rulesync 43.7.0 → 43.8.0

package/dist/{import-tr3jHcG2.js → import-Cu5o6uKO.js}

@@ -1793,28 +1793,6 @@ function splitAbsolutePath(absolutePath) {
 	};
 }
 /**
-* Whether writing `targetPath` would land outside `rootPath` once every link on
-* the way there is resolved. Both sides are taken to where a write to them
-* would land (see {@link writeLandingPath}), so a root that does not fully
-* exist yet is judged the same way as the target below it.
-*
-* A link that stays inside the root passes. That is what sets this apart from
-* the stricter {@link assertWritablePathInsideRoot} the sweep paths use: a
-* dotfiles checkout linked from inside the home directory is a common shape for
-* a global write target, and refusing it would refuse `--global` outright.
-*
-* A link chain that cycles is reported as an escape: the write could not get
-* through it, and refusing it is the answer that never writes somewhere
-* unexpected.
-*/
-async function writablePathEscapesRoot({ rootPath, targetPath }) {
-	const relativeLanding = await relativeWriteLanding({
-		rootPath,
-		targetPath
-	});
-	return relativeLanding === null || pathEscapesRoot(relativeLanding);
-}
-/**
 * Where a write to `targetPath` lands relative to where a write to `rootPath`
 * lands, both taken through {@link writeLandingPath}: `""` when the two land on
 * the same directory, and `null` when either side's links form a cycle. Errors
@@ -1827,6 +1805,59 @@ async function relativeWriteLanding({ rootPath, targetPath }) {
 	return relative(rootLanding, targetLanding);
 }
 /**
+* Directory names that hold version-control metadata. Bytes landing in one of
+* them change how the VCS behaves rather than what it tracks: `.git/config`
+* can set `core.fsmonitor`, `.git/hooks/*` run on the next commit.
+*/
+const VCS_METADATA_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".jj"
+]);
+function hasVcsMetadataSegment(path) {
+	return splitPathSegments(path).some((segment) => {
+		const folded = segment.replace(/:.*$/, "").replace(/[. ]+$/, "").toLowerCase();
+		return VCS_METADATA_DIR_NAMES.has(folded) || /^(git|hg|svn|jj)~\d+$/.test(folded);
+	});
+}
+/**
+* Whether a link on the way to `targetPath` carries it into version-control
+* metadata (`.git/` and its siblings) that its spelling does not name.
+*
+* {@link writablePathEscapesRoot} lets a link that stays inside the root
+* through, but a checked-out repository can commit `CLAUDE.md -> .git/config`:
+* the landing is inside the root, yet a write there hands the repository author
+* the operator's next `git` command. `git clone` never transfers `.git/`, so a
+* path spelled into it is never something the repository chose; only a write
+* that lands exactly where it is spelled may touch it.
+*
+* `relativeLanding` is {@link relativeWriteLanding}'s answer for the same pair,
+* passed in so a caller that already has it does not resolve the links twice.
+*/
+function landingEntersVcsMetadata({ rootPath, targetPath, relativeLanding }) {
+	return hasVcsMetadataSegment(relativeLanding) && relativeLanding !== relative(resolve(rootPath), resolve(targetPath));
+}
+/**
+* Refuse a write target that a symbolic link carries into version-control
+* metadata (see {@link landingEntersVcsMetadata}). Meant for writes of remote
+* bytes, next to {@link assertPathResolvesInsideRoot}: an in-root link (a
+* skill directory linked to a shared one) stays allowed, but not one that
+* hands the bytes to `.git/config` or `.git/hooks/`.
+*/
+async function assertLandingOutsideVcsMetadata({ rootPath, targetPath }) {
+	const relativeLanding = await relativeWriteLanding({
+		rootPath,
+		targetPath
+	});
+	if (relativeLanding === null) throw new PathOutsideRootError(`Refusing to write through a link cycle: ${targetPath}.`);
+	if (landingEntersVcsMetadata({
+		rootPath,
+		targetPath,
+		relativeLanding
+	})) throw new PathOutsideRootError(`Refusing to write ${targetPath}: a symbolic link leads it into version-control metadata.`);
+}
+/**
 * How many trailing segments `filePath` and `identity` have in common.
 *
 * A path that walked through no link at all shares all of its own segments with
@@ -5430,7 +5461,8 @@ const QWENCODE_HOOK_EVENTS = [
 	"todoCreated",
 	"todoCompleted",
 	"messageDisplay",
-	"sessionDelete"
+	"sessionDelete",
+	"fileChanged"
 ];
 const CANONICAL_TO_KIMI_CODE_EVENT_NAMES = {
 	sessionStart: "SessionStart",
@@ -6764,6 +6796,7 @@ const CANONICAL_TO_JUNIE_EVENT_NAMES = {
 	sessionStart: "SessionStart",
 	beforeSubmitPrompt: "UserPromptSubmit",
 	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
 	stop: "Stop",
 	stopFailure: "StopFailure",
 	permissionRequest: "PermissionRequest",
@@ -6772,11 +6805,12 @@ const CANONICAL_TO_JUNIE_EVENT_NAMES = {
 /**
 * Hook events supported by JetBrains Junie CLI.
 *
-* Junie CLI exposes seven lifecycle events under the `"hooks"` key of
+* Junie CLI exposes eight lifecycle events under the `"hooks"` key of
 * `~/.junie/config.json`: `SessionStart`, `UserPromptSubmit`, `PreToolUse`,
-* `Stop`, `StopFailure`, `PermissionRequest`, and `SessionEnd`. Matchers apply
-* to `SessionStart` (source), `PreToolUse` (tool name), `StopFailure` (error
-* type), `PermissionRequest` (tool name), and `SessionEnd` (reason);
+* `PostToolUse`, `Stop`, `StopFailure`, `PermissionRequest`, and `SessionEnd`.
+* Matchers apply to `SessionStart` (source), `PreToolUse` and `PostToolUse`
+* (tool name), `StopFailure` (error type), `PermissionRequest` (tool name), and
+* `SessionEnd` (reason);
 * `UserPromptSubmit` and `Stop` are matcher-less and always run. Only
 * `type: "command"` hooks are supported. Project-local hooks are ignored for
 * safety.
@@ -6955,7 +6989,8 @@ const CANONICAL_TO_QWENCODE_EVENT_NAMES = {
 	todoCreated: "TodoCreated",
 	todoCompleted: "TodoCompleted",
 	messageDisplay: "MessageDisplay",
-	sessionDelete: "SessionDelete"
+	sessionDelete: "SessionDelete",
+	fileChanged: "FileChanged"
 };
 /**
 * Map Qwen Code PascalCase event names to canonical camelCase.
@@ -9210,7 +9245,8 @@ const AntigravityCliPermissionsOverrideSchema = z.looseObject({
 * The same override also carries the two plugin-consumption keys Auggie reads
 * from `settings.json`: `recommendedMarketplaces` (`"owner/repo"` marketplaces
 * a workspace prompts its contributors to install; honored only in the
-* project's `.augment/settings.json`) and `enabledPlugins` (plugin ids of the
+* project's `.augment/settings.json`, and only by Auggie 0.x — 1.x no longer
+* reads it) and `enabledPlugins` (plugin ids of the
 * form `"plugin@marketplace"` mapped to on/off, deep-merged across the user,
 * project and local tiers).
 *
@@ -9394,6 +9430,14 @@ const CodexBasePermissionProfileSchema = z.enum(CODEX_BASE_PERMISSION_PROFILES);
 *   `true`; only an explicit `false` suppresses it. Like
 *   `base_permission_profile` it is consumed by the profile builder, not
 *   written as a top-level config key.
+* - `bash_canonical_matching` — when `true`, the `forbidden` (deny) and
+*   `prompt` (ask) rules generated from `permission.bash` into
+*   `.codex/rules/rulesync.rules` carry `canonical_matching = True`, so Codex
+*   compares their tokens after Unicode canonical case-insensitive folding (`rm` also
+*   matches `RM`). `allow` rules stay exact so the opt-in never widens what is
+*   auto-approved. Requires Codex 0.167.0 or later — an older Codex rejects the
+*   keyword and fails to load the rules file — so it defaults to `false`. Not
+*   written as a config key.
 *
 * The keys written to `config.toml` are an **allowlist**, not verbatim
 * passthrough: only `CODEXCLI_OVERRIDE_KEYS`
@@ -9401,8 +9445,8 @@ const CodexBasePermissionProfileSchema = z.enum(CODEX_BASE_PERMISSION_PROFILES);
 * `sandbox_workspace_write`, `apps`, `approvals_reviewer`, `auto_review`,
 * `tui`) are emitted, and
 * `computeCodexcliOverridePatch` skips anything else with a warning.
-* `base_permission_profile` and `git_write_rules` are consumed by the profile
-* builder rather than written, as described above, and `permission` is the
+* `base_permission_profile`, `git_write_rules` and `bash_canonical_matching`
+* are consumed by the generators rather than written, as described above, and `permission` is the
 * tool-scoped canonical block, which `RulesyncPermissions.forTarget` strips out
 * of the override before it ever reaches the patch. The allowlist is what keeps
 * the override from clobbering a feature-owned key: `mcp_servers.*` per-MCP
@@ -9459,7 +9503,8 @@ const CodexcliPermissionsOverrideSchema = z.looseObject({
 	* @see https://developers.openai.com/codex/config-reference
 	*/
 	tui: z.optional(z.looseObject({})),
-	git_write_rules: z.optional(z.boolean())
+	git_write_rules: z.optional(z.boolean()),
+	bash_canonical_matching: z.optional(z.boolean())
 });
 /**
 * Tool-scoped override block for Zed. These Zed `agent` keys sit outside the
@@ -9543,6 +9588,14 @@ const ZedPermissionsOverrideSchema = z.looseObject({
 * { "sandbox": { "excluded": { "allow": ["Exec(git status *)"], "deny": ["Exec(git tag *)"] } } }
 * @example
 * { "forbiddenPlugins": ["*"], "optionalPlugins": ["acme/approved"] }
+*
+* `permission_mode` (CLI v3000.12.17+) is the mode new local sessions start in
+* (`normal`, the upstream default, `accept-edits`, `smart` or `dangerous`).
+* Like `sandbox` it is a **User Config Only** key, so it is emitted at global
+* scope only. It is never derived from the canonical rules.
+*
+* @example
+* { "permission_mode": "accept-edits" }
 * @see https://docs.devin.ai/cli/sandbox
 * @see https://docs.devin.ai/cli/reference/configuration/config-file
 * @see https://docs.devin.ai/cli/extensibility/plugins/overview
@@ -9558,12 +9611,25 @@ const DEVIN_PLUGIN_GOVERNANCE_SCHEMAS = {
 	optionalPlugins: DevinPluginSourceListSchema,
 	forbiddenPlugins: z.array(z.string())
 };
+/**
+* Values Devin accepts for the user-config `permission_mode` key. Shared by the
+* override schema and the import, which drops a value that would not pass it.
+*
+* @see https://docs.devin.ai/cli/reference/configuration/config-file
+*/
+const DevinPermissionModeSchema = z.enum([
+	"normal",
+	"accept-edits",
+	"smart",
+	"dangerous"
+]);
 const DevinPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
 	sandbox: z.optional(z.looseObject({})),
 	requiredPlugins: z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.requiredPlugins),
 	optionalPlugins: z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.optionalPlugins),
-	forbiddenPlugins: z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.forbiddenPlugins)
+	forbiddenPlugins: z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.forbiddenPlugins),
+	permission_mode: z.optional(DevinPermissionModeSchema)
 });
 /**
 * Permissions configuration.
@@ -11975,6 +12041,98 @@ function resolveStandardSkillFields({ rootFrontmatter, section }) {
 		})
 	});
 }
+// src/utils/remote-name.ts
+/**
+* Name checks for a directory or file name chosen by a remote source (a
+* fetched repository, an installed git, GitHub or npm source). Shared by
+* `rulesync fetch` and `rulesync install`, so a name one of them turns away is
+* not written, or printed raw, by the other.
