rulesync 43.7.0 → 43.8.0

package/dist/{import-CfxyzbvB.cjs → import-C5ETusOs.cjs}

@@ -1815,28 +1815,6 @@ function splitAbsolutePath(absolutePath) {
 	};
 }
 /**
-* Whether writing `targetPath` would land outside `rootPath` once every link on
-* the way there is resolved. Both sides are taken to where a write to them
-* would land (see {@link writeLandingPath}), so a root that does not fully
-* exist yet is judged the same way as the target below it.
-*
-* A link that stays inside the root passes. That is what sets this apart from
-* the stricter {@link assertWritablePathInsideRoot} the sweep paths use: a
-* dotfiles checkout linked from inside the home directory is a common shape for
-* a global write target, and refusing it would refuse `--global` outright.
-*
-* A link chain that cycles is reported as an escape: the write could not get
-* through it, and refusing it is the answer that never writes somewhere
-* unexpected.
-*/
-async function writablePathEscapesRoot({ rootPath, targetPath }) {
-	const relativeLanding = await relativeWriteLanding({
-		rootPath,
-		targetPath
-	});
-	return relativeLanding === null || pathEscapesRoot(relativeLanding);
-}
-/**
 * Where a write to `targetPath` lands relative to where a write to `rootPath`
 * lands, both taken through {@link writeLandingPath}: `""` when the two land on
 * the same directory, and `null` when either side's links form a cycle. Errors
@@ -1849,6 +1827,59 @@ async function relativeWriteLanding({ rootPath, targetPath }) {
 	return (0, node_path.relative)(rootLanding, targetLanding);
 }
 /**
+* Directory names that hold version-control metadata. Bytes landing in one of
+* them change how the VCS behaves rather than what it tracks: `.git/config`
+* can set `core.fsmonitor`, `.git/hooks/*` run on the next commit.
+*/
+const VCS_METADATA_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".jj"
+]);
+function hasVcsMetadataSegment(path) {
+	return splitPathSegments(path).some((segment) => {
+		const folded = segment.replace(/:.*$/, "").replace(/[. ]+$/, "").toLowerCase();
+		return VCS_METADATA_DIR_NAMES.has(folded) || /^(git|hg|svn|jj)~\d+$/.test(folded);
+	});
+}
+/**
+* Whether a link on the way to `targetPath` carries it into version-control
+* metadata (`.git/` and its siblings) that its spelling does not name.
+*
+* {@link writablePathEscapesRoot} lets a link that stays inside the root
+* through, but a checked-out repository can commit `CLAUDE.md -> .git/config`:
+* the landing is inside the root, yet a write there hands the repository author
+* the operator's next `git` command. `git clone` never transfers `.git/`, so a
+* path spelled into it is never something the repository chose; only a write
+* that lands exactly where it is spelled may touch it.
+*
+* `relativeLanding` is {@link relativeWriteLanding}'s answer for the same pair,
+* passed in so a caller that already has it does not resolve the links twice.
+*/
+function landingEntersVcsMetadata({ rootPath, targetPath, relativeLanding }) {
+	return hasVcsMetadataSegment(relativeLanding) && relativeLanding !== (0, node_path.relative)((0, node_path.resolve)(rootPath), (0, node_path.resolve)(targetPath));
+}
+/**
+* Refuse a write target that a symbolic link carries into version-control
+* metadata (see {@link landingEntersVcsMetadata}). Meant for writes of remote
+* bytes, next to {@link assertPathResolvesInsideRoot}: an in-root link (a
+* skill directory linked to a shared one) stays allowed, but not one that
+* hands the bytes to `.git/config` or `.git/hooks/`.
+*/
+async function assertLandingOutsideVcsMetadata({ rootPath, targetPath }) {
+	const relativeLanding = await relativeWriteLanding({
+		rootPath,
+		targetPath
+	});
+	if (relativeLanding === null) throw new PathOutsideRootError(`Refusing to write through a link cycle: ${targetPath}.`);
+	if (landingEntersVcsMetadata({
+		rootPath,
+		targetPath,
+		relativeLanding
+	})) throw new PathOutsideRootError(`Refusing to write ${targetPath}: a symbolic link leads it into version-control metadata.`);
+}
+/**
 * How many trailing segments `filePath` and `identity` have in common.
 *
 * A path that walked through no link at all shares all of its own segments with
@@ -5452,7 +5483,8 @@ const QWENCODE_HOOK_EVENTS = [
 	"todoCreated",
 	"todoCompleted",
 	"messageDisplay",
-	"sessionDelete"
+	"sessionDelete",
+	"fileChanged"
 ];
 const CANONICAL_TO_KIMI_CODE_EVENT_NAMES = {
 	sessionStart: "SessionStart",
@@ -6786,6 +6818,7 @@ const CANONICAL_TO_JUNIE_EVENT_NAMES = {
 	sessionStart: "SessionStart",
 	beforeSubmitPrompt: "UserPromptSubmit",
 	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
 	stop: "Stop",
 	stopFailure: "StopFailure",
 	permissionRequest: "PermissionRequest",
@@ -6794,11 +6827,12 @@ const CANONICAL_TO_JUNIE_EVENT_NAMES = {
 /**
 * Hook events supported by JetBrains Junie CLI.
 *
-* Junie CLI exposes seven lifecycle events under the `"hooks"` key of
+* Junie CLI exposes eight lifecycle events under the `"hooks"` key of
 * `~/.junie/config.json`: `SessionStart`, `UserPromptSubmit`, `PreToolUse`,
-* `Stop`, `StopFailure`, `PermissionRequest`, and `SessionEnd`. Matchers apply
-* to `SessionStart` (source), `PreToolUse` (tool name), `StopFailure` (error
-* type), `PermissionRequest` (tool name), and `SessionEnd` (reason);
+* `PostToolUse`, `Stop`, `StopFailure`, `PermissionRequest`, and `SessionEnd`.
+* Matchers apply to `SessionStart` (source), `PreToolUse` and `PostToolUse`
+* (tool name), `StopFailure` (error type), `PermissionRequest` (tool name), and
+* `SessionEnd` (reason);
 * `UserPromptSubmit` and `Stop` are matcher-less and always run. Only
 * `type: "command"` hooks are supported. Project-local hooks are ignored for
 * safety.
@@ -6977,7 +7011,8 @@ const CANONICAL_TO_QWENCODE_EVENT_NAMES = {
 	todoCreated: "TodoCreated",
 	todoCompleted: "TodoCompleted",
 	messageDisplay: "MessageDisplay",
-	sessionDelete: "SessionDelete"
+	sessionDelete: "SessionDelete",
+	fileChanged: "FileChanged"
 };
 /**
 * Map Qwen Code PascalCase event names to canonical camelCase.
@@ -9232,7 +9267,8 @@ const AntigravityCliPermissionsOverrideSchema = zod_mini.z.looseObject({
 * The same override also carries the two plugin-consumption keys Auggie reads
 * from `settings.json`: `recommendedMarketplaces` (`"owner/repo"` marketplaces
 * a workspace prompts its contributors to install; honored only in the
-* project's `.augment/settings.json`) and `enabledPlugins` (plugin ids of the
+* project's `.augment/settings.json`, and only by Auggie 0.x — 1.x no longer
+* reads it) and `enabledPlugins` (plugin ids of the
 * form `"plugin@marketplace"` mapped to on/off, deep-merged across the user,
 * project and local tiers).
 *
@@ -9416,6 +9452,14 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 *   `true`; only an explicit `false` suppresses it. Like
 *   `base_permission_profile` it is consumed by the profile builder, not
 *   written as a top-level config key.
+* - `bash_canonical_matching` — when `true`, the `forbidden` (deny) and
+*   `prompt` (ask) rules generated from `permission.bash` into
+*   `.codex/rules/rulesync.rules` carry `canonical_matching = True`, so Codex
+*   compares their tokens after Unicode canonical case-insensitive folding (`rm` also
+*   matches `RM`). `allow` rules stay exact so the opt-in never widens what is
+*   auto-approved. Requires Codex 0.167.0 or later — an older Codex rejects the
+*   keyword and fails to load the rules file — so it defaults to `false`. Not
+*   written as a config key.
 *
 * The keys written to `config.toml` are an **allowlist**, not verbatim
 * passthrough: only `CODEXCLI_OVERRIDE_KEYS`
@@ -9423,8 +9467,8 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 * `sandbox_workspace_write`, `apps`, `approvals_reviewer`, `auto_review`,
 * `tui`) are emitted, and
 * `computeCodexcliOverridePatch` skips anything else with a warning.
-* `base_permission_profile` and `git_write_rules` are consumed by the profile
-* builder rather than written, as described above, and `permission` is the
+* `base_permission_profile`, `git_write_rules` and `bash_canonical_matching`
+* are consumed by the generators rather than written, as described above, and `permission` is the
 * tool-scoped canonical block, which `RulesyncPermissions.forTarget` strips out
 * of the override before it ever reaches the patch. The allowlist is what keeps
 * the override from clobbering a feature-owned key: `mcp_servers.*` per-MCP
@@ -9481,7 +9525,8 @@ const CodexcliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	* @see https://developers.openai.com/codex/config-reference
 	*/
 	tui: zod_mini.z.optional(zod_mini.z.looseObject({})),
-	git_write_rules: zod_mini.z.optional(zod_mini.z.boolean())
+	git_write_rules: zod_mini.z.optional(zod_mini.z.boolean()),
+	bash_canonical_matching: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
 * Tool-scoped override block for Zed. These Zed `agent` keys sit outside the
@@ -9565,6 +9610,14 @@ const ZedPermissionsOverrideSchema = zod_mini.z.looseObject({
 * { "sandbox": { "excluded": { "allow": ["Exec(git status *)"], "deny": ["Exec(git tag *)"] } } }
 * @example
 * { "forbiddenPlugins": ["*"], "optionalPlugins": ["acme/approved"] }
+*
+* `permission_mode` (CLI v3000.12.17+) is the mode new local sessions start in
+* (`normal`, the upstream default, `accept-edits`, `smart` or `dangerous`).
+* Like `sandbox` it is a **User Config Only** key, so it is emitted at global
+* scope only. It is never derived from the canonical rules.
+*
+* @example
+* { "permission_mode": "accept-edits" }
 * @see https://docs.devin.ai/cli/sandbox
 * @see https://docs.devin.ai/cli/reference/configuration/config-file
 * @see https://docs.devin.ai/cli/extensibility/plugins/overview
@@ -9580,12 +9633,25 @@ const DEVIN_PLUGIN_GOVERNANCE_SCHEMAS = {
 	optionalPlugins: DevinPluginSourceListSchema,
 	forbiddenPlugins: zod_mini.z.array(zod_mini.z.string())
 };
+/**
+* Values Devin accepts for the user-config `permission_mode` key. Shared by the
+* override schema and the import, which drops a value that would not pass it.
+*
+* @see https://docs.devin.ai/cli/reference/configuration/config-file
+*/
+const DevinPermissionModeSchema = zod_mini.z.enum([
+	"normal",
+	"accept-edits",
+	"smart",
+	"dangerous"
+]);
 const DevinPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
 	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	requiredPlugins: zod_mini.z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.requiredPlugins),
 	optionalPlugins: zod_mini.z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.optionalPlugins),
-	forbiddenPlugins: zod_mini.z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.forbiddenPlugins)
+	forbiddenPlugins: zod_mini.z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.forbiddenPlugins),
+	permission_mode: zod_mini.z.optional(DevinPermissionModeSchema)
 });
 /**
 * Permissions configuration.
@@ -11997,6 +12063,98 @@ function resolveStandardSkillFields({ rootFrontmatter, section }) {
 		})
 	});
 }
+// src/utils/remote-name.ts
+/**
+* Name checks for a directory or file name chosen by a remote source (a
+* fetched repository, an installed git, GitHub or npm source). Shared by
+* `rulesync fetch` and `rulesync install`, so a name one of them turns away is
+* not written, or printed raw, by the other.
+*/
+/** A name with no character in it that draws anything of its own. */
+const NOTHING_DRAWN_PATTERN = /^[\s\p{M}]*$/u;
+/**
+* The marks a name begins with. A mark is drawn over the character before it,
+* and a name has nothing before it of its own: a leading one is drawn over
+* whatever the terminal printed last — the checkbox, the quote around a name
+* in a warning — while the name reads as if it began with its first letter.
+*/
+const LEADING_MARKS_PATTERN = /^\p{M}+/u;
+/**
+* A name ending in a dot or an ASCII space, which Win32 strips before it opens
+* the path. Only the plain space (U+0020): Win32 keeps every other trailing
+* blank, so a name ending in a no-break or an ideographic space is written
+* where it says, and is left to the whitespace note of the confusable-name
+* check rather than dropped here with Windows named as the reason.
+*/
+const TRAILING_DOT_OR_SPACE_PATTERN = /[. ]$/;
+/** A name ending in the `NAME~1` shape of a Windows 8.3 short name, extension included. */
+const SHORT_NAME_ALIAS_PATTERN = /~\d+(?:\.[^.]*)?$/;
+/**
+* A name Win32 reserves for a device — `CON`, `PRN`, `AUX`, `NUL`, `CONIN$`,
+* `CONOUT$`, `COM1`–`COM9`, `LPT1`–`LPT9` — in any case and with any
+* extension: `nul.md` is the null device too, since the reservation is decided
+* on the part before the first dot, with any spaces before that dot dropped
+* first, so `nul .md` is the null device as well. The port digit may also be
+* one of the superscript digits ¹ ² ³, which Win32 reads as 1, 2 and 3
+* (`RtlIsDosDeviceName_U`; CPython's `ntpath.isreserved` follows the same
+* rules).
