nr, getRulesyncSourceCandidates as nt, getProcessorRegistryEntry as o, posixRelativePathEscapesRoot as on, quoteForLog as or, RulesyncCheck as ot, HooksProcessor as p, removeFileWithoutFollowingSymlinks as pn, ConfigResolver as pt, RulesyncSubagentFrontmatterSchema as q, RULESYNC_PERMISSIONS_SCHEMA_URL as qn, fileExistsStrict as qt, generate as r, listSubdirectoryNames as rn, truncateText as rr, resolveRulesyncSourceWritePath as rt, parseCommaSeparatedList as s, readFileContent as sn, stripControlCharacters as sr, RulesyncCheckFrontmatterSchema as st, importFromTool as t, listDirectoryEntryNames as tn, formatMegabytes as tr, RulesyncHooks as tt, shortenToWidth as u, removeDirectoryStrict as un, stripHiddenCharacters as ur, isRecord as ut, CRUSH_LOCAL_RULE_FILE_NAME as v, splitPathSegments as vn, ConfigFileSchema as vt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as w, ALL_TOOL_TARGETS_WITH_WILDCARD as wn, ConsoleLogger as wt, QWENCODE_DIR as x, writeFileContent as xn, assertTargetsFeaturesExclusive as xt, CommandsProcessor as y, toPosixPath as yn, GITIGNORE_DESTINATION_KEY as yt, CLAUDECODE_LOCAL_RULE_FILE_NAME as z, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as zn, assertPathResolvesInsideRoot as zt };
 
-//# sourceMappingURL=import-Safgeb1C.js.map
+//# sourceMappingURL=import-w0JlEoNl.js.map