+*/
+/** A name with no character in it that draws anything of its own. */
+const NOTHING_DRAWN_PATTERN = /^[\s\p{M}]*$/u;
+/**
+* The marks a name begins with. A mark is drawn over the character before it,
+* and a name has nothing before it of its own: a leading one is drawn over
+* whatever the terminal printed last — the checkbox, the quote around a name
+* in a warning — while the name reads as if it began with its first letter.
+*/
+const LEADING_MARKS_PATTERN = /^\p{M}+/u;
+/**
+* A name ending in a dot or an ASCII space, which Win32 strips before it opens
+* the path. Only the plain space (U+0020): Win32 keeps every other trailing
+* blank, so a name ending in a no-break or an ideographic space is written
+* where it says, and is left to the whitespace note of the confusable-name
+* check rather than dropped here with Windows named as the reason.
+*/
+const TRAILING_DOT_OR_SPACE_PATTERN = /[. ]$/;
+/** A name ending in the `NAME~1` shape of a Windows 8.3 short name, extension included. */
+const SHORT_NAME_ALIAS_PATTERN = /~\d+(?:\.[^.]*)?$/;
+/**
+* A name Win32 reserves for a device — `CON`, `PRN`, `AUX`, `NUL`, `CONIN$`,
+* `CONOUT$`, `COM1`–`COM9`, `LPT1`–`LPT9` — in any case and with any
+* extension: `nul.md` is the null device too, since the reservation is decided
+* on the part before the first dot, with any spaces before that dot dropped
+* first, so `nul .md` is the null device as well. The port digit may also be
+* one of the superscript digits ¹ ² ³, which Win32 reads as 1, 2 and 3
+* (`RtlIsDosDeviceName_U`; CPython's `ntpath.isreserved` follows the same
+* rules).
+*/
+const RESERVED_DEVICE_NAME_PATTERN = /^(?:CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|COM[1-9\u00B9\u00B2\u00B3]|LPT[1-9\u00B9\u00B2\u00B3]) *(?:\..*)?$/i;
+/**
+* Whether Windows resolves a path segment to something other than the entry it
+* reads as.
+*
+* Win32 drops a trailing dot or ASCII space when it resolves a path, so a remote
+* `skills/deploy.` is the existing `skills/deploy` there. A name ending in the
+* `NAME~1` shape is the same class of problem: on a volume that generates
+* short names, it opens whatever long name it stands for. The shape only
+* means that at the end of a name, so `data~2parser` and `v1.0` are ordinary
+* names. A reserved device name is the extreme case: `nul` and `nul.md` are
+* not entries in any directory but the null device itself, so a write to one
+* lands nowhere, and a directory of that name cannot be created at all.
+*
+* The predicate is asked of every segment of a written path — the skill
+* directory, but equally a nested `references/notes. ` or a `scripts/con.sh`
+* — since a folded segment anywhere in a path lands the file beside, or on top
+* of, a sibling the repository never published. The check is not gated on the
+* platform: the same repository is checked out on several of them, and a name
+* that lands somewhere else on any one of them is one this tool would rather
+* turn away everywhere than write differently depending on where it runs.
+*/
+function hasWindowsFoldableName(name) {
+	return TRAILING_DOT_OR_SPACE_PATTERN.test(name) || SHORT_NAME_ALIAS_PATTERN.test(name) || RESERVED_DEVICE_NAME_PATTERN.test(name);
+}
+/**
+* Whether a remote name is safe to write and to print as it is.
+*
+* A name of nothing but blank space is shown as the empty string, the same as
+* one that strips down to nothing: both draw as a row with no name on it. So
+* is a name of nothing but combining marks, which have no character of their
+* own to sit on and draw as a smear over whatever the terminal puts beside
+* them. A name that merely begins with a mark is turned away for the same
+* reason, and shown without it: the mark sits on nothing the name owns. A name
+* carrying control characters (an ANSI, C1 or OSC sequence) or deceptive
+* zero-width characters is turned away too, so it can neither rewrite the
+* terminal nor pass for another name. The Windows-folding check comes after
+* the hidden characters, so a name that is both is reported by the reason that
+* keeps its raw form off the terminal.
+*/
+function classifyRemoteName(name) {
+	const stripped = stripHiddenCharacters(name);
+	const beginsWithMark = LEADING_MARKS_PATTERN.test(stripped);
+	const display = NOTHING_DRAWN_PATTERN.test(stripped) ? "" : stripped.replace(LEADING_MARKS_PATTERN, "");
+	if (display === "" || beginsWithMark || hasDeceptiveHiddenCharacters(name)) return {
+		kind: "unsafe",
+		display,
+		reason: "hidden"
+	};
+	if (hasWindowsFoldableName(name)) return {
+		kind: "unsafe",
+		display,
+		reason: "foldable"
+	};
+	return { kind: "safe" };
+}
 // src/features/rules/instruction-budget.ts
 /**
 * Normalizes a relative directory path for comparison: POSIX separators, no
@@ -13862,7 +14020,11 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions", "sandbox"]
+				ownedKeys: [
+					"permissions",
+					"sandbox",
+					"permission_mode"
+				]
 			}
 		}
 	},
@@ -14636,6 +14798,16 @@ var RulesyncSourceConsumer = class {
 		this.dryRun = dryRun;
 		this.logger = logger;
 	}
+	/**
+	* Whether the orphan sweep may follow a symbolic link that stays inside the
+	* output root. Only global scope answers true: its root is the operator's
+	* own home directory, where a dotfiles checkout linked in (`~/.claude ->
+	* ~/dotfiles/claude`) is a common shape. A project checkout may carry links
+	* its author committed, so the default refuses them.
+	*/
+	sweepsThroughInRootLinks() {
+		return false;
+	}
 	recordRulesyncSourceLoadFailure() {
 		this.rulesyncSourceLoadFailed = true;
 	}
@@ -14768,7 +14940,8 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 				refused = await refusesDeleteOutsideRoot({
 					logger: this.logger,
 					rootPath,
-					dirPath
+					dirPath,
+					allowInRootLinks: this.sweepsThroughInRootLinks()
 				});
 				refusedDirs.set(cacheKey, refused);
 			}
@@ -14868,27 +15041,45 @@ function mergeByIdentity({ perRoot, identity }) {
 	return order.map((key) => winnerByKey.get(key));
 }
 /**
-* Whether a write to `targetPath` has to be refused because a link on the way
-* there leads out of `rootPath`, warning about the refusal.
+* Why a write to `targetPath` has to be refused, or `null` when it may go
+* ahead: a link on the way there leads out of `rootPath`, or into
+* version-control metadata that the path as spelled does not name.
 *
 * A checked-out repository can carry a symbolic link at an output path
-* (`AGENTS.md -> ~/.bashrc`, a tool directory linked to `/etc`), and a write
-* through it would land wherever the link points. Every writer that lets the
-* OS follow links — file, directory, and config-rewrite alike — asks this first
-* so that one warning describes the one behavior.
+* (`AGENTS.md -> ~/.bashrc`, a tool directory linked to `/etc`, `CLAUDE.md ->
+* .git/config`), and a write through it would land wherever the link points.
+*/
+async function writeRefusalReason({ rootPath, targetPath }) {
+	const relativeLanding = await relativeWriteLanding({
+		rootPath,
+		targetPath
+	});
+	if (relativeLanding === null || pathEscapesRoot(relativeLanding)) return `it resolves outside ${quoteForLog(rootPath)} through a symbolic link`;
+	if (landingEntersVcsMetadata({
+		rootPath,
+		targetPath,
+		relativeLanding
+	})) return "it resolves into version-control metadata through a symbolic link";
+	return null;
+}
+/**
+* Whether a write to `targetPath` has to be refused (see
+* {@link writeRefusalReason}), warning about the refusal. Every writer that
+* lets the OS follow links — file, directory, and config-rewrite alike — asks
+* this first so that one warning describes the one behavior.
 */
 async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
-	if (!await writablePathEscapesRoot({
+	const reason = await writeRefusalReason({
 		rootPath,
 		targetPath
-	})) return false;
-	logger.warn(`Refusing to write ${quoteForLog(targetPath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	});
+	if (reason === null) return false;
+	logger.warn(`Refusing to write ${quoteForLog(targetPath)}: ${reason}`);
 	return true;
 }
 /**
-* Whether deleting the files in `dirPath` has to be refused because a link on
-* the way to that directory leads out of `rootPath`, warning about the refusal
-* once for the whole directory.
+* Why the orphan sweep has to leave the files in `dirPath` alone, or `null`
+* when it may delete them.
 *
 * Deletion candidates are enumerated without following links *inside* the
 * scanned directory, but the scanned directory itself is reached through
@@ -14897,13 +15088,40 @@ async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
 * an orphan. Only the directory is judged, never the file in it, because
 * removing a file that is itself a link unlinks the link where it is spelled
 * and never touches its target.
+*
+* Beyond the write rules, a project checkout is content another party may
+* control: a committed `.claude/rules -> ..` would make every untracked `*.md`
+* in the project read as an orphan. Unless `allowInRootLinks` (global scope,
+* where the root is the operator's own home directory) the swept directory
+* must therefore be the one its path spells, with no link on the way.
 */
-async function refusesDeleteOutsideRoot({ logger, rootPath, dirPath }) {
-	if (!await writablePathEscapesRoot({
+async function sweepRefusalReason({ rootPath, dirPath, allowInRootLinks }) {
+	const relativeLanding = await relativeWriteLanding({
 		rootPath,
 		targetPath: dirPath
-	})) return false;
-	logger.warn(`Refusing to delete files in ${quoteForLog(dirPath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	});
+	if (relativeLanding === null || pathEscapesRoot(relativeLanding)) return `it resolves outside ${quoteForLog(rootPath)} through a symbolic link`;
+	if (landingEntersVcsMetadata({
+		rootPath,
+		targetPath: dirPath,
+		relativeLanding
+	})) return "it resolves into version-control metadata through a symbolic link";
+	if (!allowInRootLinks && relativeLanding !== relative(resolve(rootPath), resolve(dirPath))) return "it is reached through a symbolic link";
+	return null;
+}
+/**
+* Whether deleting the files in `dirPath` has to be refused (see
+* {@link sweepRefusalReason}), warning about the refusal once for the whole
+* directory.