+*/
+const RESERVED_DEVICE_NAME_PATTERN = /^(?:CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|COM[1-9\u00B9\u00B2\u00B3]|LPT[1-9\u00B9\u00B2\u00B3]) *(?:\..*)?$/i;
+/**
+* Whether Windows resolves a path segment to something other than the entry it
+* reads as.
+*
+* Win32 drops a trailing dot or ASCII space when it resolves a path, so a remote
+* `skills/deploy.` is the existing `skills/deploy` there. A name ending in the
+* `NAME~1` shape is the same class of problem: on a volume that generates
+* short names, it opens whatever long name it stands for. The shape only
+* means that at the end of a name, so `data~2parser` and `v1.0` are ordinary
+* names. A reserved device name is the extreme case: `nul` and `nul.md` are
+* not entries in any directory but the null device itself, so a write to one
+* lands nowhere, and a directory of that name cannot be created at all.
+*
+* The predicate is asked of every segment of a written path — the skill
+* directory, but equally a nested `references/notes. ` or a `scripts/con.sh`
+* — since a folded segment anywhere in a path lands the file beside, or on top
+* of, a sibling the repository never published. The check is not gated on the
+* platform: the same repository is checked out on several of them, and a name
+* that lands somewhere else on any one of them is one this tool would rather
+* turn away everywhere than write differently depending on where it runs.
+*/
+function hasWindowsFoldableName(name) {
+	return TRAILING_DOT_OR_SPACE_PATTERN.test(name) || SHORT_NAME_ALIAS_PATTERN.test(name) || RESERVED_DEVICE_NAME_PATTERN.test(name);
+}
+/**
+* Whether a remote name is safe to write and to print as it is.
+*
+* A name of nothing but blank space is shown as the empty string, the same as
+* one that strips down to nothing: both draw as a row with no name on it. So
+* is a name of nothing but combining marks, which have no character of their
+* own to sit on and draw as a smear over whatever the terminal puts beside
+* them. A name that merely begins with a mark is turned away for the same
+* reason, and shown without it: the mark sits on nothing the name owns. A name
+* carrying control characters (an ANSI, C1 or OSC sequence) or deceptive
+* zero-width characters is turned away too, so it can neither rewrite the
+* terminal nor pass for another name. The Windows-folding check comes after
+* the hidden characters, so a name that is both is reported by the reason that
+* keeps its raw form off the terminal.
+*/
+function classifyRemoteName(name) {
+	const stripped = stripHiddenCharacters(name);
+	const beginsWithMark = LEADING_MARKS_PATTERN.test(stripped);
+	const display = NOTHING_DRAWN_PATTERN.test(stripped) ? "" : stripped.replace(LEADING_MARKS_PATTERN, "");
+	if (display === "" || beginsWithMark || hasDeceptiveHiddenCharacters(name)) return {
+		kind: "unsafe",
+		display,
+		reason: "hidden"
+	};
+	if (hasWindowsFoldableName(name)) return {
+		kind: "unsafe",
+		display,
+		reason: "foldable"
+	};
+	return { kind: "safe" };
+}
 // src/features/rules/instruction-budget.ts
 /**
 * Normalizes a relative directory path for comparison: POSIX separators, no
@@ -13884,7 +14042,11 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions", "sandbox"]
+				ownedKeys: [
+					"permissions",
+					"sandbox",
+					"permission_mode"
+				]
 			}
 		}
 	},
@@ -14658,6 +14820,16 @@ var RulesyncSourceConsumer = class {
 		this.dryRun = dryRun;
 		this.logger = logger;
 	}
+	/**
+	* Whether the orphan sweep may follow a symbolic link that stays inside the
+	* output root. Only global scope answers true: its root is the operator's
+	* own home directory, where a dotfiles checkout linked in (`~/.claude ->
+	* ~/dotfiles/claude`) is a common shape. A project checkout may carry links
+	* its author committed, so the default refuses them.
+	*/
+	sweepsThroughInRootLinks() {
+		return false;
+	}
 	recordRulesyncSourceLoadFailure() {
 		this.rulesyncSourceLoadFailed = true;
 	}
@@ -14790,7 +14962,8 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 				refused = await refusesDeleteOutsideRoot({
 					logger: this.logger,
 					rootPath,
-					dirPath
+					dirPath,
+					allowInRootLinks: this.sweepsThroughInRootLinks()
 				});
 				refusedDirs.set(cacheKey, refused);
 			}
@@ -14890,27 +15063,45 @@ function mergeByIdentity({ perRoot, identity }) {
 	return order.map((key) => winnerByKey.get(key));
 }
 /**
-* Whether a write to `targetPath` has to be refused because a link on the way
-* there leads out of `rootPath`, warning about the refusal.
+* Why a write to `targetPath` has to be refused, or `null` when it may go
+* ahead: a link on the way there leads out of `rootPath`, or into
+* version-control metadata that the path as spelled does not name.
 *
 * A checked-out repository can carry a symbolic link at an output path
-* (`AGENTS.md -> ~/.bashrc`, a tool directory linked to `/etc`), and a write
-* through it would land wherever the link points. Every writer that lets the
-* OS follow links — file, directory, and config-rewrite alike — asks this first
-* so that one warning describes the one behavior.
+* (`AGENTS.md -> ~/.bashrc`, a tool directory linked to `/etc`, `CLAUDE.md ->
+* .git/config`), and a write through it would land wherever the link points.
+*/
+async function writeRefusalReason({ rootPath, targetPath }) {
+	const relativeLanding = await relativeWriteLanding({
+		rootPath,
+		targetPath
+	});
+	if (relativeLanding === null || pathEscapesRoot(relativeLanding)) return `it resolves outside ${quoteForLog(rootPath)} through a symbolic link`;
+	if (landingEntersVcsMetadata({
+		rootPath,
+		targetPath,
+		relativeLanding
+	})) return "it resolves into version-control metadata through a symbolic link";
+	return null;
+}
+/**
+* Whether a write to `targetPath` has to be refused (see
+* {@link writeRefusalReason}), warning about the refusal. Every writer that
+* lets the OS follow links — file, directory, and config-rewrite alike — asks
+* this first so that one warning describes the one behavior.
 */
 async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
-	if (!await writablePathEscapesRoot({
+	const reason = await writeRefusalReason({
 		rootPath,
 		targetPath
-	})) return false;
-	logger.warn(`Refusing to write ${quoteForLog(targetPath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	});
+	if (reason === null) return false;
+	logger.warn(`Refusing to write ${quoteForLog(targetPath)}: ${reason}`);
 	return true;
 }
 /**
-* Whether deleting the files in `dirPath` has to be refused because a link on
-* the way to that directory leads out of `rootPath`, warning about the refusal
-* once for the whole directory.
+* Why the orphan sweep has to leave the files in `dirPath` alone, or `null`
+* when it may delete them.
 *
 * Deletion candidates are enumerated without following links *inside* the
 * scanned directory, but the scanned directory itself is reached through
@@ -14919,13 +15110,40 @@ async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
 * an orphan. Only the directory is judged, never the file in it, because
 * removing a file that is itself a link unlinks the link where it is spelled
 * and never touches its target.
+*
+* Beyond the write rules, a project checkout is content another party may
+* control: a committed `.claude/rules -> ..` would make every untracked `*.md`
+* in the project read as an orphan. Unless `allowInRootLinks` (global scope,
+* where the root is the operator's own home directory) the swept directory
+* must therefore be the one its path spells, with no link on the way.
 */
-async function refusesDeleteOutsideRoot({ logger, rootPath, dirPath }) {
-	if (!await writablePathEscapesRoot({
+async function sweepRefusalReason({ rootPath, dirPath, allowInRootLinks }) {
+	const relativeLanding = await relativeWriteLanding({
 		rootPath,
 		targetPath: dirPath
-	})) return false;
-	logger.warn(`Refusing to delete files in ${quoteForLog(dirPath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	});
+	if (relativeLanding === null || pathEscapesRoot(relativeLanding)) return `it resolves outside ${quoteForLog(rootPath)} through a symbolic link`;
+	if (landingEntersVcsMetadata({
+		rootPath,
+		targetPath: dirPath,
+		relativeLanding
+	})) return "it resolves into version-control metadata through a symbolic link";
+	if (!allowInRootLinks && relativeLanding !== (0, node_path.relative)((0, node_path.resolve)(rootPath), (0, node_path.resolve)(dirPath))) return "it is reached through a symbolic link";
+	return null;
+}
+/**
+* Whether deleting the files in `dirPath` has to be refused (see
+* {@link sweepRefusalReason}), warning about the refusal once for the whole
+* directory.
+*/
+async function refusesDeleteOutsideRoot({ logger, rootPath, dirPath, allowInRootLinks }) {
+	const reason = await sweepRefusalReason({
+		rootPath,
+		dirPath,
+		allowInRootLinks
+	});
+	if (reason === null) return false;
+	logger.warn(`Refusing to delete files in ${quoteForLog(dirPath)}: ${reason}`);
 	return true;
 }
 /**
@@ -22636,6 +22854,9 @@ const commandsProcessorToolTargetsGlobal = allToolTargetKeys$3.filter((target) =
 var CommandsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	flattenedCommandNaming;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$6, dryRun = false, flattenedCommandNaming = "basename", logger }) {
@@ -23207,6 +23428,15 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				this.logger.warn(`Refusing to sweep ${quotedDirPath}: ${stripControlCharacters(formatError(error))}`);
 				continue;
 			}
+			const sweepRefusal = await sweepRefusalReason({
+				rootPath: this.outputRoot,
+				dirPath,
+				allowInRootLinks: this.sweepsThroughInRootLinks()
+			});
+			if (sweepRefusal !== null) {
+				this.logger.warn(`Refusing to sweep ${quotedDirPath}: ${sweepRefusal}`);
+				continue;
+			}
 			const generatedNames = /* @__PURE__ */ new Set();
 			const mainFile = aiDir.getMainFile();
 			if (mainFile) generatedNames.add(toPosixPath(mainFile.name));
@@ -25290,6 +25520,8 @@ const CRUSH_CONFIG_FILE_NAME = "crush.json";
 const CRUSH_HIDDEN_CONFIG_FILE_NAME = ".crush.json";
 const CRUSH_PERMISSIONS_KEY = "permissions";
 const CRUSH_ALLOWED_TOOLS_KEY = "allowed_tools";
+const CRUSH_SAFE_COMMANDS_KEY = "safe_commands";
+const CRUSH_BLOCKED_COMMANDS_KEY = "blocked_commands";
 const CRUSH_OPTIONS_KEY = "options";
 const CRUSH_DISABLED_TOOLS_KEY = "disabled_tools";
 const CRUSH_HOOKS_KEY = "hooks";
@@ -29970,6 +30202,9 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 			global: this.global
 		});
 	}
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	/**
 	* The tool's skills roots that exist on disk, each paired with its absolute
 	* path and vetted as writable inside this run's output root. Shared by the
@@ -29999,6 +30234,15 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 				this.logger.warn(`Skipping the orphan sweep for ${quoteForLog(skillsDirPath)}; nothing under it is deleted: ${stripControlCharacters(formatError(error))}`);
 				continue;
 			}
+			const sweepRefusal = await sweepRefusalReason({
+				rootPath: this.outputRoot,
+				dirPath: skillsDirPath,
+				allowInRootLinks: this.sweepsThroughInRootLinks()
+			});
+			if (sweepRefusal !== null) {
+				this.logger.warn(`Skipping the orphan sweep for ${quoteForLog(skillsDirPath)}; nothing under it is deleted: ${sweepRefusal}`);
+				continue;
+			}
 			existingRoots.push({
 				root,
 				skillsDirPath
@@ -33225,11 +33469,17 @@ var FirebenderSubagent = class FirebenderSubagent extends ToolSubagent {
 	*/
 	static async fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, global = false, logger, deleteOrphans = false }) {
 		const agentsDirPath = this.getSettablePaths({ global }).relativeDirPath;
-		const agentsDirEscapesRoot = await writablePathEscapesRoot({
+		const agentsDirFullPath = (0, node_path.join)(outputRoot, agentsDirPath);
+		const writeRefused = await writeRefusalReason({
 			rootPath: outputRoot,
-			targetPath: (0, node_path.join)(outputRoot, agentsDirPath, "agent.md")
-		});
-		const existingAgentFileNames = new Set(agentsDirEscapesRoot ? [] : await listDirectoryEntryNames((0, node_path.join)(outputRoot, agentsDirPath)));
+			targetPath: (0, node_path.join)(agentsDirFullPath, "agent.md")
+		}) !== null;
+		const sweepRefused = deleteOrphans && await sweepRefusalReason({
+			rootPath: outputRoot,
+			dirPath: agentsDirFullPath,
+			allowInRootLinks: global
+		}) !== null;
+		const existingAgentFileNames = new Set(writeRefused ? [] : await listDirectoryEntryNames(agentsDirFullPath));
 		const subagents = rulesyncSubagents.map((rulesyncSubagent) => this.fromRulesyncSubagent({
 			outputRoot,
 			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
@@ -33245,8 +33495,8 @@ var FirebenderSubagent = class FirebenderSubagent extends ToolSubagent {
 				global
 			})),
 			existingAgentFileNames,
-			deleteOrphans,
-			frozen: agentsDirEscapesRoot,
+			deleteOrphans: deleteOrphans && !sweepRefused,
+			frozen: writeRefused,
 			global,
 			logger
 		});
@@ -37364,6 +37614,9 @@ function compareRelativePathsShallowestFirst(left, right) {
 var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	deleteOrphans;
 	getFactory;
 	/**
@@ -38085,6 +38338,39 @@ function warnAndSkipMcpServer({ toolName, serverName, reason, logger }) {
 	return null;
 }
 /**
+* Drops every server whose `enabledTools` allowlist is empty, warning about
+* each one, for a tool that reads an empty (or missing) allowlist as "no
+* filter". Canonically an empty allowlist allows no tools at all, so emitting
+* the server unfiltered would expose every tool it reports. With
+* `ignoreBlankNames`, blank entries count as absent, for a tool that drops
+* them before applying the list. `productName` names the tool in the reason
+* when it differs from the `toolName` the warning starts with.
+*/
+function skipServersWithEmptyEnabledTools({ mcpServers, toolName, logger, ignoreBlankNames = false, productName = toolName }) {
+	const kept = {};
+	for (const [name, server] of Object.entries(mcpServers)) {
+		const { enabledTools } = server;
+		if (Array.isArray(enabledTools)) {
+			if ((ignoreBlankNames ? enabledTools.filter((tool) => typeof tool !== "string" || tool.trim() !== "") : enabledTools).length === 0) {
+				warnAndSkipMcpServer({
+					toolName,
+					serverName: name,
+					reason: `an empty enabledTools list, which allows no tools at all but which ${productName} treats as no filter`,
+					logger
+				});
+				continue;
+			}
+		}
+		Object.defineProperty(kept, name, {
+			value: server,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+	}
+	return kept;
+}
+/**
 * The `tools` map Kilo and OpenCode keep beside `mcp` is keyed `<server>_<tool>`
 * and reaches servers `mcp` does not list — ones the global config or a
 * marketplace defines — so entries naming no listed
@@ -38646,7 +38932,11 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 		const existingMcp = readExistingKiloMcpEntries(fileContent);
 		const parsedExisting = (0, jsonc_parser.parse)(fileContent || "{}");
 		const existingDocument = isRecord(parsedExisting) ? parsedExisting : {};
-		const mcpServers = rulesyncMcp.getMcpServers();
+		const mcpServers = skipServersWithEmptyEnabledTools({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: "Kilo",
+			logger
+		});
 		const { mcp: convertedMcp, toolPermissions } = convertToKiloFormat(resolveKiloEnvVarRefs({
 			mcpServers,
 			global,
@@ -38775,7 +39065,8 @@ const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
 	"timeout",
 	"oauth",
 	"protocol",
-	"codemode"
+	"codemode",
+	"pool"
 ];
 const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
@@ -38938,7 +39229,7 @@ function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 * - env -> environment
 * - disabled -> enabled (inverted)
 * - enabledTools/disabledTools -> top-level tools map (with server name prefix)
-* - OpenCode-supported extras (timeout, oauth, protocol, codemode) -> passed through verbatim
+* - OpenCode-supported extras (timeout, oauth, protocol, codemode, pool) -> passed through verbatim
 */
 function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, configShape, logger) {
 	const serverRecord = serverConfig;
@@ -39178,7 +39469,11 @@ var OpencodeMcp = class extends ToolMcp {
 			if (fileContent) relativeFilePath = this.layout.jsonFileName;
 		}
 		const transformedServers = convertEnvVarRefsToToolFormat({
-			mcpServers: rulesyncMcp.getMcpServers(),
+			mcpServers: skipServersWithEmptyEnabledTools({
+				mcpServers: rulesyncMcp.getMcpServers(),
+				toolName: "OpenCode",
+				logger
+			}),
 			replacement: "{env:$1}"
 		});
 		const existingJson = (0, jsonc_parser.parse)(fileContent || "{}");
@@ -48774,6 +49069,9 @@ var RulesProcessor = class extends FeatureProcessor {
 	language;
 	deriveSubprojectPathFromGlobs;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	skills;
 	featureOptions;
@@ -51358,12 +51656,29 @@ var HermesagentCheck = class HermesagentCheck extends ToolCheck {
 			};
 		}
 	}
+	/**
+	* The `.rulesync/checks/<stem>.md` name an imported spec gets. The slug is
+	* read from a spec file that may come from a fetched or cloned repository,
+	* so it is kept as written only when it is a single plain file name; a slug
+	* such as `../../docs/OPERATOR` would otherwise move the write out of
+	* `.rulesync/checks/`. Anything else is slugified, and an empty result falls
+	* back to the spec file's own name.
+	*/
+	importedCheckStem(slug) {
+		const isPlainFileName = (name) => name !== "" && name !== "." && name !== ".." && !/[/\\<>:"|?*]/.test(name) && !hasWindowsFoldableName(name) && stripControlCharacters(name) === name;
+		if (isPlainFileName(slug)) return slug;
+		for (const candidate of [slugifyCheckName(slug), slugifyCheckName((0, node_path.basename)(this.relativeFilePath, ".json"))]) {
+			if (candidate === "") continue;
+			return isPlainFileName(candidate) ? candidate : `${candidate}-check`;
+		}
+		return "check";
+	}
 	toRulesyncCheck() {
 		const spec = HermesCheckSpecSchema.parse(JSON.parse(this.fileContent));
 		return new RulesyncCheck({
 			outputRoot: ".",
 			relativeDirPath: RULESYNC_CHECKS_RELATIVE_DIR_PATH,
-			relativeFilePath: `${spec.slug}.md`,
+			relativeFilePath: `${this.importedCheckStem(spec.slug)}.md`,
 			frontmatter: {
 				targets: ["*"],
 				description: spec.description,
@@ -51871,6 +52186,9 @@ const checksProcessorToolTargetsGlobal = allToolTargetKeys.filter((target) => {
 var ChecksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$2, dryRun = false, logger }) {
 		super({
@@ -54182,6 +54500,10 @@ function definingFields({ h, rawEntry, hookType, converterConfig }) {
 		field: "tool",
 		value: h.tool
 	});
+	for (const { canonical, tool } of converterConfig.stringPassthroughFields ?? []) if (canonical === "if" && h[tool] !== "") fields.push({
+		field: "if",
+		value: h[tool]
+	});
 	return fields;
 }
 /**
@@ -62958,10 +63280,12 @@ function emittedEventsWithHook(params) {
 function converterCapabilities(config) {
 	if (!config.supportedHookTypes) throw new Error("Hooks converter config must declare its supportedHookTypes");
 	const passesThroughEnabled = (config.booleanPassthroughFields ?? []).some((field) => field.canonical === "enabled");
+	const passesThroughIf = (config.stringPassthroughFields ?? []).some((field) => field.canonical === "if") && !(config.skippedWhenFields ?? []).includes("if");
 	return {
 		supportedEvents: config.supportedEvents,
 		supportedHookTypes: [...config.supportedHookTypes],
-		...passesThroughEnabled ? { supportsPerHookEnabled: true } : {}
+		...passesThroughEnabled ? { supportsPerHookEnabled: true } : {},
+		...passesThroughIf ? { supportsPerHookIf: true } : {}
 	};
 }
 const toolHooksFactories = /* @__PURE__ */ new Map([
@@ -63606,6 +63930,9 @@ const hooksProcessorToolTargetsGlobalImportable = [...toolHooksFactories.entries
 var HooksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	preserveUnownedHooks;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, preserveUnownedHooks = false, logger }) {
 		super({
@@ -63684,7 +64011,8 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (!factory) throw new Error(`Unsupported tool target: ${this.toolTarget}`);
 		const config = rulesyncHooks.getJson();
 		const sharedHooks = config.hooks;
-		const overrideHooks = config[HOOKS_OVERRIDE_KEY_ALIASES[this.toolTarget] ?? this.toolTarget]?.hooks ?? {};
+		const overrideKey = HOOKS_OVERRIDE_KEY_ALIASES[this.toolTarget] ?? this.toolTarget;
+		const overrideHooks = config[overrideKey]?.hooks ?? {};
 		const effectiveHooks = {
 			...sharedHooks,
 			...overrideHooks
@@ -63722,7 +64050,10 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (eventsWithUnsupportedMatcher.length > 0) this.logger.warn(`Skipped matcher hook(s) for ${this.toolTarget} (not supported): ${eventsWithUnsupportedMatcher.join(", ")}`);
 		const toolHooks = await factory.class.fromRulesyncHooks({
 			outputRoot: this.outputRoot,
-			rulesyncHooks,
+			rulesyncHooks: factory.supportsPerHookIf ? rulesyncHooks : this.withoutConditionalHooks({
+				rulesyncHooks,
+				overrideKey
+			}),
 			validate: true,
 			global: this.global,
 			preserveUnowned: this.preserveUnownedHooks,
@@ -63745,6 +64076,53 @@ var HooksProcessor = class extends FeatureProcessor {
 		return result;
 	}
 	/**
+	* Returns the hooks source without the definitions that carry a per-hook
+	* `if` condition, warning about each one. Used for targets that cannot
+	* express `if`: emitting such a hook without its condition would make it
+	* fire on every call its matcher selects, so a permission-granting hook
+	* scoped by `if` would approve far more than its author meant.
+	*/
+	withoutConditionalHooks(params) {
+		const { rulesyncHooks, overrideKey } = params;
+		const config = rulesyncHooks.getJson();
+		const skipped = [];
+		const filterHooks = (hooks) => {
+			if (!isPlainObject(hooks)) return hooks;
+			const filtered = {};
+			for (const [event, defs] of Object.entries(hooks)) {
+				if (!Array.isArray(defs)) {
+					filtered[event] = defs;
+					continue;
+				}
+				filtered[event] = defs.filter((def) => {
+					const condition = isPlainObject(def) ? def.if : void 0;
+					if (typeof condition !== "string" || condition.trim() === "") return true;
+					skipped.push(`${event} (${quoteValueForWarning(condition)})`);
+					return false;
+				});
+			}
+			return filtered;
+		};
+		const filteredConfig = {
+			...config,
+			hooks: filterHooks(config.hooks)
+		};
+		const override = config[overrideKey];
+		if (Object.hasOwn(config, overrideKey) && isPlainObject(override)) filteredConfig[overrideKey] = {
+			...override,
+			hooks: filterHooks(override.hooks)
+		};
+		if (skipped.length === 0) return rulesyncHooks;
+		this.logger.warn(`Skipped hook(s) with an "if" condition for ${this.toolTarget} (only the ${targetsSupporting("supportsPerHookIf")} hooks formats support it, and without it the hook would run on every call its matcher selects): ${skipped.join(", ")}`);
+		return new RulesyncHooks({
+			outputRoot: rulesyncHooks.getOutputRoot(),
+			relativeDirPath: rulesyncHooks.getRelativeDirPath(),
+			relativeFilePath: rulesyncHooks.getRelativeFilePath(),
+			fileContent: JSON.stringify(filteredConfig),
+			validate: false
+		});
+	}
+	/**
 	* Warns about canonical per-hook fields that this target's hooks format
 	* cannot express, so a hook does not silently change behavior on generation.
 	* Only canonical definitions are considered: a tool-native field inside an
@@ -63989,6 +64367,35 @@ var BobIgnore = class extends PlainToolIgnore {
 		};
 	}
 };
+// src/features/ignore/claude-read-deny-pattern.ts
+/**
+* Translate the path of a Claude Code style `Read(<path>)` deny into the
+* gitignore syntax of `.rulesync/.aiignore`.
+*
+* Claude Code reads the path forms differently from gitignore: `./path` is
+* relative to the current directory, `/path` to the project root, `//path` is
+* absolute and `~/path` is under the home directory. Copied verbatim, the
+* common `Read(./.env)` idiom would become `./.env`, which matches nothing in
+* a gitignore-syntax ignore file, so every other tool would lose the deny.
+*
+* - `./path` is anchored to the project root as `/path`.
+* - `//path` and `~/path` (or a bare `~`) name locations a project-relative
+*   ignore file cannot express; they are skipped with a warning and `null` is
+*   returned.
+* - Every other path (`.env`, `secrets/**`, `/path`) already means the same
+*   project files in gitignore syntax and is kept as is.