+*/
+async function refusesDeleteOutsideRoot({ logger, rootPath, dirPath, allowInRootLinks }) {
+	const reason = await sweepRefusalReason({
+		rootPath,
+		dirPath,
+		allowInRootLinks
+	});
+	if (reason === null) return false;
+	logger.warn(`Refusing to delete files in ${quoteForLog(dirPath)}: ${reason}`);
 	return true;
 }
 /**
@@ -22614,6 +22832,9 @@ const commandsProcessorToolTargetsGlobal = allToolTargetKeys$3.filter((target) =
 var CommandsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	flattenedCommandNaming;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$6, dryRun = false, flattenedCommandNaming = "basename", logger }) {
@@ -23185,6 +23406,15 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				this.logger.warn(`Refusing to sweep ${quotedDirPath}: ${stripControlCharacters(formatError(error))}`);
 				continue;
 			}
+			const sweepRefusal = await sweepRefusalReason({
+				rootPath: this.outputRoot,
+				dirPath,
+				allowInRootLinks: this.sweepsThroughInRootLinks()
+			});
+			if (sweepRefusal !== null) {
+				this.logger.warn(`Refusing to sweep ${quotedDirPath}: ${sweepRefusal}`);
+				continue;
+			}
 			const generatedNames = /* @__PURE__ */ new Set();
 			const mainFile = aiDir.getMainFile();
 			if (mainFile) generatedNames.add(toPosixPath(mainFile.name));
@@ -25268,6 +25498,8 @@ const CRUSH_CONFIG_FILE_NAME = "crush.json";
 const CRUSH_HIDDEN_CONFIG_FILE_NAME = ".crush.json";
 const CRUSH_PERMISSIONS_KEY = "permissions";
 const CRUSH_ALLOWED_TOOLS_KEY = "allowed_tools";
+const CRUSH_SAFE_COMMANDS_KEY = "safe_commands";
+const CRUSH_BLOCKED_COMMANDS_KEY = "blocked_commands";
 const CRUSH_OPTIONS_KEY = "options";
 const CRUSH_DISABLED_TOOLS_KEY = "disabled_tools";
 const CRUSH_HOOKS_KEY = "hooks";
@@ -29948,6 +30180,9 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 			global: this.global
 		});
 	}
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	/**
 	* The tool's skills roots that exist on disk, each paired with its absolute
 	* path and vetted as writable inside this run's output root. Shared by the
@@ -29977,6 +30212,15 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 				this.logger.warn(`Skipping the orphan sweep for ${quoteForLog(skillsDirPath)}; nothing under it is deleted: ${stripControlCharacters(formatError(error))}`);
 				continue;
 			}
+			const sweepRefusal = await sweepRefusalReason({
+				rootPath: this.outputRoot,
+				dirPath: skillsDirPath,
+				allowInRootLinks: this.sweepsThroughInRootLinks()
+			});
+			if (sweepRefusal !== null) {
+				this.logger.warn(`Skipping the orphan sweep for ${quoteForLog(skillsDirPath)}; nothing under it is deleted: ${sweepRefusal}`);
+				continue;
+			}
 			existingRoots.push({
 				root,
 				skillsDirPath
@@ -33203,11 +33447,17 @@ var FirebenderSubagent = class FirebenderSubagent extends ToolSubagent {
 	*/
 	static async fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, global = false, logger, deleteOrphans = false }) {
 		const agentsDirPath = this.getSettablePaths({ global }).relativeDirPath;
-		const agentsDirEscapesRoot = await writablePathEscapesRoot({
+		const agentsDirFullPath = join(outputRoot, agentsDirPath);
+		const writeRefused = await writeRefusalReason({
 			rootPath: outputRoot,
-			targetPath: join(outputRoot, agentsDirPath, "agent.md")
-		});
-		const existingAgentFileNames = new Set(agentsDirEscapesRoot ? [] : await listDirectoryEntryNames(join(outputRoot, agentsDirPath)));
+			targetPath: join(agentsDirFullPath, "agent.md")
+		}) !== null;
+		const sweepRefused = deleteOrphans && await sweepRefusalReason({
+			rootPath: outputRoot,
+			dirPath: agentsDirFullPath,
+			allowInRootLinks: global
+		}) !== null;
+		const existingAgentFileNames = new Set(writeRefused ? [] : await listDirectoryEntryNames(agentsDirFullPath));
 		const subagents = rulesyncSubagents.map((rulesyncSubagent) => this.fromRulesyncSubagent({
 			outputRoot,
 			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
@@ -33223,8 +33473,8 @@ var FirebenderSubagent = class FirebenderSubagent extends ToolSubagent {
 				global
 			})),
 			existingAgentFileNames,
-			deleteOrphans,
-			frozen: agentsDirEscapesRoot,
+			deleteOrphans: deleteOrphans && !sweepRefused,
+			frozen: writeRefused,
 			global,
 			logger
 		});
@@ -37342,6 +37592,9 @@ function compareRelativePathsShallowestFirst(left, right) {
 var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	deleteOrphans;
 	getFactory;
 	/**
@@ -38063,6 +38316,39 @@ function warnAndSkipMcpServer({ toolName, serverName, reason, logger }) {
 	return null;
 }
 /**
+* Drops every server whose `enabledTools` allowlist is empty, warning about
+* each one, for a tool that reads an empty (or missing) allowlist as "no
+* filter". Canonically an empty allowlist allows no tools at all, so emitting
+* the server unfiltered would expose every tool it reports. With
+* `ignoreBlankNames`, blank entries count as absent, for a tool that drops
+* them before applying the list. `productName` names the tool in the reason
+* when it differs from the `toolName` the warning starts with.
+*/
+function skipServersWithEmptyEnabledTools({ mcpServers, toolName, logger, ignoreBlankNames = false, productName = toolName }) {
+	const kept = {};
+	for (const [name, server] of Object.entries(mcpServers)) {
+		const { enabledTools } = server;
+		if (Array.isArray(enabledTools)) {
+			if ((ignoreBlankNames ? enabledTools.filter((tool) => typeof tool !== "string" || tool.trim() !== "") : enabledTools).length === 0) {
+				warnAndSkipMcpServer({
+					toolName,
+					serverName: name,
+					reason: `an empty enabledTools list, which allows no tools at all but which ${productName} treats as no filter`,
+					logger
+				});
+				continue;
+			}
+		}
+		Object.defineProperty(kept, name, {
+			value: server,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+	}
+	return kept;
+}
+/**
 * The `tools` map Kilo and OpenCode keep beside `mcp` is keyed `<server>_<tool>`
 * and reaches servers `mcp` does not list — ones the global config or a
 * marketplace defines — so entries naming no listed
@@ -38624,7 +38910,11 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 		const existingMcp = readExistingKiloMcpEntries(fileContent);
 		const parsedExisting = parse$1(fileContent || "{}");
 		const existingDocument = isRecord(parsedExisting) ? parsedExisting : {};
-		const mcpServers = rulesyncMcp.getMcpServers();
+		const mcpServers = skipServersWithEmptyEnabledTools({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: "Kilo",
+			logger
+		});
 		const { mcp: convertedMcp, toolPermissions } = convertToKiloFormat(resolveKiloEnvVarRefs({
 			mcpServers,
 			global,
@@ -38753,7 +39043,8 @@ const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
 	"timeout",
 	"oauth",
 	"protocol",
-	"codemode"
+	"codemode",
+	"pool"
 ];
 const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
@@ -38916,7 +39207,7 @@ function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 * - env -> environment
 * - disabled -> enabled (inverted)
 * - enabledTools/disabledTools -> top-level tools map (with server name prefix)
-* - OpenCode-supported extras (timeout, oauth, protocol, codemode) -> passed through verbatim
+* - OpenCode-supported extras (timeout, oauth, protocol, codemode, pool) -> passed through verbatim
 */
 function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, configShape, logger) {
 	const serverRecord = serverConfig;
@@ -39156,7 +39447,11 @@ var OpencodeMcp = class extends ToolMcp {
 			if (fileContent) relativeFilePath = this.layout.jsonFileName;
 		}
 		const transformedServers = convertEnvVarRefsToToolFormat({
-			mcpServers: rulesyncMcp.getMcpServers(),
+			mcpServers: skipServersWithEmptyEnabledTools({
+				mcpServers: rulesyncMcp.getMcpServers(),
+				toolName: "OpenCode",
+				logger
+			}),
 			replacement: "{env:$1}"
 		});
 		const existingJson = parse$1(fileContent || "{}");
@@ -48752,6 +49047,9 @@ var RulesProcessor = class extends FeatureProcessor {
 	language;
 	deriveSubprojectPathFromGlobs;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	skills;
 	featureOptions;
@@ -51336,12 +51634,29 @@ var HermesagentCheck = class HermesagentCheck extends ToolCheck {
 			};
 		}
 	}
+	/**
+	* The `.rulesync/checks/<stem>.md` name an imported spec gets. The slug is
+	* read from a spec file that may come from a fetched or cloned repository,
+	* so it is kept as written only when it is a single plain file name; a slug
+	* such as `../../docs/OPERATOR` would otherwise move the write out of
+	* `.rulesync/checks/`. Anything else is slugified, and an empty result falls
+	* back to the spec file's own name.
+	*/
+	importedCheckStem(slug) {
+		const isPlainFileName = (name) => name !== "" && name !== "." && name !== ".." && !/[/\\<>:"|?*]/.test(name) && !hasWindowsFoldableName(name) && stripControlCharacters(name) === name;
+		if (isPlainFileName(slug)) return slug;
+		for (const candidate of [slugifyCheckName(slug), slugifyCheckName(basename(this.relativeFilePath, ".json"))]) {
+			if (candidate === "") continue;
+			return isPlainFileName(candidate) ? candidate : `${candidate}-check`;
+		}
+		return "check";
+	}
 	toRulesyncCheck() {
 		const spec = HermesCheckSpecSchema.parse(JSON.parse(this.fileContent));
 		return new RulesyncCheck({
 			outputRoot: ".",
 			relativeDirPath: RULESYNC_CHECKS_RELATIVE_DIR_PATH,
-			relativeFilePath: `${spec.slug}.md`,
+			relativeFilePath: `${this.importedCheckStem(spec.slug)}.md`,
 			frontmatter: {
 				targets: ["*"],
 				description: spec.description,
@@ -51849,6 +52164,9 @@ const checksProcessorToolTargetsGlobal = allToolTargetKeys.filter((target) => {
 var ChecksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$2, dryRun = false, logger }) {
 		super({
@@ -54160,6 +54478,10 @@ function definingFields({ h, rawEntry, hookType, converterConfig }) {
 		field: "tool",
 		value: h.tool
 	});
+	for (const { canonical, tool } of converterConfig.stringPassthroughFields ?? []) if (canonical === "if" && h[tool] !== "") fields.push({
+		field: "if",
+		value: h[tool]
+	});
 	return fields;
 }
 /**
@@ -62936,10 +63258,12 @@ function emittedEventsWithHook(params) {
 function converterCapabilities(config) {
 	if (!config.supportedHookTypes) throw new Error("Hooks converter config must declare its supportedHookTypes");
 	const passesThroughEnabled = (config.booleanPassthroughFields ?? []).some((field) => field.canonical === "enabled");
+	const passesThroughIf = (config.stringPassthroughFields ?? []).some((field) => field.canonical === "if") && !(config.skippedWhenFields ?? []).includes("if");
 	return {
 		supportedEvents: config.supportedEvents,
 		supportedHookTypes: [...config.supportedHookTypes],
-		...passesThroughEnabled ? { supportsPerHookEnabled: true } : {}
+		...passesThroughEnabled ? { supportsPerHookEnabled: true } : {},
+		...passesThroughIf ? { supportsPerHookIf: true } : {}
 	};
 }
 const toolHooksFactories = /* @__PURE__ */ new Map([
@@ -63584,6 +63908,9 @@ const hooksProcessorToolTargetsGlobalImportable = [...toolHooksFactories.entries
 var HooksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	preserveUnownedHooks;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, preserveUnownedHooks = false, logger }) {
 		super({
@@ -63662,7 +63989,8 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (!factory) throw new Error(`Unsupported tool target: ${this.toolTarget}`);
 		const config = rulesyncHooks.getJson();
 		const sharedHooks = config.hooks;
-		const overrideHooks = config[HOOKS_OVERRIDE_KEY_ALIASES[this.toolTarget] ?? this.toolTarget]?.hooks ?? {};
+		const overrideKey = HOOKS_OVERRIDE_KEY_ALIASES[this.toolTarget] ?? this.toolTarget;
+		const overrideHooks = config[overrideKey]?.hooks ?? {};
 		const effectiveHooks = {
 			...sharedHooks,
 			...overrideHooks
@@ -63700,7 +64028,10 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (eventsWithUnsupportedMatcher.length > 0) this.logger.warn(`Skipped matcher hook(s) for ${this.toolTarget} (not supported): ${eventsWithUnsupportedMatcher.join(", ")}`);
 		const toolHooks = await factory.class.fromRulesyncHooks({
 			outputRoot: this.outputRoot,
-			rulesyncHooks,
+			rulesyncHooks: factory.supportsPerHookIf ? rulesyncHooks : this.withoutConditionalHooks({
+				rulesyncHooks,
+				overrideKey
+			}),
 			validate: true,
 			global: this.global,
 			preserveUnowned: this.preserveUnownedHooks,
@@ -63723,6 +64054,53 @@ var HooksProcessor = class extends FeatureProcessor {
 		return result;
 	}
 	/**
+	* Returns the hooks source without the definitions that carry a per-hook
+	* `if` condition, warning about each one. Used for targets that cannot
+	* express `if`: emitting such a hook without its condition would make it
+	* fire on every call its matcher selects, so a permission-granting hook
+	* scoped by `if` would approve far more than its author meant.