+*/
+function claudeReadDenyPathToIgnorePattern({ path, toolLabel, logger }) {
+	if (path.startsWith("//") || path === "~" || path.startsWith("~/")) {
+		warnWithFallback(logger, `Skipping ${toolLabel} read deny ${quoteValueForWarning(path)} on ignore import: an absolute or home-directory path cannot be expressed in the project-relative .rulesync/.aiignore.`);
+		return null;
+	}
+	if (path.startsWith("./")) {
+		const rest = path.slice(2).replace(/^(?:\.\/)+/, "");
+		return rest.length > 0 ? `/${rest}` : null;
+	}
+	return path;
+}
 // src/features/ignore/claudecode-ignore.ts
 const DEFAULT_FILE_MODE = "shared";
 /**
@@ -64047,9 +64454,12 @@ var ClaudecodeIgnore = class ClaudecodeIgnore extends ToolIgnore {
 	}
 	toRulesyncIgnore() {
 		const fileContent = this.patterns.map((pattern) => {
-			if (isReadDenyEntry(pattern)) return pattern.slice(5, -1);
+			if (isReadDenyEntry(pattern)) return claudeReadDenyPathToIgnorePattern({
+				path: pattern.slice(5, -1),
+				toolLabel: "Claude Code"
+			});
 			return pattern;
-		}).filter((pattern) => pattern.length > 0).join("\n");
+		}).filter((pattern) => pattern !== null && pattern.length > 0).join("\n");
 		return new RulesyncIgnore({
 			outputRoot: this.outputRoot,
 			relativeDirPath: RulesyncIgnore.getSettablePaths().recommended.relativeDirPath,
@@ -64324,7 +64734,7 @@ var FirebenderIgnore = class FirebenderIgnore extends ToolIgnore {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const managedPatterns = [...new Set(patterns)];
+		const managedPatterns = patterns.filter((pattern, index) => patterns.lastIndexOf(pattern) === index);
 		return new FirebenderIgnore({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -64979,7 +65389,10 @@ const asClaudeStyleSettings = (document) => {
 };
 /** The pattern of a `read_file(...)` (or legacy `Read(...)`) deny, else null. */
 const readDenyPatternOf = (entry) => {
-	for (const toolName of [REASONIX_READ_TOOL_NAME, REASONIX_LEGACY_READ_TOOL_NAME]) if (isReadDenyEntry(entry, toolName)) return entry.slice(toolName.length + 1, -1);
+	for (const toolName of [REASONIX_READ_TOOL_NAME, REASONIX_LEGACY_READ_TOOL_NAME]) if (isReadDenyEntry(entry, toolName)) return claudeReadDenyPathToIgnorePattern({
+		path: entry.slice(toolName.length + 1, -1),
+		toolLabel: "Reasonix"
+	});
 	return null;
 };
 /**
@@ -65319,6 +65732,9 @@ var IgnoreProcessor = class extends FeatureProcessor {
 	getFactory;
 	featureOptions;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, getFactory = defaultGetFactory$1, global = false, dryRun = false, logger, featureOptions }) {
 		super({
 			outputRoot,
@@ -65652,30 +66068,71 @@ function isEmptyValue(value) {
 	if (Array.isArray(value)) return value.length === 0;
 	return isPlainObject(value) && Object.keys(value).length === 0;
 }
+const MILLISECONDS_PER_SECOND$4 = 1e3;
+/**
+* Convert the canonical `timeout` (milliseconds) into Antigravity's
+* `timeoutSeconds` (integer seconds), rounding up so a sub-second timeout does
+* not become `0`. A negative value disables the timeout upstream, so it is
+* written as `-1`. An authored native `timeoutSeconds` wins over `timeout`.
+*/
+function convertTimeoutToAntigravity({ serverName, config, logger }) {
+	if (!("timeout" in config)) return config;
+	const { timeout, ...rest } = config;
+	if (rest.timeoutSeconds !== void 0) {
+		logger?.warn(`Antigravity MCP: ${quoteValueForWarning(serverName)} sets both "timeout" and "timeoutSeconds"; keeping "timeoutSeconds" and dropping "timeout".`);
+		return rest;
+	}
+	if (typeof timeout !== "number" || !Number.isFinite(timeout)) {
+		logger?.warn(`Antigravity MCP: dropping the "timeout" of ${quoteValueForWarning(serverName)}: expected a number of milliseconds.`);
+		return rest;
+	}
+	const timeoutSeconds = timeout < 0 ? -1 : Math.ceil(timeout / MILLISECONDS_PER_SECOND$4);
+	return Object.fromEntries(Object.entries(config).map(([key, value]) => key === "timeout" ? ["timeoutSeconds", timeoutSeconds] : [key, value]));
+}
 /**
-* Antigravity uses `serverUrl` (not the canonical `url`) for HTTP/SSE MCP
+* Antigravity uses `serverUrl` (not the canonical `url`) for remote MCP
 * servers. Convert the canonical shape into Antigravity's on the way out, and
 * back to canonical on the way in.
 *
 * Antigravity documents no `type` field: the transport follows from `command`
-* (stdio) or `serverUrl` (Streamable HTTP / SSE), and `agy plugin validate`
+* (stdio) or `serverUrl` (Streamable HTTP), and `agy plugin validate`
 * reports the canonical `type` as an unknown field, so it is not written. A
 * remote server that carries `command`, `args` or `env` was also observed to be
 * refused at startup (runtime behavior reported by `agy plugin validate` 1.4.4,
 * not documented), so an empty `args` / `env` left on a `serverUrl` server is
 * dropped.
+*
+* Remote servers must use Streamable HTTP: the legacy HTTP+SSE transport is
+* not supported, so a canonical `sse` server is still written but warned
+* about. The canonical `timeout` (milliseconds) becomes `timeoutSeconds`.
 * https://antigravity.google/docs/mcp
 */
-function toAntigravityMcpServers(servers) {
+function toAntigravityMcpServers(servers, logger) {
 	const renamed = renameServerField(servers, "url", "serverUrl");
 	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
 		if (!isPlainObject(config)) return [name, config];
+		if (config.type === "sse" || config.transport === "sse") logger?.warn(`Antigravity MCP: ${quoteValueForWarning(name)} uses the SSE transport, which Antigravity does not support (remote servers must use Streamable HTTP); it is written as "serverUrl" and may fail to connect.`);
 		const isRemote = typeof config.serverUrl === "string";
-		return [name, Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value))))];
+		return [name, convertTimeoutToAntigravity({
+			serverName: name,
+			config: Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value)))),
+			logger
+		})];
 	}));
 }
+/**
+* Convert Antigravity servers back to the canonical shape: `serverUrl` becomes
+* `url`, and `timeoutSeconds` becomes the canonical `timeout` in milliseconds
+* (a negative value, which disables the timeout upstream, stays `-1`).
+*/
 function toCanonicalMcpServers(servers) {
-	return renameServerField(servers, "serverUrl", "url");
+	const renamed = renameServerField(servers, "serverUrl", "url");
+	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
+		if (!isPlainObject(config) || typeof config.timeoutSeconds !== "number") return [name, config];
+		const timeoutSeconds = config.timeoutSeconds;
+		const timeout = timeoutSeconds < 0 ? -1 : timeoutSeconds * MILLISECONDS_PER_SECOND$4;
+		return [name, Object.fromEntries(Object.entries(config).filter(([key]) => key !== "timeout").map(([key, value]) => key === "timeoutSeconds" ? ["timeout", timeout] : [key, value]))];
+	}));
 }
 /**
 * Parse `mcp_config.json` as JSONC and require a top-level object, so a file
@@ -65693,7 +66150,8 @@ function parseAntigravityMcpConfig(fileContent) {
 * the IDE and the CLI.
 *
 * Antigravity writes a dedicated `mcp_config.json` whose `mcpServers` map lives
-* at the top level (`disabledTools` per server is supported). Unlike Gemini
+* at the top level (`enabledTools` / `disabledTools` per server are supported
+* under the same names). Unlike Gemini
 * CLI's shared `settings.json`, this file is dedicated to MCP, so it is safely
 * deletable. HTTP servers use `serverUrl` rather than the canonical `url`, so
 * the field is translated in both directions.
@@ -65746,11 +66204,11 @@ var AntigravityMcp = class extends ToolMcp {
 			global
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const newJson = {
 			...parseAntigravityMcpConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({ mcpServers: {} }, null, 2)),
-			mcpServers: toAntigravityMcpServers(rulesyncMcp.getMcpServers())
+			mcpServers: toAntigravityMcpServers(rulesyncMcp.getMcpServers(), logger)
 		};
 		return new this({
 			outputRoot,
@@ -69419,7 +69877,11 @@ var CrushMcp = class CrushMcp extends ToolMcp {
 			ownedPaths: [["mcp"]],
 			logger
 		});
-		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => [serverName, {
+		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(skipServersWithEmptyEnabledTools({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: "Crush",
+			logger
+		})).map(([serverName, serverConfig]) => [serverName, {
 			...serverConfig,
 			...readCrushOnlyKeys({
 				serverName,
@@ -70379,31 +70841,6 @@ var DshMcp = class DshMcp extends ToolMcp {
 };
 // src/features/mcp/factorydroid-mcp.ts
 const TOOL_NAME = "factorydroid";
-/**
-* Drop servers whose `enabledTools` allowlist is empty.
-*
-* Canonically an empty allowlist allows no tools, but Droid applies
-* `enabledTools` only "when the list is non-empty"
-* (https://docs.factory.com/harness/mcp), so writing `[]` would load every
-* tool the server reports. Skipping the server is the only form that does not
-* hand the model more tools than the canonical config allows.
-*/
-function skipEmptyAllowlistServers({ mcpServers, logger }) {
-	const kept = {};
-	for (const [name, server] of Object.entries(mcpServers)) {
-		if (server.enabledTools?.length === 0) {
-			warnAndSkipMcpServer({
-				toolName: TOOL_NAME,
-				serverName: name,
-				reason: "an empty enabledTools list, which allows no tools at all but which Factory Droid treats as no filter",
-				logger
-			});
-			continue;
-		}
-		kept[name] = server;
-	}
-	return kept;
-}
 var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -70430,8 +70867,10 @@ var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 		});
 	}
 	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, logger }) {
-		const factorydroidConfig = { mcpServers: skipEmptyAllowlistServers({
+		const factorydroidConfig = { mcpServers: skipServersWithEmptyEnabledTools({
 			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: TOOL_NAME,
+			productName: "Factory Droid",
 			logger
 		}) };
 		const fileContent = JSON.stringify(factorydroidConfig, null, 2);
@@ -71862,19 +72301,42 @@ function normalizeKimiCodeTransport({ transport, hasCommand }) {
 	return hasCommand ? "stdio" : "http";
 }
 /**
-* The only `executor` value Kimi Code accepts on a stdio server. 2.2.0 removed
-* the never-implemented `kaos` option and narrowed the schema to
-* `z.enum(['local'])`, so any other value makes Kimi fail validation when it
-* loads `mcp.json`.
+* The only `executor` value every current Kimi Code release accepts on a stdio
+* server. 2.2.0 removed the never-implemented `kaos` option and narrowed the
+* schema to `z.enum(['local'])`, so 2.2.0 through 2.4.x fail validation on any
+* other value when they load `mcp.json`. 2.5.0 widened the enum back to
+* `'local' | 'kaos'`, but `kaos` is still undocumented and would break the
+* older releases, so it keeps being dropped.
 * @see https://github.com/MoonshotAI/kimi-code/pull/4184
+* @see https://github.com/MoonshotAI/kimi-code/pull/4062
 */
 const KIMI_CODE_MCP_EXECUTOR = "local";
 /** Remove, with a warning, an `executor` value Kimi Code would reject. Mutates `server`. */
 function dropUnsupportedKimiCodeExecutor({ name, server, logger }) {
 	if (server.executor === void 0 || server.executor === KIMI_CODE_MCP_EXECUTOR) return;
-	warnWithFallback(logger, `Kimi Code MCP: dropping executor ${JSON.stringify(server.executor)} from "${name}" because Kimi Code only accepts "${KIMI_CODE_MCP_EXECUTOR}".`);
+	warnWithFallback(logger, `Kimi Code MCP: dropping executor ${JSON.stringify(server.executor)} from "${name}" because Kimi Code 2.2.0 through 2.4.x accept only "${KIMI_CODE_MCP_EXECUTOR}".`);
 	delete server.executor;
 }
+/**
+* Remove, with a warning, an `environment_id` Kimi Code cannot use. Kimi Code
+* 2.5.0 added it to stdio servers only, as a non-empty string naming an
+* `[environments.<id>]` entry of `config.toml`; an empty or non-string value
+* fails Kimi's validation. Mutates `server`.