+	*/
+	withoutConditionalHooks(params) {
+		const { rulesyncHooks, overrideKey } = params;
+		const config = rulesyncHooks.getJson();
+		const skipped = [];
+		const filterHooks = (hooks) => {
+			if (!isPlainObject(hooks)) return hooks;
+			const filtered = {};
+			for (const [event, defs] of Object.entries(hooks)) {
+				if (!Array.isArray(defs)) {
+					filtered[event] = defs;
+					continue;
+				}
+				filtered[event] = defs.filter((def) => {
+					const condition = isPlainObject(def) ? def.if : void 0;
+					if (typeof condition !== "string" || condition.trim() === "") return true;
+					skipped.push(`${event} (${quoteValueForWarning(condition)})`);
+					return false;
+				});
+			}
+			return filtered;
+		};
+		const filteredConfig = {
+			...config,
+			hooks: filterHooks(config.hooks)
+		};
+		const override = config[overrideKey];
+		if (Object.hasOwn(config, overrideKey) && isPlainObject(override)) filteredConfig[overrideKey] = {
+			...override,
+			hooks: filterHooks(override.hooks)
+		};
+		if (skipped.length === 0) return rulesyncHooks;
+		this.logger.warn(`Skipped hook(s) with an "if" condition for ${this.toolTarget} (only the ${targetsSupporting("supportsPerHookIf")} hooks formats support it, and without it the hook would run on every call its matcher selects): ${skipped.join(", ")}`);
+		return new RulesyncHooks({
+			outputRoot: rulesyncHooks.getOutputRoot(),
+			relativeDirPath: rulesyncHooks.getRelativeDirPath(),
+			relativeFilePath: rulesyncHooks.getRelativeFilePath(),
+			fileContent: JSON.stringify(filteredConfig),
+			validate: false
+		});
+	}
+	/**
 	* Warns about canonical per-hook fields that this target's hooks format
 	* cannot express, so a hook does not silently change behavior on generation.
 	* Only canonical definitions are considered: a tool-native field inside an
@@ -63967,6 +64345,35 @@ var BobIgnore = class extends PlainToolIgnore {
 		};
 	}
 };
+// src/features/ignore/claude-read-deny-pattern.ts
+/**
+* Translate the path of a Claude Code style `Read(<path>)` deny into the
+* gitignore syntax of `.rulesync/.aiignore`.
+*
+* Claude Code reads the path forms differently from gitignore: `./path` is
+* relative to the current directory, `/path` to the project root, `//path` is
+* absolute and `~/path` is under the home directory. Copied verbatim, the
+* common `Read(./.env)` idiom would become `./.env`, which matches nothing in
+* a gitignore-syntax ignore file, so every other tool would lose the deny.
+*
+* - `./path` is anchored to the project root as `/path`.
+* - `//path` and `~/path` (or a bare `~`) name locations a project-relative
+*   ignore file cannot express; they are skipped with a warning and `null` is
+*   returned.
+* - Every other path (`.env`, `secrets/**`, `/path`) already means the same
+*   project files in gitignore syntax and is kept as is.
+*/
+function claudeReadDenyPathToIgnorePattern({ path, toolLabel, logger }) {
+	if (path.startsWith("//") || path === "~" || path.startsWith("~/")) {
+		warnWithFallback(logger, `Skipping ${toolLabel} read deny ${quoteValueForWarning(path)} on ignore import: an absolute or home-directory path cannot be expressed in the project-relative .rulesync/.aiignore.`);
+		return null;
+	}
+	if (path.startsWith("./")) {
+		const rest = path.slice(2).replace(/^(?:\.\/)+/, "");
+		return rest.length > 0 ? `/${rest}` : null;
+	}
+	return path;
+}
 // src/features/ignore/claudecode-ignore.ts
 const DEFAULT_FILE_MODE = "shared";
 /**
@@ -64025,9 +64432,12 @@ var ClaudecodeIgnore = class ClaudecodeIgnore extends ToolIgnore {
 	}
 	toRulesyncIgnore() {
 		const fileContent = this.patterns.map((pattern) => {
-			if (isReadDenyEntry(pattern)) return pattern.slice(5, -1);
+			if (isReadDenyEntry(pattern)) return claudeReadDenyPathToIgnorePattern({
+				path: pattern.slice(5, -1),
+				toolLabel: "Claude Code"
+			});
 			return pattern;
-		}).filter((pattern) => pattern.length > 0).join("\n");
+		}).filter((pattern) => pattern !== null && pattern.length > 0).join("\n");
 		return new RulesyncIgnore({
 			outputRoot: this.outputRoot,
 			relativeDirPath: RulesyncIgnore.getSettablePaths().recommended.relativeDirPath,
@@ -64302,7 +64712,7 @@ var FirebenderIgnore = class FirebenderIgnore extends ToolIgnore {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const managedPatterns = [...new Set(patterns)];
+		const managedPatterns = patterns.filter((pattern, index) => patterns.lastIndexOf(pattern) === index);
 		return new FirebenderIgnore({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -64957,7 +65367,10 @@ const asClaudeStyleSettings = (document) => {
 };
 /** The pattern of a `read_file(...)` (or legacy `Read(...)`) deny, else null. */
 const readDenyPatternOf = (entry) => {
-	for (const toolName of [REASONIX_READ_TOOL_NAME, REASONIX_LEGACY_READ_TOOL_NAME]) if (isReadDenyEntry(entry, toolName)) return entry.slice(toolName.length + 1, -1);
+	for (const toolName of [REASONIX_READ_TOOL_NAME, REASONIX_LEGACY_READ_TOOL_NAME]) if (isReadDenyEntry(entry, toolName)) return claudeReadDenyPathToIgnorePattern({
+		path: entry.slice(toolName.length + 1, -1),
+		toolLabel: "Reasonix"
+	});
 	return null;
 };
 /**
@@ -65297,6 +65710,9 @@ var IgnoreProcessor = class extends FeatureProcessor {
 	getFactory;
 	featureOptions;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, getFactory = defaultGetFactory$1, global = false, dryRun = false, logger, featureOptions }) {
 		super({
 			outputRoot,
@@ -65630,30 +66046,71 @@ function isEmptyValue(value) {
 	if (Array.isArray(value)) return value.length === 0;
 	return isPlainObject(value) && Object.keys(value).length === 0;
 }
+const MILLISECONDS_PER_SECOND$4 = 1e3;
+/**
+* Convert the canonical `timeout` (milliseconds) into Antigravity's
+* `timeoutSeconds` (integer seconds), rounding up so a sub-second timeout does
+* not become `0`. A negative value disables the timeout upstream, so it is
+* written as `-1`. An authored native `timeoutSeconds` wins over `timeout`.
+*/
+function convertTimeoutToAntigravity({ serverName, config, logger }) {
+	if (!("timeout" in config)) return config;
+	const { timeout, ...rest } = config;
+	if (rest.timeoutSeconds !== void 0) {
+		logger?.warn(`Antigravity MCP: ${quoteValueForWarning(serverName)} sets both "timeout" and "timeoutSeconds"; keeping "timeoutSeconds" and dropping "timeout".`);
+		return rest;
+	}
+	if (typeof timeout !== "number" || !Number.isFinite(timeout)) {
+		logger?.warn(`Antigravity MCP: dropping the "timeout" of ${quoteValueForWarning(serverName)}: expected a number of milliseconds.`);
+		return rest;
+	}
+	const timeoutSeconds = timeout < 0 ? -1 : Math.ceil(timeout / MILLISECONDS_PER_SECOND$4);
+	return Object.fromEntries(Object.entries(config).map(([key, value]) => key === "timeout" ? ["timeoutSeconds", timeoutSeconds] : [key, value]));
+}
 /**
-* Antigravity uses `serverUrl` (not the canonical `url`) for HTTP/SSE MCP
+* Antigravity uses `serverUrl` (not the canonical `url`) for remote MCP
 * servers. Convert the canonical shape into Antigravity's on the way out, and
 * back to canonical on the way in.
 *
 * Antigravity documents no `type` field: the transport follows from `command`
-* (stdio) or `serverUrl` (Streamable HTTP / SSE), and `agy plugin validate`
+* (stdio) or `serverUrl` (Streamable HTTP), and `agy plugin validate`
 * reports the canonical `type` as an unknown field, so it is not written. A
 * remote server that carries `command`, `args` or `env` was also observed to be
 * refused at startup (runtime behavior reported by `agy plugin validate` 1.4.4,
 * not documented), so an empty `args` / `env` left on a `serverUrl` server is
 * dropped.
+*
+* Remote servers must use Streamable HTTP: the legacy HTTP+SSE transport is
+* not supported, so a canonical `sse` server is still written but warned
+* about. The canonical `timeout` (milliseconds) becomes `timeoutSeconds`.
 * https://antigravity.google/docs/mcp
 */
-function toAntigravityMcpServers(servers) {
+function toAntigravityMcpServers(servers, logger) {
 	const renamed = renameServerField(servers, "url", "serverUrl");
 	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
 		if (!isPlainObject(config)) return [name, config];
+		if (config.type === "sse" || config.transport === "sse") logger?.warn(`Antigravity MCP: ${quoteValueForWarning(name)} uses the SSE transport, which Antigravity does not support (remote servers must use Streamable HTTP); it is written as "serverUrl" and may fail to connect.`);
 		const isRemote = typeof config.serverUrl === "string";
-		return [name, Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value))))];
+		return [name, convertTimeoutToAntigravity({
+			serverName: name,
+			config: Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value)))),
+			logger
+		})];
 	}));
 }
+/**
+* Convert Antigravity servers back to the canonical shape: `serverUrl` becomes
+* `url`, and `timeoutSeconds` becomes the canonical `timeout` in milliseconds
+* (a negative value, which disables the timeout upstream, stays `-1`).
+*/
 function toCanonicalMcpServers(servers) {
-	return renameServerField(servers, "serverUrl", "url");
+	const renamed = renameServerField(servers, "serverUrl", "url");
+	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
+		if (!isPlainObject(config) || typeof config.timeoutSeconds !== "number") return [name, config];
+		const timeoutSeconds = config.timeoutSeconds;
+		const timeout = timeoutSeconds < 0 ? -1 : timeoutSeconds * MILLISECONDS_PER_SECOND$4;
+		return [name, Object.fromEntries(Object.entries(config).filter(([key]) => key !== "timeout").map(([key, value]) => key === "timeoutSeconds" ? ["timeout", timeout] : [key, value]))];
+	}));
 }
 /**
 * Parse `mcp_config.json` as JSONC and require a top-level object, so a file
@@ -65671,7 +66128,8 @@ function parseAntigravityMcpConfig(fileContent) {
 * the IDE and the CLI.
 *
 * Antigravity writes a dedicated `mcp_config.json` whose `mcpServers` map lives
-* at the top level (`disabledTools` per server is supported). Unlike Gemini
+* at the top level (`enabledTools` / `disabledTools` per server are supported
+* under the same names). Unlike Gemini
 * CLI's shared `settings.json`, this file is dedicated to MCP, so it is safely
 * deletable. HTTP servers use `serverUrl` rather than the canonical `url`, so
 * the field is translated in both directions.
@@ -65724,11 +66182,11 @@ var AntigravityMcp = class extends ToolMcp {
 			global
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const newJson = {
 			...parseAntigravityMcpConfig(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({ mcpServers: {} }, null, 2)),
-			mcpServers: toAntigravityMcpServers(rulesyncMcp.getMcpServers())
+			mcpServers: toAntigravityMcpServers(rulesyncMcp.getMcpServers(), logger)
 		};
 		return new this({
 			outputRoot,
@@ -69397,7 +69855,11 @@ var CrushMcp = class CrushMcp extends ToolMcp {
 			ownedPaths: [["mcp"]],
 			logger
 		});
-		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => [serverName, {
+		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(skipServersWithEmptyEnabledTools({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: "Crush",
+			logger
+		})).map(([serverName, serverConfig]) => [serverName, {
 			...serverConfig,
 			...readCrushOnlyKeys({
 				serverName,
@@ -70357,31 +70819,6 @@ var DshMcp = class DshMcp extends ToolMcp {
 };
 // src/features/mcp/factorydroid-mcp.ts
 const TOOL_NAME = "factorydroid";
-/**
-* Drop servers whose `enabledTools` allowlist is empty.
-*
-* Canonically an empty allowlist allows no tools, but Droid applies
-* `enabledTools` only "when the list is non-empty"
-* (https://docs.factory.com/harness/mcp), so writing `[]` would load every
-* tool the server reports. Skipping the server is the only form that does not
-* hand the model more tools than the canonical config allows.
-*/
-function skipEmptyAllowlistServers({ mcpServers, logger }) {
-	const kept = {};
-	for (const [name, server] of Object.entries(mcpServers)) {
-		if (server.enabledTools?.length === 0) {
-			warnAndSkipMcpServer({
-				toolName: TOOL_NAME,
-				serverName: name,
-				reason: "an empty enabledTools list, which allows no tools at all but which Factory Droid treats as no filter",
-				logger
-			});
-			continue;
-		}
-		kept[name] = server;
-	}
-	return kept;
-}
 var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -70408,8 +70845,10 @@ var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 		});
 	}
 	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, logger }) {
-		const factorydroidConfig = { mcpServers: skipEmptyAllowlistServers({
+		const factorydroidConfig = { mcpServers: skipServersWithEmptyEnabledTools({
 			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: TOOL_NAME,
+			productName: "Factory Droid",
 			logger
 		}) };
 		const fileContent = JSON.stringify(factorydroidConfig, null, 2);
@@ -71840,19 +72279,42 @@ function normalizeKimiCodeTransport({ transport, hasCommand }) {
 	return hasCommand ? "stdio" : "http";
 }
 /**
-* The only `executor` value Kimi Code accepts on a stdio server. 2.2.0 removed
-* the never-implemented `kaos` option and narrowed the schema to
-* `z.enum(['local'])`, so any other value makes Kimi fail validation when it
-* loads `mcp.json`.
+* The only `executor` value every current Kimi Code release accepts on a stdio
+* server. 2.2.0 removed the never-implemented `kaos` option and narrowed the
+* schema to `z.enum(['local'])`, so 2.2.0 through 2.4.x fail validation on any
+* other value when they load `mcp.json`. 2.5.0 widened the enum back to
+* `'local' | 'kaos'`, but `kaos` is still undocumented and would break the
+* older releases, so it keeps being dropped.
 * @see https://github.com/MoonshotAI/kimi-code/pull/4184
+* @see https://github.com/MoonshotAI/kimi-code/pull/4062
 */
 const KIMI_CODE_MCP_EXECUTOR = "local";
 /** Remove, with a warning, an `executor` value Kimi Code would reject. Mutates `server`. */
 function dropUnsupportedKimiCodeExecutor({ name, server, logger }) {
 	if (server.executor === void 0 || server.executor === KIMI_CODE_MCP_EXECUTOR) return;
-	warnWithFallback(logger, `Kimi Code MCP: dropping executor ${JSON.stringify(server.executor)} from "${name}" because Kimi Code only accepts "${KIMI_CODE_MCP_EXECUTOR}".`);
+	warnWithFallback(logger, `Kimi Code MCP: dropping executor ${JSON.stringify(server.executor)} from "${name}" because Kimi Code 2.2.0 through 2.4.x accept only "${KIMI_CODE_MCP_EXECUTOR}".`);
 	delete server.executor;
 }
+/**
+* Remove, with a warning, an `environment_id` Kimi Code cannot use. Kimi Code
+* 2.5.0 added it to stdio servers only, as a non-empty string naming an
+* `[environments.<id>]` entry of `config.toml`; an empty or non-string value
+* fails Kimi's validation. Mutates `server`.
+* @see https://github.com/MoonshotAI/kimi-code/pull/4062
+*/
+function dropUnsupportedKimiCodeEnvironmentId({ name, server, isStdio, logger }) {
+	const environmentId = server.environment_id;
+	if (environmentId === void 0) return;
+	if (!isStdio) {
+		warnWithFallback(logger, `Kimi Code MCP: dropping environment_id from "${name}" because Kimi Code only accepts it on stdio servers.`);
+		delete server.environment_id;
+		return;
+	}
+	if (typeof environmentId !== "string" || environmentId.length === 0) {
+		warnWithFallback(logger, `Kimi Code MCP: dropping environment_id ${JSON.stringify(environmentId)} from "${name}" because Kimi Code requires a non-empty string.`);
+		delete server.environment_id;
+	}
+}
 function toKimiCodeServer({ name, server, logger }) {
 	const transport = server.transport ?? server.type;
 	if (transport === "ws") {
@@ -71880,6 +72342,7 @@ function toKimiCodeServer({ name, server, logger }) {
 	for (const field of [
 		"env",
 		"cwd",
+		"environment_id",
 		"executor",
 		"runtime_id",
 		"headers",
@@ -71896,6 +72359,12 @@ function toKimiCodeServer({ name, server, logger }) {
 		server: converted,
 		logger
 	});
+	dropUnsupportedKimiCodeEnvironmentId({
+		name,
+		server: converted,
+		isStdio: normalizedTransport === "stdio",
+		logger
+	});
 	if (server.disabled === true) converted.enabled = false;
 	return converted;
 }
@@ -71920,6 +72389,15 @@ function fromKimiCodeServers({ servers, logger }) {
 			logger
 		});
 		const type = transport === "stdio" || transport === "sse" || transport === "http" ? transport : void 0;
+		dropUnsupportedKimiCodeEnvironmentId({
+			name,
+			server: rest,
+			isStdio: normalizeKimiCodeTransport({
+				transport,
+				hasCommand: rest.command !== void 0
+			}) === "stdio",
+			logger
+		});
 		return [name, {
 			...rest,
 			...type && { type },
@@ -73088,7 +73566,12 @@ var OpenclawMcp = class OpenclawMcp extends ToolMcp {
 		const existingMcp = isRecord(existing["mcp"]) ? existing["mcp"] : {};
 		const existingServers = isRecord(existingMcp["servers"]) ? existingMcp[OPENCLAW_MCP_SERVERS_KEY] : {};
 		const converted = convertToOpenclawFormat({
-			mcpServers: rulesyncMcp.getMcpServers(),
+			mcpServers: skipServersWithEmptyEnabledTools({
+				mcpServers: rulesyncMcp.getMcpServers(),
+				toolName: "OpenClaw",
+				ignoreBlankNames: true,
+				logger
+			}),
 			logger
 		});
 		const servers = {
@@ -73716,7 +74199,11 @@ var PoolMcp = class PoolMcp extends ToolMcp {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
-		const converted = convertToPoolFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => {
+		const converted = convertToPoolFormat(Object.fromEntries(Object.entries(skipServersWithEmptyEnabledTools({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			toolName: "Pool",
+			logger
+		})).map(([serverName, serverConfig]) => {
 			const rawServer = rulesyncMcp.getRawMcpServer(serverName);
 			const poolAllow = isRecord(rawServer) ? rawServer.poolAllow : void 0;
 			return [serverName, {
@@ -77242,7 +77729,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		meta: {
 			supportsProject: true,
 			supportsGlobal: true,
-			supportsEnabledTools: false,
+			supportsEnabledTools: true,
 			supportsDisabledTools: true
 		}
 	}],
@@ -77251,7 +77738,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		meta: {
 			supportsProject: true,
 			supportsGlobal: true,
-			supportsEnabledTools: false,
+			supportsEnabledTools: true,
 			supportsDisabledTools: true
 		}
 	}],
@@ -77260,7 +77747,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		meta: {
 			supportsProject: true,
 			supportsGlobal: false,
-			supportsEnabledTools: false,
+			supportsEnabledTools: true,
 			supportsDisabledTools: true
 		}
 	}],
@@ -77827,6 +78314,9 @@ function warnStrippedMcpServerFields({ mcpServers, fields, toolTarget, logger })
 var McpProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	getFactory;
 	featureOptions;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory, dryRun = false, logger, featureOptions }) {
@@ -79936,12 +80426,30 @@ function toPathTarget(pattern) {
 		"**",
 		"**/*"
 	].includes(path)) return { target: "." };
-	const directory = path.replace(DIRECTORY_CONTENTS_SUFFIX, "") || (path.startsWith("/") ? "/" : "");
+	const stripped = path.replace(DIRECTORY_CONTENTS_SUFFIX, "");
+	const directory = stripped === "" && path.startsWith("/") ? "/" : /^[A-Za-z]:$/.test(stripped) && stripped !== path ? `${stripped}/` : stripped;
 	if (directory !== path && directory.length > 0 && !hasGlob(directory)) return { target: directory };
 	if (!hasGlob(path)) return { target: path };
 	return { skipReason: "Antigravity file targets are paths, not globs. Only a plain path, `dir/**` or `*` can be expressed" };
 }
 /**
+* The canonical patterns a `read_file` / `write_file` target imports as. A
+* target can name a file or a directory, and a directory covers everything
+* inside it, but the target alone does not say which. A plain path such as
+* `src` imports as both `src` and `src/**`, so re-exporting it to a tool whose
+* plain path matches only that one path keeps covering the subtree; regenerating
+* collapses both back into one target. The bare `*`, and a target that already
+* holds glob characters (verbatim output of an older Rulesync), stay as written.
+*/
+function fromPathTarget(target) {
+	if (target === "*" || hasGlob(target) || /^[A-Za-z]:$/.test(target)) return [target];
+	if (target === ".") return [".", "./**"];
+	const root = /^((?:[A-Za-z]:)?\/)\/*$/.exec(target)?.[1];
+	if (root !== void 0) return [root, `${root}**`];
+	const path = target.replace(/\/+$/, "");
+	return [path, `${path}/**`];
+}
+/**
 * A URL or domain pattern becomes its hostname. A leading `*.` is dropped,
 * since a domain already covers its subdomains, and the URL path is ignored.
 * Claude Code's `domain:` form is read as well.
@@ -80158,19 +80666,21 @@ function convertAntigravityToRulesyncPermissions({ allow, ask, deny, toCategory,
 		for (const entry of entries) {
 			const { toolName, pattern: target } = parseToolPatternEntry(entry);
 			const canonical = toCategory(toolName);
-			const pattern = ANTIGRAVITY_COMMAND_ACTIONS.has(toolName) ? importAntigravityCommandTarget({
+			const patterns = ANTIGRAVITY_COMMAND_ACTIONS.has(toolName) ? [importAntigravityCommandTarget({
 				target,
 				entry,
 				decision: action,
 				logger,
 				toolLabel
-			}) : PATH_ACTIONS.has(toolName) ? collapseLeadingHome(target, homeDirectory) : target;
-			if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
-			getOrCreateOwn({
-				record: permission,
-				key: canonical,
-				create: () => ({})
-			})[pattern] = action;
+			})] : PATH_ACTIONS.has(toolName) ? fromPathTarget(collapseLeadingHome(target, homeDirectory)) : [target];
+			for (const pattern of patterns) {
+				if (isPrototypePollutionKey(canonical) || isPrototypePollutionKey(pattern)) continue;
+				getOrCreateOwn({
+					record: permission,
+					key: canonical,
+					create: () => ({})
+				})[pattern] = action;
+			}
 		}
 	};
 	processEntries(allow, "allow");
@@ -80941,6 +81451,10 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 * in global mode it is dropped with a warning instead of written somewhere it
 * does nothing.
 *
+* Only Auggie 0.x reads `recommendedMarketplaces`: the 1.x plugin settings
+* reference lists `enabledPlugins` alone. The key is still written because the
+* stable CLI is 0.x, and the write warning says it is 0.x-only.