+* @see https://github.com/MoonshotAI/kimi-code/pull/4062
+*/
+function dropUnsupportedKimiCodeEnvironmentId({ name, server, isStdio, logger }) {
+	const environmentId = server.environment_id;
+	if (environmentId === void 0) return;
+	if (!isStdio) {
+		warnWithFallback(logger, `Kimi Code MCP: dropping environment_id from "${name}" because Kimi Code only accepts it on stdio servers.`);
+		delete server.environment_id;
+		return;
+	}
+	if (typeof environmentId !== "string" || environmentId.length === 0) {
+		warnWithFallback(logger, `Kimi Code MCP: dropping environment_id ${JSON.stringify(environmentId)} from "${name}" because Kimi Code requires a non-empty string.`);
+		delete server.environment_id;
+	}
+}
 function toKimiCodeServer({ name, server, logger }) {
 	const transport = server.transport ?? server.type;
 	if (transport === "ws") {
@@ -71902,6 +72364,7 @@ function toKimiCodeServer({ name, server, logger }) {
 	for (const field of [
 		"env",
 		"cwd",
+		"environment_id",
 		"executor",
 		"runtime_id",
 		"headers",
@@ -71918,6 +72381,12 @@ function toKimiCodeServer({ name, server, logger }) {
 		server: converted,
 		logger
 	});
+	dropUnsupportedKimiCodeEnvironmentId({
+		name,
+		server: converted,
+		isStdio: normalizedTransport === "stdio",
+		logger
+	});
 	if (server.disabled === true) converted.enabled = false;
 	return converted;
 }
@@ -71942,6 +72411,15 @@ function fromKimiCodeServers({ servers, logger }) {
 			logger
 		});
 		const type = transport === "stdio" || transport === "sse" || transport === "http" ? transport : void 0;
+		dropUnsupportedKimiCodeEnvironmentId({
+			name,
+			server: rest,
+			isStdio: normalizeKimiCodeTransport({
+				transport,
+				hasCommand: rest.command !== void 0
+			}) === "stdio",
+			logger
+		});
 		return [name, {
 			...rest,
 			...type && { type },
@@ -73110,7 +73588,12 @@ var OpenclawMcp = class OpenclawMcp extends ToolMcp {
 		const existingMcp = isRecord(existing["mcp"]) ? existing["mcp"] : {};
 		const existingServers = isRecord(existingMcp["servers"]) ? existingMcp[OPENCLAW_MCP_SERVERS_KEY] : {};
 		const converted = convertToOpenclawFormat({
-			mcpServers: rulesyncMcp.getMcpServers(),
+			mcpServers: skipServersWithEmptyEnabledTools({
+				mcpServers: rulesyncMcp.getMcpServers(),
+				toolName: "OpenClaw",
+				ignoreBlankNames: true,
+				logger
+			}),
 			logger
 		});
 		const servers = {
@@ -73738,7 +74221,11 @@ var PoolMcp = class PoolMcp extends ToolMcp {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
-		const converted = convertToPoolFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => {
+		const converted = convertToPoolFormat(Object.fromEntries(Object.entries(skipServersWithEmptyEnabledTools({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: "Pool",
+			logger
+		})).map(([serverName, serverConfig]) => {
 			const rawServer = rulesyncMcp.getRawMcpServer(serverName);
 			const poolAllow = isRecord(rawServer) ? rawServer.poolAllow : void 0;
 			return [serverName, {
@@ -77264,7 +77751,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		meta: {
 			supportsProject: true,
 			supportsGlobal: true,
-			supportsEnabledTools: false,
+			supportsEnabledTools: true,
 			supportsDisabledTools: true
 		}
 	}],
@@ -77273,7 +77760,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		meta: {
 			supportsProject: true,
 			supportsGlobal: true,
-			supportsEnabledTools: false,
+			supportsEnabledTools: true,
 			supportsDisabledTools: true
 		}
 	}],
@@ -77282,7 +77769,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		meta: {
 			supportsProject: true,
 			supportsGlobal: false,
-			supportsEnabledTools: false,
+			supportsEnabledTools: true,
 			supportsDisabledTools: true
 		}
 	}],
@@ -77849,6 +78336,9 @@ function warnStrippedMcpServerFields({ mcpServers, fields, toolTarget, logger })
 var McpProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	featureOptions;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory, dryRun = false, logger, featureOptions }) {
@@ -79958,12 +80448,30 @@ function toPathTarget(pattern) {
 		"**",
 		"**/*"
 	].includes(path)) return { target: "." };
-	const directory = path.replace(DIRECTORY_CONTENTS_SUFFIX, "") || (path.startsWith("/") ? "/" : "");
+	const stripped = path.replace(DIRECTORY_CONTENTS_SUFFIX, "");
+	const directory = stripped === "" && path.startsWith("/") ? "/" : /^[A-Za-z]:$/.test(stripped) && stripped !== path ? `${stripped}/` : stripped;
 	if (directory !== path && directory.length > 0 && !hasGlob(directory)) return { target: directory };
 	if (!hasGlob(path)) return { target: path };
 	return { skipReason: "Antigravity file targets are paths, not globs. Only a plain path, `dir/**` or `*` can be expressed" };
 }
 /**
+* The canonical patterns a `read_file` / `write_file` target imports as. A
+* target can name a file or a directory, and a directory covers everything
+* inside it, but the target alone does not say which. A plain path such as
+* `src` imports as both `src` and `src/**`, so re-exporting it to a tool whose
+* plain path matches only that one path keeps covering the subtree; regenerating
+* collapses both back into one target. The bare `*`, and a target that already
+* holds glob characters (verbatim output of an older Rulesync), stay as written.
+*/
+function fromPathTarget(target) {
+	if (target === "*" || hasGlob(target) || /^[A-Za-z]:$/.test(target)) return [target];
+	if (target === ".") return [".", "./**"];
+	const root = /^((?:[A-Za-z]:)?\/)\/*$/.exec(target)?.[1];
+	if (root !== void 0) return [root, `${root}**`];
+	const path = target.replace(/\/+$/, "");
+	return [path, `${path}/**`];
+}
+/**
 * A URL or domain pattern becomes its hostname. A leading `*.` is dropped,
 * since a domain already covers its subdomains, and the URL path is ignored.
 * Claude Code's `domain:` form is read as well.
@@ -80180,19 +80688,21 @@ function convertAntigravityToRulesyncPermissions({ allow, ask, deny, toCategory,
 		for (const entry of entries) {
 			const { toolName, pattern: target } = parseToolPatternEntry(entry);
 			const canonical = toCategory(toolName);
-			const pattern = ANTIGRAVITY_COMMAND_ACTIONS.has(toolName) ? importAntigravityCommandTarget({
+			const patterns = ANTIGRAVITY_COMMAND_ACTIONS.has(toolName) ? [importAntigravityCommandTarget({
 				target,
 				entry,
 				decision: action,
 				logger,
 				toolLabel
-			}) : PATH_ACTIONS.has(toolName) ? collapseLeadingHome(target, homeDirectory) : target;
-			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
-			getOrCreateOwn({
-				record: permission,
-				key: canonical,
-				create: () => ({})
-			})[pattern] = action;
+			})] : PATH_ACTIONS.has(toolName) ? fromPathTarget(collapseLeadingHome(target, homeDirectory)) : [target];
+			for (const pattern of patterns) {
+				if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+				getOrCreateOwn({
+					record: permission,
+					key: canonical,
+					create: () => ({})
+				})[pattern] = action;
+			}
 		}
 	};
 	processEntries(allow, "allow");
@@ -80963,6 +81473,10 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 * in global mode it is dropped with a warning instead of written somewhere it
 * does nothing.
 *
+* Only Auggie 0.x reads `recommendedMarketplaces`: the 1.x plugin settings
+* reference lists `enabledPlugins` alone. The key is still written because the
+* stable CLI is 0.x, and the write warning says it is 0.x-only.
+*
 * Both make Auggie load code the repository did not ship — a recommended
 * marketplace is one prompt away from being cloned, and an enabled plugin can
 * carry its own hooks and MCP servers — so writing either is logged, unless
@@ -80982,7 +81496,7 @@ function buildPluginConsumptionPatch({ override, existing, global, logger }) {
 		else {
 			patch.recommendedMarketplaces = recommendedMarketplaces;
 			const existingMarketplaces = existingKeys.recommendedMarketplaces;
-			if (recommendedMarketplaces.length > 0 && !(0, node_util.isDeepStrictEqual)(recommendedMarketplaces, existingMarketplaces)) logger?.warn(`Writing AugmentCode \`recommendedMarketplaces\` (${recommendedMarketplaces.map(quoteValueForWarning).join(", ")}): Auggie prompts everyone who opens this workspace to install these plugin marketplaces.`);
+			if (recommendedMarketplaces.length > 0 && !(0, node_util.isDeepStrictEqual)(recommendedMarketplaces, existingMarketplaces)) logger?.warn(`Writing AugmentCode \`recommendedMarketplaces\` (${recommendedMarketplaces.map(quoteValueForWarning).join(", ")}): Auggie 0.x prompts everyone who opens this workspace to install these plugin marketplaces (Auggie 1.x no longer reads this key).`);
 			warnAboutRemovedPluginIds({
 				key: "recommendedMarketplaces",
 				removed: (existingMarketplaces ?? []).filter((marketplace) => !recommendedMarketplaces.includes(marketplace)),
@@ -81211,12 +81725,12 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 			const regex = entry.shellInputRegex;
 			if (isShellRegexRoundtrippable(regex)) pattern = shellRegexToGlob(regex);
 			else {
-				if (action !== "deny" && !canApproximateShellRegexWithoutWidening(regex)) {
-					logger?.warn(`AugmentCode permissions: skipping ${action} entry for tool '${entry.toolName}': shellInputRegex '${regex}' uses a quantifier or a literal '*' / '?' that a glob cannot express, and converting it would widen the rule. The entry is not imported.`);
+				if (action === "allow" && !canApproximateShellRegexWithoutWidening(regex)) {
+					logger?.warn(`AugmentCode permissions: skipping allow entry for tool '${entry.toolName}': shellInputRegex '${regex}' uses a quantifier or a literal '*' / '?' that a glob cannot express, and converting it would widen the rule. The entry is not imported.`);
 					continue;
 				}
-				if (action === "deny") {
-					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as the catch-all '*' pattern (fail-closed) so the deny rule cannot be silently narrowed on regenerate.`);
+				if (action !== "allow") {
+					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing the ${action} rule as the catch-all '*' pattern (fail-closed) so it cannot be silently narrowed on regenerate.`);
 					pattern = "*";
 				} else {
 					pattern = shellRegexToGlob(regex);
@@ -81302,6 +81816,62 @@ function classifyPattern(pattern, bareStarIsWildcard) {
 	};
 	return { kind: "literal" };
 }
+/** The trimmed spellings of the literal (prefix) deny entries, minus the bare wildcard. */
+function collectLiteralDenyStems({ rules, bareStarIsWildcard }) {
+	const stems = /* @__PURE__ */ new Set();
+	for (const [pattern, action] of Object.entries(rules)) {
+		if (action !== "deny" || pattern === "*") continue;
+		const stem = pattern.trimEnd();
+		if (stem.length > 0 && classifyPattern(pattern, bareStarIsWildcard).kind === "literal") stems.add(stem);
+	}
+	return stems;
+}
+function isCoveredByLiteralDeny({ pattern, literalDenyStems }) {
+	if (!pattern.endsWith(" *")) return false;
+	const stem = pattern.slice(0, -2).trimEnd();
+	return stem.length > 0 && literalDenyStems.has(stem);
+}
+/**
+* Lower a VS Code style command allow/deny list pair into canonical `bash`
+* rules on import.
+*
+* The native entries are compared as literal command prefixes, while canonical
+* patterns are globs, so a verbatim copy changes their meaning:
+*
+* - A prefix deny such as `curl` blocks `curl https://…` natively but would
+*   only block the exact command `curl` canonically, so a broad allow beside
+*   it would auto-approve what the native config blocked. Each deny that does
+*   not already end in `*` is imported as itself plus `<deny> *`.
+* - An allow holding glob syntax (`npm *`) is literal prefix text natively and
+*   approves almost nothing, but canonically it is a wildcard. Such an allow is
+*   not imported (with a warning) rather than imported wider than it matched.
+*   The Roo Code lineage's bare `*` is a real wildcard natively and is kept.
+*
+* A pattern in both lists imports as `deny`, matching both tools' precedence
+* for identical entries.