+*
 * Both make Auggie load code the repository did not ship — a recommended
 * marketplace is one prompt away from being cloned, and an enabled plugin can
 * carry its own hooks and MCP servers — so writing either is logged, unless
@@ -80960,7 +81474,7 @@ function buildPluginConsumptionPatch({ override, existing, global, logger }) {
 		else {
 			patch.recommendedMarketplaces = recommendedMarketplaces;
 			const existingMarketplaces = existingKeys.recommendedMarketplaces;
-			if (recommendedMarketplaces.length > 0 && !isDeepStrictEqual(recommendedMarketplaces, existingMarketplaces)) logger?.warn(`Writing AugmentCode \`recommendedMarketplaces\` (${recommendedMarketplaces.map(quoteValueForWarning).join(", ")}): Auggie prompts everyone who opens this workspace to install these plugin marketplaces.`);
+			if (recommendedMarketplaces.length > 0 && !isDeepStrictEqual(recommendedMarketplaces, existingMarketplaces)) logger?.warn(`Writing AugmentCode \`recommendedMarketplaces\` (${recommendedMarketplaces.map(quoteValueForWarning).join(", ")}): Auggie 0.x prompts everyone who opens this workspace to install these plugin marketplaces (Auggie 1.x no longer reads this key).`);
 			warnAboutRemovedPluginIds({
 				key: "recommendedMarketplaces",
 				removed: (existingMarketplaces ?? []).filter((marketplace) => !recommendedMarketplaces.includes(marketplace)),
@@ -81189,12 +81703,12 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 			const regex = entry.shellInputRegex;
 			if (isShellRegexRoundtrippable(regex)) pattern = shellRegexToGlob(regex);
 			else {
-				if (action !== "deny" && !canApproximateShellRegexWithoutWidening(regex)) {
-					logger?.warn(`AugmentCode permissions: skipping ${action} entry for tool '${entry.toolName}': shellInputRegex '${regex}' uses a quantifier or a literal '*' / '?' that a glob cannot express, and converting it would widen the rule. The entry is not imported.`);
+				if (action === "allow" && !canApproximateShellRegexWithoutWidening(regex)) {
+					logger?.warn(`AugmentCode permissions: skipping allow entry for tool '${entry.toolName}': shellInputRegex '${regex}' uses a quantifier or a literal '*' / '?' that a glob cannot express, and converting it would widen the rule. The entry is not imported.`);
 					continue;
 				}
-				if (action === "deny") {
-					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as the catch-all '*' pattern (fail-closed) so the deny rule cannot be silently narrowed on regenerate.`);
+				if (action !== "allow") {
+					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing the ${action} rule as the catch-all '*' pattern (fail-closed) so it cannot be silently narrowed on regenerate.`);
 					pattern = "*";
 				} else {
 					pattern = shellRegexToGlob(regex);
@@ -81280,6 +81794,62 @@ function classifyPattern(pattern, bareStarIsWildcard) {
 	};
 	return { kind: "literal" };
 }
+/** The trimmed spellings of the literal (prefix) deny entries, minus the bare wildcard. */
+function collectLiteralDenyStems({ rules, bareStarIsWildcard }) {
+	const stems = /* @__PURE__ */ new Set();
+	for (const [pattern, action] of Object.entries(rules)) {
+		if (action !== "deny" || pattern === "*") continue;
+		const stem = pattern.trimEnd();
+		if (stem.length > 0 && classifyPattern(pattern, bareStarIsWildcard).kind === "literal") stems.add(stem);
+	}
+	return stems;
+}
+function isCoveredByLiteralDeny({ pattern, literalDenyStems }) {
+	if (!pattern.endsWith(" *")) return false;
+	const stem = pattern.slice(0, -2).trimEnd();
+	return stem.length > 0 && literalDenyStems.has(stem);
+}
+/**
+* Lower a VS Code style command allow/deny list pair into canonical `bash`
+* rules on import.
+*
+* The native entries are compared as literal command prefixes, while canonical
+* patterns are globs, so a verbatim copy changes their meaning:
+*
+* - A prefix deny such as `curl` blocks `curl https://…` natively but would
+*   only block the exact command `curl` canonically, so a broad allow beside
+*   it would auto-approve what the native config blocked. Each deny that does
+*   not already end in `*` is imported as itself plus `<deny> *`.
+* - An allow holding glob syntax (`npm *`) is literal prefix text natively and
+*   approves almost nothing, but canonically it is a wildcard. Such an allow is
+*   not imported (with a warning) rather than imported wider than it matched.
+*   The Roo Code lineage's bare `*` is a real wildcard natively and is kept.
+*
+* A pattern in both lists imports as `deny`, matching both tools' precedence
+* for identical entries.
+*/
+function importVscodeCommandLists({ allowed, denied, toolLabel, logger, prefixSemantics = "roo-lineage" }) {
+	const isRooLineage = prefixSemantics === "roo-lineage";
+	const rules = {};
+	const skippedAllows = [];
+	for (const pattern of allowed) {
+		if (!(isRooLineage && pattern === "*") && /[*?]/.test(pattern)) {
+			skippedAllows.push(pattern);
+			continue;
+		}
+		rules[pattern] = "allow";
+	}
+	for (const pattern of denied) {
+		rules[pattern] = "deny";
+		const stem = pattern.trimEnd();
+		if (!pattern.endsWith("*") && stem.length > 0) rules[`${stem} *`] = "deny";
+	}
+	if (skippedAllows.length > 0) {
+		const count = skippedAllows.length;
+		warnWithFallback(logger, `${toolLabel}: allow ${pluralize(count, "pattern", "patterns")} ${formatPatterns(skippedAllows)} ${pluralize(count, "was", "were")} not imported. ${toolLabel} compares ${pluralize(count, "it", "them")} as literal command prefix text, while a rulesync pattern is a glob, so importing ${pluralize(count, "it", "them")} would approve more commands than the native config does.` + (isRooLineage ? ` Only a bare "*" is a wildcard there.` : ""));
+	}
+	return rules;
+}
 function pluralize(count, singular, plural) {
 	return count === 1 ? singular : plural;
 }
@@ -81374,8 +81944,16 @@ function buildVscodeCommandLists({ rules, toolLabel, logger, prefixSemantics = "
 	const matcherAllows = [];
 	const widenedDenies = [];
 	const inertDenies = [];
+	const literalDenyStems = collectLiteralDenyStems({
+		rules,
+		bareStarIsWildcard: isRooLineage
+	});
 	for (const [pattern, action] of Object.entries(rules)) {
 		if (action !== "allow" && action !== "deny") continue;
+		if (action === "deny" && isCoveredByLiteralDeny({
+			pattern,
+			literalDenyStems
+		})) continue;
 		const shape = classifyPattern(pattern, isRooLineage);
 		if (action === "allow") {
 			allowed.push(pattern);
@@ -81738,16 +82316,20 @@ var BobPermissions = class BobPermissions extends ToolPermissions {
 			validate: true
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const settings = parseBobSettings({
 			fileContent: this.getFileContent(),
 			filePath: join(this.getRelativeDirPath(), this.getRelativeFilePath())
 		});
 		const approval = settings[APPROVAL_KEY$1];
 		const entry = (isPlainObject(approval) && Array.isArray(approval.allowedExecutors) ? approval.allowedExecutors : []).find(isExecuteCommandEntry);
-		const rules = {};
-		for (const pattern of toStringArray$1(entry?.approvedCommands)) rules[pattern] = "allow";
-		for (const pattern of toStringArray$1(entry?.deniedCommands)) rules[pattern] = "deny";
+		const rules = importVscodeCommandLists({
+			allowed: toStringArray$1(entry?.approvedCommands),
+			denied: toStringArray$1(entry?.deniedCommands),
+			toolLabel: TOOL_LABEL,
+			logger,
+			prefixSemantics: "documented-prefix"
+		});
 		const permission = {};
 		if (Object.keys(rules).length > 0) permission[SHELL_PERMISSION_CATEGORY] = rules;
 		const bob = readBobOverride(settings);
@@ -85511,7 +86093,7 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 	const patch = {};
 	const allowed = new Set(CODEXCLI_OVERRIDE_KEYS);
 	for (const [key, value] of Object.entries(override ?? {})) {
-		if (key === "base_permission_profile" || key === "git_write_rules") continue;
+		if (key === "base_permission_profile" || key === "git_write_rules" || key === "bash_canonical_matching") continue;
 		if (!allowed.has(key)) {
 			logger?.warn(`Codex CLI permission override key "${key}" is not managed and was skipped. "permissions"/"default_permissions" are owned by the canonical permission model and "mcp_servers" gating by the MCP feature.`);
 			continue;
@@ -85800,6 +86382,7 @@ function stripTrailingSlash(pattern) {
 function buildCodexBashRulesContent({ config, logger }) {
 	const bashRules = bashRulesHonoringAllTools(config.permission);
 	const entries = Object.entries(bashRules);
+	const canonicalMatching = config.codexcli?.bash_canonical_matching === true;
 	const header = ["# Generated by Rulesync from .rulesync/permissions.jsonc (permission.bash)", "# https://developers.openai.com/codex/rules"];
 	if (entries.length === 0) return [...header, "# No bash permission rules were configured."].join("\n");
 	const ruleBlocks = entries.map(([pattern, action]) => {
@@ -85818,6 +86401,7 @@ function buildCodexBashRulesContent({ config, logger }) {
 			`    pattern = [${serializedTokens}],`,
 			`    decision = ${JSON.stringify(decision)},`,
 			`    justification = ${JSON.stringify(`Generated from Rulesync permission.bash: ${pattern}`)},`,
+			...canonicalMatching && decision !== "allow" ? ["    canonical_matching = True,"] : [],
 			")"
 		].join("\n");
 	}).filter((block) => block !== null);
@@ -87402,9 +87986,126 @@ function toCanonicalToolName$5(crushName) {
 function isMcpToolName(crushName) {
 	return crushName.startsWith(MCP_CRUSH_PREFIX) && crushName.length > 4;
 }
+const CRUSH_COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
+	"env",
+	"nohup",
+	"nice",
+	"timeout"
+]);
+const CRUSH_COMMAND_PREFIXES = [...CRUSH_COMMAND_WRAPPERS, "time"];
+const CRUSH_COMMAND_NAME = /^[a-z0-9_][a-z0-9_.+-]*$/;
+const CRUSH_COMMAND_ARGUMENT = /^[A-Za-z0-9_@%+=:,./-]+$/;
+const CRUSH_COMMAND_NAME_SUFFIXES = [
+	".exe",
+	".bat",
+	".cmd"
+];
+function isCrushCommandName(name) {
+	return CRUSH_COMMAND_NAME.test(name) && !CRUSH_COMMAND_NAME_SUFFIXES.some((suffix) => name.endsWith(suffix)) && !isPrototypePollutionKey(name);
+}
+/**
+* Reduce a command name the way Crush matches it (`shell.NormalizeCommandName`):
+* trimmed, without its directory, lower-cased, and without a Windows
+* executable suffix.
+*/
+function normalizeCrushCommandName(raw) {
+	const base = (raw.trim().split(/[\\/]/).at(-1) ?? "").toLowerCase();
+	const suffix = CRUSH_COMMAND_NAME_SUFFIXES.find((candidate) => base.length > candidate.length && base.endsWith(candidate));
+	return suffix === void 0 ? base : base.slice(0, -suffix.length);
+}
+/**
+* Whether a canonical pattern is a literal command line that a Crush
+* `safe_commands` entry reproduces exactly: Crush matches an entry only when
+* the command is written with exactly those tokens, no extra arguments and no
+* flags, which is what a wildcard-free glob means. A leading wrapper is
+* refused, since Crush would resolve it away and approve the bare command.
+*/
+function isExactCrushCommandLine(pattern) {
+	const [name, ...args] = pattern.split(" ");
+	return name !== void 0 && isCrushCommandName(name) && !CRUSH_COMMAND_WRAPPERS.has(name) && args.every((arg) => CRUSH_COMMAND_ARGUMENT.test(arg));
+}
+/**
+* The command name a canonical `<name>` / `<name> *` pattern names as a
+* whole, i.e. the `blocked_commands` entry for it, or undefined.