+*/
+function importVscodeCommandLists({ allowed, denied, toolLabel, logger, prefixSemantics = "roo-lineage" }) {
+	const isRooLineage = prefixSemantics === "roo-lineage";
+	const rules = {};
+	const skippedAllows = [];
+	for (const pattern of allowed) {
+		if (!(isRooLineage && pattern === "*") && /[*?]/.test(pattern)) {
+			skippedAllows.push(pattern);
+			continue;
+		}
+		rules[pattern] = "allow";
+	}
+	for (const pattern of denied) {
+		rules[pattern] = "deny";
+		const stem = pattern.trimEnd();
+		if (!pattern.endsWith("*") && stem.length > 0) rules[`${stem} *`] = "deny";
+	}
+	if (skippedAllows.length > 0) {
+		const count = skippedAllows.length;
+		warnWithFallback(logger, `${toolLabel}: allow ${pluralize(count, "pattern", "patterns")} ${formatPatterns(skippedAllows)} ${pluralize(count, "was", "were")} not imported. ${toolLabel} compares ${pluralize(count, "it", "them")} as literal command prefix text, while a rulesync pattern is a glob, so importing ${pluralize(count, "it", "them")} would approve more commands than the native config does.` + (isRooLineage ? ` Only a bare "*" is a wildcard there.` : ""));
+	}
+	return rules;
+}
 function pluralize(count, singular, plural) {
 	return count === 1 ? singular : plural;
 }
@@ -81396,8 +81966,16 @@ function buildVscodeCommandLists({ rules, toolLabel, logger, prefixSemantics = "
 	const matcherAllows = [];
 	const widenedDenies = [];
 	const inertDenies = [];
+	const literalDenyStems = collectLiteralDenyStems({
+		rules,
+		bareStarIsWildcard: isRooLineage
+	});
 	for (const [pattern, action] of Object.entries(rules)) {
 		if (action !== "allow" && action !== "deny") continue;
+		if (action === "deny" && isCoveredByLiteralDeny({
+			pattern,
+			literalDenyStems
+		})) continue;
 		const shape = classifyPattern(pattern, isRooLineage);
 		if (action === "allow") {
 			allowed.push(pattern);
@@ -81760,16 +82338,20 @@ var BobPermissions = class BobPermissions extends ToolPermissions {
 			validate: true
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const settings = parseBobSettings({
 			fileContent: this.getFileContent(),
 			filePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())
 		});
 		const approval = settings[APPROVAL_KEY$1];
 		const entry = (isPlainObject(approval) && Array.isArray(approval.allowedExecutors) ? approval.allowedExecutors : []).find(isExecuteCommandEntry);
-		const rules = {};
-		for (const pattern of toStringArray$1(entry?.approvedCommands)) rules[pattern] = "allow";
-		for (const pattern of toStringArray$1(entry?.deniedCommands)) rules[pattern] = "deny";
+		const rules = importVscodeCommandLists({
+			allowed: toStringArray$1(entry?.approvedCommands),
+			denied: toStringArray$1(entry?.deniedCommands),
+			toolLabel: TOOL_LABEL,
+			logger,
+			prefixSemantics: "documented-prefix"
+		});
 		const permission = {};
 		if (Object.keys(rules).length > 0) permission[SHELL_PERMISSION_CATEGORY] = rules;
 		const bob = readBobOverride(settings);
@@ -85533,7 +86115,7 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 	const patch = {};
 	const allowed = new Set(CODEXCLI_OVERRIDE_KEYS);
 	for (const [key, value] of Object.entries(override ?? {})) {
-		if (key === "base_permission_profile" || key === "git_write_rules") continue;
+		if (key === "base_permission_profile" || key === "git_write_rules" || key === "bash_canonical_matching") continue;
 		if (!allowed.has(key)) {
 			logger?.warn(`Codex CLI permission override key "${key}" is not managed and was skipped. "permissions"/"default_permissions" are owned by the canonical permission model and "mcp_servers" gating by the MCP feature.`);
 			continue;
@@ -85822,6 +86404,7 @@ function stripTrailingSlash(pattern) {
 function buildCodexBashRulesContent({ config, logger }) {
 	const bashRules = bashRulesHonoringAllTools(config.permission);
 	const entries = Object.entries(bashRules);
+	const canonicalMatching = config.codexcli?.bash_canonical_matching === true;
 	const header = ["# Generated by Rulesync from .rulesync/permissions.jsonc (permission.bash)", "# https://developers.openai.com/codex/rules"];
 	if (entries.length === 0) return [...header, "# No bash permission rules were configured."].join("\n");
 	const ruleBlocks = entries.map(([pattern, action]) => {
@@ -85840,6 +86423,7 @@ function buildCodexBashRulesContent({ config, logger }) {
 			`    pattern = [${serializedTokens}],`,
 			`    decision = ${JSON.stringify(decision)},`,
 			`    justification = ${JSON.stringify(`Generated from Rulesync permission.bash: ${pattern}`)},`,
+			...canonicalMatching && decision !== "allow" ? ["    canonical_matching = True,"] : [],
 			")"
 		].join("\n");
 	}).filter((block) => block !== null);
@@ -87424,9 +88008,126 @@ function toCanonicalToolName$5(crushName) {
 function isMcpToolName(crushName) {
 	return crushName.startsWith(MCP_CRUSH_PREFIX) && crushName.length > 4;
 }
+const CRUSH_COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
+	"env",
+	"nohup",
+	"nice",
+	"timeout"
+]);
+const CRUSH_COMMAND_PREFIXES = [...CRUSH_COMMAND_WRAPPERS, "time"];
+const CRUSH_COMMAND_NAME = /^[a-z0-9_][a-z0-9_.+-]*$/;
+const CRUSH_COMMAND_ARGUMENT = /^[A-Za-z0-9_@%+=:,./-]+$/;
+const CRUSH_COMMAND_NAME_SUFFIXES = [
+	".exe",
+	".bat",
+	".cmd"
+];
+function isCrushCommandName(name) {
+	return CRUSH_COMMAND_NAME.test(name) && !CRUSH_COMMAND_NAME_SUFFIXES.some((suffix) => name.endsWith(suffix)) && !isPrototypePollutionKey(name);
+}
+/**
+* Reduce a command name the way Crush matches it (`shell.NormalizeCommandName`):
+* trimmed, without its directory, lower-cased, and without a Windows
+* executable suffix.
+*/
+function normalizeCrushCommandName(raw) {
+	const base = (raw.trim().split(/[\\/]/).at(-1) ?? "").toLowerCase();
+	const suffix = CRUSH_COMMAND_NAME_SUFFIXES.find((candidate) => base.length > candidate.length && base.endsWith(candidate));
+	return suffix === void 0 ? base : base.slice(0, -suffix.length);
+}
+/**
+* Whether a canonical pattern is a literal command line that a Crush
+* `safe_commands` entry reproduces exactly: Crush matches an entry only when
+* the command is written with exactly those tokens, no extra arguments and no
+* flags, which is what a wildcard-free glob means. A leading wrapper is
+* refused, since Crush would resolve it away and approve the bare command.
+*/
+function isExactCrushCommandLine(pattern) {
+	const [name, ...args] = pattern.split(" ");
+	return name !== void 0 && isCrushCommandName(name) && !CRUSH_COMMAND_WRAPPERS.has(name) && args.every((arg) => CRUSH_COMMAND_ARGUMENT.test(arg));
+}
+/**
+* The command name a canonical `<name>` / `<name> *` pattern names as a
+* whole, i.e. the `blocked_commands` entry for it, or undefined.
+*/
+function wholeCommandName(pattern) {
+	const name = pattern.endsWith(" *") ? pattern.slice(0, -2) : pattern;
+	return isCrushCommandName(name) ? name : void 0;
+}
+/**
+* The line a Crush `safe_commands` entry effectively stands for, in canonical
+* form (whitespace collapsed, command name normalized), or undefined when the
+* entry has no exact canonical spelling (wildcards, quoting, a wrapper, ...).
+*/
+function effectiveSafeCommandLine(entry) {
+	const [name, ...args] = entry.trim().split(/\s+/);
+	if (name === void 0 || name === "") return void 0;
+	const line = [normalizeCrushCommandName(name), ...args].join(" ");
+	return isExactCrushCommandLine(line) ? line : void 0;
+}
+/**
+* A restriction pattern with its command word reduced the way Crush reduces a
+* wrapper's name before peeling it (`shell.NormalizeCommandName`): any
+* directory dropped (`./nice`, `bin\env.exe`, `/usr/bin/env`), lower-cased,
+* and without a Windows executable suffix. A `*` in the command word may
+* stand for a directory and part of a name, so when what follows it is the
+* tail of a wrapper name, everything before it collapses into `*`
+* (`b*nice` -> `*nice`, `/u*v` -> `*v`; `rm*` is left alone). The rest of the pattern is lower-cased as well, for a
+* nested wrapper spelled in another case. Used only to compare against the
+* wrapper spellings of a safe line, where it can only withhold more.
+*/
+function normalizeRestrictionCommandWord(pattern) {
+	const space = pattern.indexOf(" ");
+	let head = space < 0 ? pattern : pattern.slice(0, space);
+	const rest = space < 0 ? "" : pattern.slice(space);
+	head = normalizeCrushCommandName(head);
+	const star = head.lastIndexOf("*");
+	const tail = head.slice(star + 1);
+	if (star > 0 && tail !== "" && CRUSH_COMMAND_PREFIXES.some((prefix) => prefix.endsWith(tail))) head = `*${tail}`;
+	return `${head}${rest.toLowerCase()}`;
+}
+/**
+* Build the test for a `safe_commands` line: which canonical `deny`/`ask`
+* rules govern a command Crush would approve through it? Besides the line
+* itself, Crush approves it followed by `--` and behind a wrapper (or the
+* `time` keyword), whose name it normalizes (`./nice`, `/usr/bin/env`, `NICE`,
+* `nohup.exe`). The line and its wrapper spellings are compared against the
+* restrictions as written, and the wrapper spellings also against the
+* restrictions with their command word normalized the same way — which keeps
+* an unrelated `rm *` from withholding the line, as a leading wildcard on the
+* spelling would. Canonically the stricter rule wins whatever its width
+* (`deny > ask > allow`), so any overlap withholds the line.
+*
+* Crush also approves a line composed with other safe lines (`&&`, `||`, `|`,
+* `;`, a parenthesized group); those compositions are not compared, the way
+* other tools' per-subcommand matching treats an allowed command.
+*/
+function createSafeCommandShadowTest(permission) {
+	const restrictions = collectShellCommandRules(permission).rules.filter(({ action }) => action !== "allow");
+	const test = createShadowingRestrictionsTest(restrictions);
+	const normalized = restrictions.map((rule) => ({
+		...rule,
+		pattern: normalizeRestrictionCommandWord(rule.pattern)
+	}));
+	const testNormalized = createShadowingRestrictionsTest(normalized);
+	const originalOf = /* @__PURE__ */ new Map();
+	normalized.forEach((rule, index) => {
+		const original = restrictions[index]?.pattern;
+		if (original !== void 0 && !originalOf.has(rule.pattern)) originalOf.set(rule.pattern, original);
+	});
+	const withSeparator = (spellings) => spellings.flatMap((spelling) => [spelling, `${spelling} --*`]);
+	const wrapped = (base) => CRUSH_COMMAND_PREFIXES.map((prefix) => `${prefix}*${base}`);
+	return (line) => uniq$11([...withSeparator([line, ...wrapped(line)]).flatMap((spelling) => test(spelling)), ...withSeparator(wrapped(line.toLowerCase())).flatMap((spelling) => testNormalized(spelling).map((pattern) => originalOf.get(pattern) ?? pattern))]);
+}
 function uniq$11(values) {
 	return [...new Set(values)];
 }
+function stringList(value) {
+	return isStringArray(value) ? value : [];
+}
+function listOrUndefined(values) {
+	return values.length > 0 ? values : void 0;
+}
 /**
 * Permissions adapter for Crush.
 *
@@ -87448,8 +88149,24 @@ function uniq$11(values) {
 *     `webfetch` -> `fetch`, `mcp__<server>__<tool>` -> `mcp_<server>_<tool>`;
 *     any other category passes through verbatim.
 *
-* A pattern-specific rule cannot be expressed and is reported and skipped.
-* Because Crush cannot narrow an allowed tool, a category's catch-all `allow`
+* Crush v0.100.0+ also carries two command lists, which the `bash` category's
+* pattern rules map onto (see `convertBashCommandRules`):
+*   - `permissions.safe_commands`: exact command lines that skip the prompt
+*     (no extra arguments, no flags) <- an `allow` on a literal command line
+*     that no canonical `deny`/`ask` overlaps.
+*   - `permissions.blocked_commands`: command names added to the dangerous
+*     list <- a `deny` on `<name>` or `<name> *`. Not a full deny: a direct
+*     invocation is still prompted for (and auto-approved in yolo mode or
+*     through `allowed_tools: ["bash"]`); only the forms Crush would not
+*     prompt for (its read-only commands, `safe_commands`) and indirect
+*     invocations are refused at exec time. An `ask` is not written there,
+*     since it would turn the read-only forms into a refusal.
+* `permissions.allowed_commands` only drops names from the dangerous list (the
+* commands keep prompting), so it has no canonical counterpart and is left
+* untouched.
+*
+* Any other pattern-specific rule cannot be expressed and is reported and
+* skipped. Because Crush cannot narrow an allowed tool, a category's catch-all `allow`
 * is not written while the same category carries a pattern-specific `deny` or
 * `ask`: the tool keeps prompting (fail closed) rather than being widened to
 * everything. The all-tools `*` category is mirrored onto `bash` by
@@ -87513,7 +88230,12 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 		const existingContent = location.fileContent ?? "";
 		warnCrushTwinLeftovers({
 			location,
-			ownedPaths: [[CRUSH_PERMISSIONS_KEY, CRUSH_ALLOWED_TOOLS_KEY], [CRUSH_OPTIONS_KEY, CRUSH_DISABLED_TOOLS_KEY]],
+			ownedPaths: [
+				[CRUSH_PERMISSIONS_KEY, CRUSH_ALLOWED_TOOLS_KEY],
+				[CRUSH_PERMISSIONS_KEY, CRUSH_SAFE_COMMANDS_KEY],
+				[CRUSH_PERMISSIONS_KEY, CRUSH_BLOCKED_COMMANDS_KEY],
+				[CRUSH_OPTIONS_KEY, CRUSH_DISABLED_TOOLS_KEY]
+			],
 			logger
 		});
 		const existing = parseCrushConfig(existingContent, location.filePath);
@@ -87525,12 +88247,22 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 			logger
 		});
 		const managedToolNames = managedCrushToolNames(config);
+		const commands = rebuildCrushCommandLists({
+			config,
+			existingPermissions,
+			logger
+		});
 		const preservedAllowed = (isStringArray(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
 		const preservedDisabled = (isStringArray(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
 		const allowedList = uniq$11([...preservedAllowed, ...generated.allowed]);
 		const disabledList = uniq$11([...preservedDisabled, ...generated.disabled]);
+		const permissionsHasContent = allowedList.length > 0 || commands.safe.length > 0 || commands.blocked.length > 0;
 		const patch = {};
-		if (allowedList.length > 0 || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = { [CRUSH_ALLOWED_TOOLS_KEY]: allowedList.length > 0 ? allowedList : void 0 };
+		if (permissionsHasContent || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = {
+			[CRUSH_ALLOWED_TOOLS_KEY]: listOrUndefined(allowedList),
+			[CRUSH_SAFE_COMMANDS_KEY]: listOrUndefined(commands.safe),
+			[CRUSH_BLOCKED_COMMANDS_KEY]: listOrUndefined(commands.blocked)
+		};
 		if (disabledList.length > 0 || existingOptions !== void 0) patch[CRUSH_OPTIONS_KEY] = { [CRUSH_DISABLED_TOOLS_KEY]: disabledList.length > 0 ? disabledList : void 0 };
 		return new CrushPermissions({
 			outputRoot,
@@ -87548,17 +88280,79 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 			global
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const permissions = isRecord(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
 		const options = toRecord(this.json[CRUSH_OPTIONS_KEY]);
 		const rulesyncConfig = convertCrushListsToRulesync({
-			allowed: isStringArray(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
-			disabled: isStringArray(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+			allowed: stringList(permissions[CRUSH_ALLOWED_TOOLS_KEY]),
+			disabled: stringList(options[CRUSH_DISABLED_TOOLS_KEY]),
+			safe: stringList(permissions[CRUSH_SAFE_COMMANDS_KEY]),
+			blocked: stringList(permissions[CRUSH_BLOCKED_COMMANDS_KEY]),
+			logger
 		});
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 };
 /**
+* The `safe_commands` / `blocked_commands` lists a generate writes: the
+* existing entries rulesync keeps, followed by the ones derived from the
+* canonical `bash` rules. Existing `blocked_commands` entries are all kept:
+* rulesync cannot tell its own from hand-written ones, and dropping one only
+* ever loosens. A derived blocked name that is the command of a written safe
+* line is withheld, since Crush would refuse that line at exec time.
+*/
+function rebuildCrushCommandLists({ config, existingPermissions, logger }) {
+	const bashRules = honorAllToolsOnBash(config.permission)["bash"] ?? {};
+	const shadowTest = createSafeCommandShadowTest(config.permission);
+	const generated = convertBashCommandRules({
+		bashRules,
+		shadowTest,
+		logger
+	});
+	const safe = uniq$11([...preserveSafeCommands({
+		existing: stringList(existingPermissions?.[CRUSH_SAFE_COMMANDS_KEY]),
+		bashRules,
+		shadowTest,
+		logger
+	}), ...generated.safe]);
+	const safeCommandNames = new Set(safe.flatMap((entry) => {
+		const name = entry.trim().split(/\s+/)[0];
+		return name === void 0 || name === "" ? [] : [normalizeCrushCommandName(name)];
+	}));
+	const blocked = generated.blocked.filter((name) => {
+		if (!safeCommandNames.has(name)) return true;
+		logger?.warn(`The "deny" rule for "bash" on ${quoteValueForWarning(name)} is not added to permissions.blocked_commands because Crush would then refuse the allowed permissions.safe_commands line(s) for that command; Crush keeps prompting for it.`);
+		return false;
+	});
+	const existingBlocked = stringList(existingPermissions?.[CRUSH_BLOCKED_COMMANDS_KEY]);
+	for (const entry of existingBlocked) {
+		if (!safeCommandNames.has(normalizeCrushCommandName(entry))) continue;
+		logger?.warn(`The existing permissions.blocked_commands entry ${quoteValueForWarning(entry)} is kept, but Crush will refuse the permissions.safe_commands line(s) for that command at exec time; remove one of them by hand.`);
+	}
+	return {
+		safe,
+		blocked: uniq$11([...existingBlocked, ...blocked])
+	};
+}
+/**
+* The existing `safe_commands` entries a generate keeps: those the canonical
+* `bash` rules do not spell out themselves (an entry they do spell is rebuilt
+* from them), minus any entry a canonical `deny`/`ask` governs, which would
+* otherwise auto-approve what the config restricts. An entry whose exact
+* meaning cannot be read is dropped whenever the config restricts anything.
+*/
+function preserveSafeCommands({ existing, bashRules, shadowTest, logger }) {
+	const managedLines = new Set(Object.keys(bashRules));
+	const restricts = shadowTest("*").length > 0;
+	return existing.filter((entry) => {
+		if (managedLines.has(entry)) return false;
+		const line = effectiveSafeCommandLine(entry);
+		const shadowed = line === void 0 ? restricts : shadowTest(line).length > 0;
+		if (shadowed) logger?.warn(`Crush permissions.safe_commands entry ${quoteValueForWarning(entry)} was removed because a canonical deny/ask rule may cover the commands it approves.`);
+		return !shadowed;
+	});
+}
+/**
 * The Crush tool names the canonical config manages, i.e. the names its
 * categories map to. Entries naming any other tool are the user's and survive
 * a generate. The all-tools `*` category names no Crush tool of its own.
@@ -87583,7 +88377,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 			catchAllAction = action;
 			continue;
 		}
-		logger?.warn(`Crush permissions are tool-wide (no argument patterns), so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
+		if (category !== "bash") logger?.warn(`Crush permissions are tool-wide (no argument patterns), so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 		if (action !== "allow") restricted = true;
 	}
 	if (catchAllAction === "allow" && restricted) {
@@ -87634,11 +88428,71 @@ function convertRulesyncToCrushLists({ config, logger }) {
 	};
 }
 /**
+* Map the `bash` category's pattern rules onto Crush's command lists:
+*   - `allow` on a literal command line -> `permissions.safe_commands`, which
+*     Crush matches exactly (no extra arguments, no flags). It is withheld
+*     when a canonical `deny`/`ask` governs any command Crush would approve
+*     through it.
+*   - `deny` on `<name>` / `<name> *` -> `permissions.blocked_commands`, the
+*     strictest Crush can say about a single command: a direct invocation is
+*     still prompted for, while the forms Crush would not prompt for and
+*     indirect invocations are refused at exec time. Reported, since it is
+*     not a full deny.
+*   - Anything else is reported and skipped. A pattern `ask` is never written
+*     to `blocked_commands`, which would refuse the command's read-only forms
+*     outright, and an `allow` with a wildcard has no list that auto-approves
+*     it.
+*/
+function convertBashCommandRules({ bashRules, shadowTest, logger }) {
+	const lists = {
+		safe: [],
+		blocked: []
+	};
+	for (const [rawPattern, action] of Object.entries(bashRules)) {
+		if (isPrototypePollutionKey(rawPattern)) continue;
+		const pattern = normalizeCatchAllPattern(rawPattern);
+		if (pattern === "*") continue;
+		const quoted = quoteValueForWarning(pattern);
+		if (action === "allow") {
+			if (!isExactCrushCommandLine(pattern)) {
+				logger?.warn(`Crush auto-approves a command only as an exact line in permissions.safe_commands (no wildcards or shell syntax), so the "allow" rule for "bash" (pattern ${quoted}) was skipped; Crush keeps prompting for it.`);
+				continue;
+			}
+			const shadows = shadowTest(pattern);
+			if (shadows.length > 0) {
+				logger?.warn(`The "allow" rule for "bash" (pattern ${quoted}) is not added to permissions.safe_commands because the deny/ask rule(s) ${shadows.map(quoteValueForWarning).join(", ")} also cover commands Crush would approve through it; Crush keeps prompting for it.`);
+				continue;
+			}
+			lists.safe.push(pattern);
+			continue;
+		}
+		if (action === "ask") {
+			logger?.warn(`Crush has no per-command prompt list (permissions.blocked_commands would refuse the command's read-only forms outright), so the "ask" rule for "bash" (pattern ${quoted}) was skipped; Crush still prompts for it unless it is one of Crush's built-in read-only commands.`);
+			continue;
+		}
+		const name = wholeCommandName(pattern);
+		if (name !== void 0 && CRUSH_COMMAND_PREFIXES.includes(name)) {
+			logger?.warn(`Crush resolves the command wrapper or keyword ${quoteValueForWarning(name)} before matching permissions.blocked_commands, so an entry for it would have no effect; the "deny" rule for "bash" (pattern ${quoted}) was skipped and Crush still prompts for it.`);
+			continue;
+		}
+		if (name === void 0) {
+			logger?.warn(`Crush can only restrict a whole command (permissions.blocked_commands), so the "deny" rule for "bash" (pattern ${quoted}) was skipped; Crush still prompts for it unless it is one of Crush's built-in read-only commands.`);
+			continue;
+		}
+		logger?.warn(`The "deny" rule for "bash" (pattern ${quoted}) is written as permissions.blocked_commands entry ${quoteValueForWarning(name)}, which is not a full deny: Crush still prompts for a direct invocation (and runs it unprompted in yolo mode or with "bash" in allowed_tools).`);
+		lists.blocked.push(name);
+	}
+	return {
+		safe: uniq$11(lists.safe),
+		blocked: uniq$11(lists.blocked)
+	};
+}
+/**
 * Convert Crush's two tool lists back into a rulesync config. A `tool:action`
 * entry scopes an allow to one action of a tool, which the canonical model
 * cannot express, so it is left out rather than widened to the whole tool.
 */
-function convertCrushListsToRulesync({ allowed, disabled }) {
+function convertCrushListsToRulesync({ allowed, disabled, safe, blocked, logger }) {
 	const permission = {};
 	const bucketFor = (category) => {
 		const own = lookupOwn({
@@ -87654,6 +88508,29 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
 		bucketFor(toCanonicalToolName$5(entry))["*"] = "deny";
 	}
+	const setBashRule = (pattern, action) => {
+		const bucket = bucketFor(SHELL_PERMISSION_CATEGORY);
+		if (!Object.hasOwn(bucket, pattern)) bucket[pattern] = action;
+	};
+	for (const entry of blocked) {
+		const name = normalizeCrushCommandName(entry);
+		if (name === "") continue;
+		if (!isCrushCommandName(name)) {
+			logger?.warn(`Crush permissions.blocked_commands entry ${quoteValueForWarning(entry)} is not a plain command name, so it was not imported.`);
+			continue;
+		}
+		setBashRule(name, "deny");
+		setBashRule(`${name} *`, "deny");
+	}
+	for (const entry of safe) {
+		if (entry.trim() === "") continue;
+		const line = effectiveSafeCommandLine(entry);
+		if (line === void 0) {
+			logger?.warn(`Crush permissions.safe_commands entry ${quoteValueForWarning(entry)} has no exact rulesync pattern (wildcards, shell syntax or a command wrapper), so it was not imported.`);
+			continue;
+		}
+		setBashRule(line, "allow");
+	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
 		bucketFor(toCanonicalToolName$5(entry))["*"] ??= "allow";
@@ -89033,8 +89910,8 @@ const DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS = [
 * In global mode the config file is shared with the hooks (`hooks`) feature
 * (MCP moved to the dedicated mcp_config.json in v3000.3), so reads and writes
 * merge into the existing JSON and the file is never deleted; only the keys
-* this feature manages are rewritten — `permissions`, plus `sandbox` in global
-* mode and the plugin governance lists (`requiredPlugins` / `optionalPlugins` /
+* this feature manages are rewritten — `permissions`, plus `sandbox` and
+* `permission_mode` in global mode and the plugin governance lists (`requiredPlugins` / `optionalPlugins` /
 * `forbiddenPlugins`) in project mode when the `devin` override authors them.
 *
 * The sibling `sandbox` block — which decides what a permitted command may
@@ -89142,6 +90019,12 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 				});
 			} else if (Object.keys(authoredSandboxRecord).length > 0) logger?.warn("Devin reads 'sandbox' from the user config only, so the 'devin.sandbox' override was dropped from the project config. Generate with --global to author it.");
 		}
+		applyPermissionModeOverride({
+			permissionMode: config.devin?.permission_mode,
+			patch,
+			global,
+			logger
+		});
 		applyPluginGovernanceOverride({
 			override: config.devin,
 			settings,
@@ -89185,6 +90068,12 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			if (DEVIN_PLUGIN_GOVERNANCE_SCHEMAS[key].safeParse(value).success) devinOverride[key] = value;
 			else logger?.warn(`Skipped Devin \`${key}\` on import: ${key === "forbiddenPlugins" ? "expected an array of strings" : "expected an array of plugin sources (strings or objects)"}.`);
 		}
+		const permissionMode = importPermissionMode({
+			value: settings.permission_mode,
+			isGlobalFile: toPosixPath(this.getRelativeDirPath()) === toPosixPath(DevinPermissions.getSettablePaths({ global: true }).relativeDirPath),
+			logger
+		});
+		if (permissionMode !== void 0) devinOverride.permission_mode = permissionMode;
 		const result = { ...config };
 		if (Object.keys(devinOverride).length > 0) result.devin = devinOverride;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
@@ -89201,6 +90090,48 @@ const DEVIN_PLUGIN_GOVERNANCE_KEYS = [
 	"forbiddenPlugins"
 ];
 /**
+* Decide what an imported `permission_mode` contributes to the `devin`
+* override. It is lifted from the user config only: unlike `sandbox`, a
+* project value Devin ignores is skipped with a warning rather than surfaced,
+* so it cannot slip into a `--global` generate later. `null` is Devin's
+* spelling of the default and carries nothing to keep; any other value the
+* override schema would reject is dropped with a warning so the next generate
+* cannot fail. `dangerous` is lifted but named, as on generate.