+*/
+function wholeCommandName(pattern) {
+	const name = pattern.endsWith(" *") ? pattern.slice(0, -2) : pattern;
+	return isCrushCommandName(name) ? name : void 0;
+}
+/**
+* The line a Crush `safe_commands` entry effectively stands for, in canonical
+* form (whitespace collapsed, command name normalized), or undefined when the
+* entry has no exact canonical spelling (wildcards, quoting, a wrapper, ...).
+*/
+function effectiveSafeCommandLine(entry) {
+	const [name, ...args] = entry.trim().split(/\s+/);
+	if (name === void 0 || name === "") return void 0;
+	const line = [normalizeCrushCommandName(name), ...args].join(" ");
+	return isExactCrushCommandLine(line) ? line : void 0;
+}
+/**
+* A restriction pattern with its command word reduced the way Crush reduces a
+* wrapper's name before peeling it (`shell.NormalizeCommandName`): any
+* directory dropped (`./nice`, `bin\env.exe`, `/usr/bin/env`), lower-cased,
+* and without a Windows executable suffix. A `*` in the command word may
+* stand for a directory and part of a name, so when what follows it is the
+* tail of a wrapper name, everything before it collapses into `*`
+* (`b*nice` -> `*nice`, `/u*v` -> `*v`; `rm*` is left alone). The rest of the pattern is lower-cased as well, for a
+* nested wrapper spelled in another case. Used only to compare against the
+* wrapper spellings of a safe line, where it can only withhold more.
+*/
+function normalizeRestrictionCommandWord(pattern) {
+	const space = pattern.indexOf(" ");
+	let head = space < 0 ? pattern : pattern.slice(0, space);
+	const rest = space < 0 ? "" : pattern.slice(space);
+	head = normalizeCrushCommandName(head);
+	const star = head.lastIndexOf("*");
+	const tail = head.slice(star + 1);
+	if (star > 0 && tail !== "" && CRUSH_COMMAND_PREFIXES.some((prefix) => prefix.endsWith(tail))) head = `*${tail}`;
+	return `${head}${rest.toLowerCase()}`;
+}
+/**
+* Build the test for a `safe_commands` line: which canonical `deny`/`ask`
+* rules govern a command Crush would approve through it? Besides the line
+* itself, Crush approves it followed by `--` and behind a wrapper (or the
+* `time` keyword), whose name it normalizes (`./nice`, `/usr/bin/env`, `NICE`,
+* `nohup.exe`). The line and its wrapper spellings are compared against the
+* restrictions as written, and the wrapper spellings also against the
+* restrictions with their command word normalized the same way — which keeps
+* an unrelated `rm *` from withholding the line, as a leading wildcard on the
+* spelling would. Canonically the stricter rule wins whatever its width
+* (`deny > ask > allow`), so any overlap withholds the line.
+*
+* Crush also approves a line composed with other safe lines (`&&`, `||`, `|`,
+* `;`, a parenthesized group); those compositions are not compared, the way
+* other tools' per-subcommand matching treats an allowed command.
+*/
+function createSafeCommandShadowTest(permission) {
+	const restrictions = collectShellCommandRules(permission).rules.filter(({ action }) => action !== "allow");
+	const test = createShadowingRestrictionsTest(restrictions);
+	const normalized = restrictions.map((rule) => ({
+		...rule,
+		pattern: normalizeRestrictionCommandWord(rule.pattern)
+	}));
+	const testNormalized = createShadowingRestrictionsTest(normalized);
+	const originalOf = /* @__PURE__ */ new Map();
+	normalized.forEach((rule, index) => {
+		const original = restrictions[index]?.pattern;
+		if (original !== void 0 && !originalOf.has(rule.pattern)) originalOf.set(rule.pattern, original);
+	});
+	const withSeparator = (spellings) => spellings.flatMap((spelling) => [spelling, `${spelling} --*`]);
+	const wrapped = (base) => CRUSH_COMMAND_PREFIXES.map((prefix) => `${prefix}*${base}`);
+	return (line) => uniq$1([...withSeparator([line, ...wrapped(line)]).flatMap((spelling) => test(spelling)), ...withSeparator(wrapped(line.toLowerCase())).flatMap((spelling) => testNormalized(spelling).map((pattern) => originalOf.get(pattern) ?? pattern))]);
+}
 function uniq$1(values) {
 	return [...new Set(values)];
 }
+function stringList(value) {
+	return isStringArray(value) ? value : [];
+}
+function listOrUndefined(values) {
+	return values.length > 0 ? values : void 0;
+}
 /**
 * Permissions adapter for Crush.
 *
@@ -87426,8 +88127,24 @@ function uniq$1(values) {
 *     `webfetch` -> `fetch`, `mcp__<server>__<tool>` -> `mcp_<server>_<tool>`;
 *     any other category passes through verbatim.
 *
-* A pattern-specific rule cannot be expressed and is reported and skipped.
-* Because Crush cannot narrow an allowed tool, a category's catch-all `allow`
+* Crush v0.100.0+ also carries two command lists, which the `bash` category's
+* pattern rules map onto (see `convertBashCommandRules`):
+*   - `permissions.safe_commands`: exact command lines that skip the prompt
+*     (no extra arguments, no flags) <- an `allow` on a literal command line
+*     that no canonical `deny`/`ask` overlaps.
+*   - `permissions.blocked_commands`: command names added to the dangerous
+*     list <- a `deny` on `<name>` or `<name> *`. Not a full deny: a direct
+*     invocation is still prompted for (and auto-approved in yolo mode or
+*     through `allowed_tools: ["bash"]`); only the forms Crush would not
+*     prompt for (its read-only commands, `safe_commands`) and indirect
+*     invocations are refused at exec time. An `ask` is not written there,
+*     since it would turn the read-only forms into a refusal.
+* `permissions.allowed_commands` only drops names from the dangerous list (the
+* commands keep prompting), so it has no canonical counterpart and is left
+* untouched.
+*
+* Any other pattern-specific rule cannot be expressed and is reported and
+* skipped. Because Crush cannot narrow an allowed tool, a category's catch-all `allow`
 * is not written while the same category carries a pattern-specific `deny` or
 * `ask`: the tool keeps prompting (fail closed) rather than being widened to
 * everything. The all-tools `*` category is mirrored onto `bash` by
@@ -87491,7 +88208,12 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 		const existingContent = location.fileContent ?? "";
 		warnCrushTwinLeftovers({
 			location,
-			ownedPaths: [[CRUSH_PERMISSIONS_KEY, CRUSH_ALLOWED_TOOLS_KEY], [CRUSH_OPTIONS_KEY, CRUSH_DISABLED_TOOLS_KEY]],
+			ownedPaths: [
+				[CRUSH_PERMISSIONS_KEY, CRUSH_ALLOWED_TOOLS_KEY],
+				[CRUSH_PERMISSIONS_KEY, CRUSH_SAFE_COMMANDS_KEY],
+				[CRUSH_PERMISSIONS_KEY, CRUSH_BLOCKED_COMMANDS_KEY],
+				[CRUSH_OPTIONS_KEY, CRUSH_DISABLED_TOOLS_KEY]
+			],
 			logger
 		});
 		const existing = parseCrushConfig(existingContent, location.filePath);
@@ -87503,12 +88225,22 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 			logger
 		});
 		const managedToolNames = managedCrushToolNames(config);
+		const commands = rebuildCrushCommandLists({
+			config,
+			existingPermissions,
+			logger
+		});
 		const preservedAllowed = (isStringArray(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
 		const preservedDisabled = (isStringArray(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
 		const allowedList = uniq$1([...preservedAllowed, ...generated.allowed]);
 		const disabledList = uniq$1([...preservedDisabled, ...generated.disabled]);
+		const permissionsHasContent = allowedList.length > 0 || commands.safe.length > 0 || commands.blocked.length > 0;
 		const patch = {};
-		if (allowedList.length > 0 || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = { [CRUSH_ALLOWED_TOOLS_KEY]: allowedList.length > 0 ? allowedList : void 0 };
+		if (permissionsHasContent || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = {
+			[CRUSH_ALLOWED_TOOLS_KEY]: listOrUndefined(allowedList),
+			[CRUSH_SAFE_COMMANDS_KEY]: listOrUndefined(commands.safe),
+			[CRUSH_BLOCKED_COMMANDS_KEY]: listOrUndefined(commands.blocked)
+		};
 		if (disabledList.length > 0 || existingOptions !== void 0) patch[CRUSH_OPTIONS_KEY] = { [CRUSH_DISABLED_TOOLS_KEY]: disabledList.length > 0 ? disabledList : void 0 };
 		return new CrushPermissions({
 			outputRoot,
@@ -87526,17 +88258,79 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 			global
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const permissions = isRecord(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
 		const options = toRecord(this.json[CRUSH_OPTIONS_KEY]);
 		const rulesyncConfig = convertCrushListsToRulesync({
-			allowed: isStringArray(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
-			disabled: isStringArray(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+			allowed: stringList(permissions[CRUSH_ALLOWED_TOOLS_KEY]),
+			disabled: stringList(options[CRUSH_DISABLED_TOOLS_KEY]),
+			safe: stringList(permissions[CRUSH_SAFE_COMMANDS_KEY]),
+			blocked: stringList(permissions[CRUSH_BLOCKED_COMMANDS_KEY]),
+			logger
 		});
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 };
 /**
+* The `safe_commands` / `blocked_commands` lists a generate writes: the
+* existing entries rulesync keeps, followed by the ones derived from the
+* canonical `bash` rules. Existing `blocked_commands` entries are all kept:
+* rulesync cannot tell its own from hand-written ones, and dropping one only
+* ever loosens. A derived blocked name that is the command of a written safe
+* line is withheld, since Crush would refuse that line at exec time.
+*/
+function rebuildCrushCommandLists({ config, existingPermissions, logger }) {
+	const bashRules = honorAllToolsOnBash(config.permission)["bash"] ?? {};
+	const shadowTest = createSafeCommandShadowTest(config.permission);
+	const generated = convertBashCommandRules({
+		bashRules,
+		shadowTest,
+		logger
+	});
+	const safe = uniq$1([...preserveSafeCommands({
+		existing: stringList(existingPermissions?.[CRUSH_SAFE_COMMANDS_KEY]),
+		bashRules,
+		shadowTest,
+		logger
+	}), ...generated.safe]);
+	const safeCommandNames = new Set(safe.flatMap((entry) => {
+		const name = entry.trim().split(/\s+/)[0];
+		return name === void 0 || name === "" ? [] : [normalizeCrushCommandName(name)];
+	}));
+	const blocked = generated.blocked.filter((name) => {
+		if (!safeCommandNames.has(name)) return true;
+		logger?.warn(`The "deny" rule for "bash" on ${quoteValueForWarning(name)} is not added to permissions.blocked_commands because Crush would then refuse the allowed permissions.safe_commands line(s) for that command; Crush keeps prompting for it.`);
+		return false;
+	});
+	const existingBlocked = stringList(existingPermissions?.[CRUSH_BLOCKED_COMMANDS_KEY]);
+	for (const entry of existingBlocked) {
+		if (!safeCommandNames.has(normalizeCrushCommandName(entry))) continue;
+		logger?.warn(`The existing permissions.blocked_commands entry ${quoteValueForWarning(entry)} is kept, but Crush will refuse the permissions.safe_commands line(s) for that command at exec time; remove one of them by hand.`);
+	}
+	return {
+		safe,
+		blocked: uniq$1([...existingBlocked, ...blocked])
+	};
+}
+/**
+* The existing `safe_commands` entries a generate keeps: those the canonical
+* `bash` rules do not spell out themselves (an entry they do spell is rebuilt
+* from them), minus any entry a canonical `deny`/`ask` governs, which would
+* otherwise auto-approve what the config restricts. An entry whose exact
+* meaning cannot be read is dropped whenever the config restricts anything.