+*/
+function importPermissionMode({ value, isGlobalFile, logger }) {
+	if (value === void 0 || value === null) return void 0;
+	if (!isGlobalFile) {
+		logger?.warn("Skipped Devin `permission_mode` on import: Devin reads it from the user config only, so the project config's value has no effect. Import with --global to lift it.");
+		return;
+	}
+	const parsed = DevinPermissionModeSchema.safeParse(value);
+	if (!parsed.success) {
+		logger?.warn(`Skipped Devin \`permission_mode\` ${quoteValueForWarning(value)} on import: expected one of ${DevinPermissionModeSchema.options.join(", ")}.`);
+		return;
+	}
+	if (parsed.data === "dangerous") logger?.warn("Imported Devin `permission_mode: \"dangerous\"`: every new local session starts with all permission prompts bypassed, and the next --global generate writes it back.");
+	return parsed.data;
+}
+/**
+* Patch the `permission_mode` the `devin` override authors into the user
+* `config.json`. It sets the mode new local sessions start in, and Devin reads
+* it from the user config only, so in project mode it is dropped with a
+* warning. It is only ever written as authored — never derived from the
+* canonical rules — and `dangerous` is named in a warning, because every new
+* session then starts with all permission prompts bypassed.
+*
+* @see https://docs.devin.ai/cli/reference/configuration/config-file
+*/
+function applyPermissionModeOverride({ permissionMode, patch, global, logger }) {
+	if (permissionMode === void 0) return;
+	if (!global) {
+		logger?.warn("Devin reads 'permission_mode' from the user config only, so the 'devin.permission_mode' override was dropped from the project config. Generate with --global to author it.");
+		return;
+	}
+	patch.permission_mode = permissionMode;
+	if (permissionMode === "dangerous") logger?.warn("Writing Devin `permission_mode: \"dangerous\"` to the user config: every new local session then starts with all permission prompts bypassed.");
+}
+/**
 * Patch the plugin governance lists the `devin` override authors into the
 * project `.devin/config.json`. Each authored list replaces the file's list
 * whole; a list it does not author is left as the file holds it. Devin reads these
@@ -95190,7 +96121,8 @@ function convertQwenToRulesyncPermissions(params) {
 *
 * Reasonix matches a rule's tool exactly against its registered tools, which
 * are snake_case (`read_file`, `write_file`, `grep`, `glob`, `web_fetch`,
-* `web_search`, `notebook_edit`, `task`). Only `Bash`, `Edit` (every file
+* `web_search`, `notebook_edit`, and `task` up to v2.57.x / `spawn_agents` from
+* v2.58.0). Only `Bash`, `Edit` (every file
 * writer: `write_file`, `edit_file`, `multi_edit`, `notebook_edit`, ...),
 * `Browser` and `Computer` are Claude-Code-style family aliases
 * (`canonicalRuleTool` / `groupOf`), so a `Read(...)` or `Write(...)` rule
@@ -95213,6 +96145,21 @@ const CANONICAL_TO_REASONIX_TOOL_NAMES = {
 	agent: "task"
 };
 /**
+* Reasonix tool names a canonical category writes beside its primary name, for
+* a tool Reasonix renamed. studio-v2.58.0 replaced the `task` delegation family
+* with `spawn_agents` (commit ad2c96347), while the 1.x line and v2 up to
+* v2.57.x still register `task`. When Reasonix loads the config file it checks
+* only a rule's syntax: a rule naming a tool the running build lacks matches
+* nothing (v2.34.0+ reports it as dormant) and is not rejected. (The v2 Web UI
+* permissions editor refuses to newly add such a rule with `ErrUnknownTool`,
+* but keeps the ones already in the file.) So writing both names keeps an
+* `agent` rule in force on old and new builds alike. Both names are read back
+* to the same category.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.58.0/internal/runtime/delegation/spawn.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.57.0/internal/runtime/delegation/task.go
+*/
+const CANONICAL_TO_EXTRA_REASONIX_TOOL_NAMES = { agent: ["spawn_agents"] };
+/**
 * The Claude-Code-style spellings rulesync emitted before it followed the
 * Reasonix tool vocabulary. None of them reaches a Reasonix tool, so they are
 * read back on import (a file generated by an older rulesync still imports)
@@ -95235,7 +96182,8 @@ const CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES = {
 */
 const REASONIX_TO_CANONICAL_TOOL_NAMES = {
 	...invertRecord(CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES),
-	...invertRecord(CANONICAL_TO_REASONIX_TOOL_NAMES)
+	...invertRecord(CANONICAL_TO_REASONIX_TOOL_NAMES),
+	...Object.fromEntries(Object.entries(CANONICAL_TO_EXTRA_REASONIX_TOOL_NAMES).flatMap(([canonical, names]) => names.map((name) => [name, canonical])))
 };
 /** Every Reasonix tool name a canonical category owns on generate. */
 function reasonixToolNamesOf(canonical) {
@@ -95243,14 +96191,20 @@ function reasonixToolNamesOf(canonical) {
 		record: CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES,
 		key: canonical
 	});
-	const current = toReasonixToolName(canonical);
-	return legacy === void 0 ? [current] : [current, legacy];
+	const current = toReasonixToolNames(canonical);
+	return legacy === void 0 ? current : [...current, legacy];
 }
-function toReasonixToolName(canonical) {
-	return lookupOwn({
+/** The Reasonix tool names a canonical category's rules are written under. */
+function toReasonixToolNames(canonical) {
+	const primary = lookupOwn({
 		record: CANONICAL_TO_REASONIX_TOOL_NAMES,
 		key: canonical
 	}) ?? canonical;
+	const extra = lookupOwn({
+		record: CANONICAL_TO_EXTRA_REASONIX_TOOL_NAMES,
+		key: canonical
+	});
+	return extra === void 0 ? [primary] : [primary, ...extra];
 }
 function toCanonicalToolName$2(reasonixName) {
 	return lookupOwn({
@@ -95658,6 +96612,17 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			});
 			if (droppedReadDenyEntries.length > 0) logger.warn(`Permissions feature manages '${REASONIX_READ_TOOL_NAME}' tool and will overwrite ${droppedReadDenyEntries.length} existing read deny entries (possibly from ignore feature). Permissions take precedence.`);
 		}
+		warnOnLoosenedAgentEntries({
+			existingPermissions,
+			managedToolNames,
+			generated: {
+				allow: [...allow, ...rawAllow],
+				ask: [...ask, ...rawAsk],
+				deny: [...deny, ...rawDeny]
+			},
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		});
 		const mergedPermissions = { ...existingPermissions };
 		setOrDeleteEntries(mergedPermissions, "allow", [
 			...preservedAllow,
@@ -95833,6 +96798,55 @@ function preserveExistingEntries({ existingPermissions, managedToolNames, rawOwn
 		deny
 	};
 }
+/**
+* `spawn_agents` became a managed name with Reasonix v2.58.0 support, so a
+* stricter rule the user wrote for it by hand (e.g. a v2.58-era
+* `deny = ["spawn_agents"]` next to an older `agent: allow` source) would be
+* silently replaced by a looser one. Name every such loosening.
+*/
+function warnOnLoosenedAgentEntries({ existingPermissions, managedToolNames, generated, relativeFilePath, logger }) {
+	if (!logger || !managedToolNames.has("spawn_agents")) return;
+	const loosened = findLoosenedEntries({
+		existingPermissions,
+		toolNames: new Set(reasonixToolNamesOf("agent")),
+		generated
+	});
+	if (loosened.length === 0) return;
+	logger.warn(`Permissions feature manages the Reasonix delegation tools ('task', 'spawn_agents') through the 'agent' category and will replace ${loosened.length} stricter existing entries in ${relativeFilePath}: ${loosened.join(", ")}. To keep them, tighten the 'agent' category in ${RULESYNC_RELATIVE_DIR_PATH}/${RULESYNC_PERMISSIONS_FILE_NAME} or move them to 'reasonix.rawDeny' / 'reasonix.rawAsk'.`);
+}
+const PERMISSION_STRICTNESS = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Existing entries for `toolNames` whose action is stricter than the one the
+* generated lists give the same entry, formatted `<list> "<entry>"`. An entry
+* the generated lists drop counts as no stricter than `allow`.
+*/
+function findLoosenedEntries({ existingPermissions, toolNames, generated }) {
+	const generatedStrictness = /* @__PURE__ */ new Map();
+	for (const list of [
+		"allow",
+		"ask",
+		"deny"
+	]) for (const entry of generated[list]) {
+		const key = normalizeToolPatternEntry(entry);
+		generatedStrictness.set(key, Math.max(generatedStrictness.get(key) ?? 0, PERMISSION_STRICTNESS[list]));
+	}
+	const loosened = [];
+	for (const list of ["ask", "deny"]) for (const entry of toStringArray$1(existingPermissions[list])) {
+		if (isReasonixExactCommandEntry(entry)) continue;
+		if (!toolNames.has(parseToolPatternEntry(entry).toolName)) continue;
+		const key = normalizeToolPatternEntry(entry);
+		if ((generatedStrictness.get(key) ?? 0) < PERMISSION_STRICTNESS[list]) loosened.push(`${list} "${entry}"`);
+	}
+	return loosened;
+}
+/** Spell an entry the way rulesync writes it, so `name(*)` equals `name`. */
+function normalizeToolPatternEntry(entry) {
+	return buildToolPatternEntry(parseToolPatternEntry(entry));
+}
 /** Sort, dedupe and set a permissions array key, deleting it when empty. */
 function setOrDeleteEntries(table, key, entries) {
 	const merged = (0, es_toolkit.uniq)(entries.toSorted());
@@ -95846,22 +96860,19 @@ function convertRulesyncToReasonixPermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		const reasonixToolName = toReasonixToolName(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			const entry = buildToolPatternEntry({
-				toolName: reasonixToolName,
-				pattern
-			});
-			switch (action) {
-				case "allow":
-					allow.push(entry);
-					break;
-				case "ask":
-					ask.push(entry);
-					break;
-				case "deny": deny.push(entry);
-			}
+	for (const [category, rules] of Object.entries(config.permission)) for (const reasonixToolName of toReasonixToolNames(category)) for (const [pattern, action] of Object.entries(rules)) {
+		const entry = buildToolPatternEntry({
+			toolName: reasonixToolName,
+			pattern
+		});
+		switch (action) {
+			case "allow":
+				allow.push(entry);
+				break;
+			case "ask":
+				ask.push(entry);
+				break;
+			case "deny": deny.push(entry);
 		}
 	}
 	return {
@@ -96088,7 +97099,7 @@ var RooPermissions = class extends ToolPermissions {
 			validate: true
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const constructor = this.constructor;
 		let settings;
 		try {
@@ -96102,9 +97113,12 @@ var RooPermissions = class extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse ${constructor.getToolLabel()} VS Code settings in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const rules = {};
-		for (const pattern of toStringArray$1(settings[constructor.getAllowedCommandsKey()])) rules[pattern] = "allow";
-		for (const pattern of toStringArray$1(settings[constructor.getDeniedCommandsKey()])) rules[pattern] = "deny";
+		const rules = importVscodeCommandLists({
+			allowed: toStringArray$1(settings[constructor.getAllowedCommandsKey()]),
+			denied: toStringArray$1(settings[constructor.getDeniedCommandsKey()]),
+			toolLabel: constructor.getToolLabel(),
+			logger
+		});
 		const permission = {};
 		if (Object.keys(rules).length > 0) permission[COMMAND_CATEGORY] = rules;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
@@ -101428,6 +102442,9 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 var PermissionsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, logger }) {
 		super({
 			outputRoot,
@@ -104671,6 +105688,12 @@ Object.defineProperty(exports, "assertDirectoryIfExists", {
 		return assertDirectoryIfExists;
 	}
 });
+Object.defineProperty(exports, "assertLandingOutsideVcsMetadata", {
+	enumerable: true,
+	get: function() {
+		return assertLandingOutsideVcsMetadata;
+	}
+});
 Object.defineProperty(exports, "assertNoSymlinkBelowRoot", {
 	enumerable: true,
 	get: function() {
@@ -104713,6 +105736,12 @@ Object.defineProperty(exports, "checkPathTraversal", {
 		return checkPathTraversal;
 	}
 });
+Object.defineProperty(exports, "classifyRemoteName", {
+	enumerable: true,
+	get: function() {
+		return classifyRemoteName;
+	}
+});
 Object.defineProperty(exports, "convertFromTool", {
 	enumerable: true,
 	get: function() {
@@ -104845,16 +105874,16 @@ Object.defineProperty(exports, "groupSpellingsByCaseFoldedIdentity", {
 		return groupSpellingsByCaseFoldedIdentity;
 	}
 });
-Object.defineProperty(exports, "hasDeceptiveHiddenCharacters", {
+Object.defineProperty(exports, "hasEnclosingMarkOutsideKeycap", {
 	enumerable: true,
 	get: function() {
-		return hasDeceptiveHiddenCharacters;
+		return hasEnclosingMarkOutsideKeycap;
 	}
 });
-Object.defineProperty(exports, "hasEnclosingMarkOutsideKeycap", {
+Object.defineProperty(exports, "hasWindowsFoldableName", {
 	enumerable: true,
 	get: function() {
-		return hasEnclosingMarkOutsideKeycap;
+		return hasWindowsFoldableName;
 	}
 });
 Object.defineProperty(exports, "importFromTool", {
@@ -105103,6 +106132,12 @@ Object.defineProperty(exports, "stripHiddenCharacters", {
 		return stripHiddenCharacters;
 	}
 });
+Object.defineProperty(exports, "sweepRefusalReason", {
+	enumerable: true,
+	get: function() {
+		return sweepRefusalReason;
+	}
+});
 Object.defineProperty(exports, "toInstructionBudgetFile", {
 	enumerable: true,
 	get: function() {