+*/
+function preserveSafeCommands({ existing, bashRules, shadowTest, logger }) {
+	const managedLines = new Set(Object.keys(bashRules));
+	const restricts = shadowTest("*").length > 0;
+	return existing.filter((entry) => {
+		if (managedLines.has(entry)) return false;
+		const line = effectiveSafeCommandLine(entry);
+		const shadowed = line === void 0 ? restricts : shadowTest(line).length > 0;
+		if (shadowed) logger?.warn(`Crush permissions.safe_commands entry ${quoteValueForWarning(entry)} was removed because a canonical deny/ask rule may cover the commands it approves.`);
+		return !shadowed;
+	});
+}
+/**
 * The Crush tool names the canonical config manages, i.e. the names its
 * categories map to. Entries naming any other tool are the user's and survive
 * a generate. The all-tools `*` category names no Crush tool of its own.
@@ -87561,7 +88355,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 			catchAllAction = action;
 			continue;
 		}
-		logger?.warn(`Crush permissions are tool-wide (no argument patterns), so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
+		if (category !== "bash") logger?.warn(`Crush permissions are tool-wide (no argument patterns), so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 		if (action !== "allow") restricted = true;
 	}
 	if (catchAllAction === "allow" && restricted) {
@@ -87612,11 +88406,71 @@ function convertRulesyncToCrushLists({ config, logger }) {
 	};
 }
 /**
+* Map the `bash` category's pattern rules onto Crush's command lists:
+*   - `allow` on a literal command line -> `permissions.safe_commands`, which
+*     Crush matches exactly (no extra arguments, no flags). It is withheld
+*     when a canonical `deny`/`ask` governs any command Crush would approve
+*     through it.
+*   - `deny` on `<name>` / `<name> *` -> `permissions.blocked_commands`, the
+*     strictest Crush can say about a single command: a direct invocation is
+*     still prompted for, while the forms Crush would not prompt for and
+*     indirect invocations are refused at exec time. Reported, since it is
+*     not a full deny.
+*   - Anything else is reported and skipped. A pattern `ask` is never written
+*     to `blocked_commands`, which would refuse the command's read-only forms
+*     outright, and an `allow` with a wildcard has no list that auto-approves
+*     it.
+*/
+function convertBashCommandRules({ bashRules, shadowTest, logger }) {
+	const lists = {
+		safe: [],
+		blocked: []
+	};
+	for (const [rawPattern, action] of Object.entries(bashRules)) {
+		if (isPrototypePollutionKey(rawPattern)) continue;
+		const pattern = normalizeCatchAllPattern(rawPattern);
+		if (pattern === "*") continue;
+		const quoted = quoteValueForWarning(pattern);
+		if (action === "allow") {
+			if (!isExactCrushCommandLine(pattern)) {
+				logger?.warn(`Crush auto-approves a command only as an exact line in permissions.safe_commands (no wildcards or shell syntax), so the "allow" rule for "bash" (pattern ${quoted}) was skipped; Crush keeps prompting for it.`);
+				continue;
+			}
+			const shadows = shadowTest(pattern);
+			if (shadows.length > 0) {
+				logger?.warn(`The "allow" rule for "bash" (pattern ${quoted}) is not added to permissions.safe_commands because the deny/ask rule(s) ${shadows.map(quoteValueForWarning).join(", ")} also cover commands Crush would approve through it; Crush keeps prompting for it.`);
+				continue;
+			}
+			lists.safe.push(pattern);
+			continue;
+		}
+		if (action === "ask") {
+			logger?.warn(`Crush has no per-command prompt list (permissions.blocked_commands would refuse the command's read-only forms outright), so the "ask" rule for "bash" (pattern ${quoted}) was skipped; Crush still prompts for it unless it is one of Crush's built-in read-only commands.`);
+			continue;
+		}
+		const name = wholeCommandName(pattern);
+		if (name !== void 0 && CRUSH_COMMAND_PREFIXES.includes(name)) {
+			logger?.warn(`Crush resolves the command wrapper or keyword ${quoteValueForWarning(name)} before matching permissions.blocked_commands, so an entry for it would have no effect; the "deny" rule for "bash" (pattern ${quoted}) was skipped and Crush still prompts for it.`);
+			continue;
+		}
+		if (name === void 0) {
+			logger?.warn(`Crush can only restrict a whole command (permissions.blocked_commands), so the "deny" rule for "bash" (pattern ${quoted}) was skipped; Crush still prompts for it unless it is one of Crush's built-in read-only commands.`);
+			continue;
+		}
+		logger?.warn(`The "deny" rule for "bash" (pattern ${quoted}) is written as permissions.blocked_commands entry ${quoteValueForWarning(name)}, which is not a full deny: Crush still prompts for a direct invocation (and runs it unprompted in yolo mode or with "bash" in allowed_tools).`);
+		lists.blocked.push(name);
+	}
+	return {
+		safe: uniq$1(lists.safe),
+		blocked: uniq$1(lists.blocked)
+	};
+}
+/**
 * Convert Crush's two tool lists back into a rulesync config. A `tool:action`
 * entry scopes an allow to one action of a tool, which the canonical model
 * cannot express, so it is left out rather than widened to the whole tool.
 */
-function convertCrushListsToRulesync({ allowed, disabled }) {
+function convertCrushListsToRulesync({ allowed, disabled, safe, blocked, logger }) {
 	const permission = {};
 	const bucketFor = (category) => {
 		const own = lookupOwn({
@@ -87632,6 +88486,29 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
 		bucketFor(toCanonicalToolName$5(entry))["*"] = "deny";
 	}
+	const setBashRule = (pattern, action) => {
+		const bucket = bucketFor(SHELL_PERMISSION_CATEGORY);
+		if (!Object.hasOwn(bucket, pattern)) bucket[pattern] = action;
+	};
+	for (const entry of blocked) {
+		const name = normalizeCrushCommandName(entry);
+		if (name === "") continue;
+		if (!isCrushCommandName(name)) {
+			logger?.warn(`Crush permissions.blocked_commands entry ${quoteValueForWarning(entry)} is not a plain command name, so it was not imported.`);
+			continue;
+		}
+		setBashRule(name, "deny");
+		setBashRule(`${name} *`, "deny");
+	}
+	for (const entry of safe) {
+		if (entry.trim() === "") continue;
+		const line = effectiveSafeCommandLine(entry);
+		if (line === void 0) {
+			logger?.warn(`Crush permissions.safe_commands entry ${quoteValueForWarning(entry)} has no exact rulesync pattern (wildcards, shell syntax or a command wrapper), so it was not imported.`);
+			continue;
+		}
+		setBashRule(line, "allow");
+	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
 		bucketFor(toCanonicalToolName$5(entry))["*"] ??= "allow";
@@ -89011,8 +89888,8 @@ const DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS = [
 * In global mode the config file is shared with the hooks (`hooks`) feature
 * (MCP moved to the dedicated mcp_config.json in v3000.3), so reads and writes
 * merge into the existing JSON and the file is never deleted; only the keys
-* this feature manages are rewritten — `permissions`, plus `sandbox` in global
-* mode and the plugin governance lists (`requiredPlugins` / `optionalPlugins` /
+* this feature manages are rewritten — `permissions`, plus `sandbox` and
+* `permission_mode` in global mode and the plugin governance lists (`requiredPlugins` / `optionalPlugins` /
 * `forbiddenPlugins`) in project mode when the `devin` override authors them.
 *
 * The sibling `sandbox` block — which decides what a permitted command may
@@ -89120,6 +89997,12 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 				});
 			} else if (Object.keys(authoredSandboxRecord).length > 0) logger?.warn("Devin reads 'sandbox' from the user config only, so the 'devin.sandbox' override was dropped from the project config. Generate with --global to author it.");
 		}
+		applyPermissionModeOverride({
+			permissionMode: config.devin?.permission_mode,
+			patch,
+			global,
+			logger
+		});
 		applyPluginGovernanceOverride({
 			override: config.devin,
 			settings,
@@ -89163,6 +90046,12 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			if (DEVIN_PLUGIN_GOVERNANCE_SCHEMAS[key].safeParse(value).success) devinOverride[key] = value;
 			else logger?.warn(`Skipped Devin \`${key}\` on import: ${key === "forbiddenPlugins" ? "expected an array of strings" : "expected an array of plugin sources (strings or objects)"}.`);
 		}
+		const permissionMode = importPermissionMode({
+			value: settings.permission_mode,
+			isGlobalFile: toPosixPath(this.getRelativeDirPath()) === toPosixPath(DevinPermissions.getSettablePaths({ global: true }).relativeDirPath),
+			logger
+		});
+		if (permissionMode !== void 0) devinOverride.permission_mode = permissionMode;
 		const result = { ...config };
 		if (Object.keys(devinOverride).length > 0) result.devin = devinOverride;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
@@ -89179,6 +90068,48 @@ const DEVIN_PLUGIN_GOVERNANCE_KEYS = [
 	"forbiddenPlugins"
 ];
 /**
+* Decide what an imported `permission_mode` contributes to the `devin`
+* override. It is lifted from the user config only: unlike `sandbox`, a
+* project value Devin ignores is skipped with a warning rather than surfaced,
+* so it cannot slip into a `--global` generate later. `null` is Devin's
+* spelling of the default and carries nothing to keep; any other value the
+* override schema would reject is dropped with a warning so the next generate
+* cannot fail. `dangerous` is lifted but named, as on generate.
+*/
+function importPermissionMode({ value, isGlobalFile, logger }) {
+	if (value === void 0 || value === null) return void 0;
+	if (!isGlobalFile) {
+		logger?.warn("Skipped Devin `permission_mode` on import: Devin reads it from the user config only, so the project config's value has no effect. Import with --global to lift it.");
+		return;
+	}
+	const parsed = DevinPermissionModeSchema.safeParse(value);
+	if (!parsed.success) {
+		logger?.warn(`Skipped Devin \`permission_mode\` ${quoteValueForWarning(value)} on import: expected one of ${DevinPermissionModeSchema.options.join(", ")}.`);
+		return;
+	}
+	if (parsed.data === "dangerous") logger?.warn("Imported Devin `permission_mode: \"dangerous\"`: every new local session starts with all permission prompts bypassed, and the next --global generate writes it back.");
+	return parsed.data;
+}
+/**
+* Patch the `permission_mode` the `devin` override authors into the user
+* `config.json`. It sets the mode new local sessions start in, and Devin reads
+* it from the user config only, so in project mode it is dropped with a
+* warning. It is only ever written as authored — never derived from the
+* canonical rules — and `dangerous` is named in a warning, because every new
+* session then starts with all permission prompts bypassed.
+*
+* @see https://docs.devin.ai/cli/reference/configuration/config-file
+*/
+function applyPermissionModeOverride({ permissionMode, patch, global, logger }) {
+	if (permissionMode === void 0) return;
+	if (!global) {
+		logger?.warn("Devin reads 'permission_mode' from the user config only, so the 'devin.permission_mode' override was dropped from the project config. Generate with --global to author it.");
+		return;
+	}
+	patch.permission_mode = permissionMode;
+	if (permissionMode === "dangerous") logger?.warn("Writing Devin `permission_mode: \"dangerous\"` to the user config: every new local session then starts with all permission prompts bypassed.");
+}
+/**
 * Patch the plugin governance lists the `devin` override authors into the
 * project `.devin/config.json`. Each authored list replaces the file's list
 * whole; a list it does not author is left as the file holds it. Devin reads these
@@ -95168,7 +96099,8 @@ function convertQwenToRulesyncPermissions(params) {
 *
 * Reasonix matches a rule's tool exactly against its registered tools, which
 * are snake_case (`read_file`, `write_file`, `grep`, `glob`, `web_fetch`,
-* `web_search`, `notebook_edit`, `task`). Only `Bash`, `Edit` (every file
+* `web_search`, `notebook_edit`, and `task` up to v2.57.x / `spawn_agents` from
+* v2.58.0). Only `Bash`, `Edit` (every file
 * writer: `write_file`, `edit_file`, `multi_edit`, `notebook_edit`, ...),
 * `Browser` and `Computer` are Claude-Code-style family aliases
 * (`canonicalRuleTool` / `groupOf`), so a `Read(...)` or `Write(...)` rule
@@ -95191,6 +96123,21 @@ const CANONICAL_TO_REASONIX_TOOL_NAMES = {
 	agent: "task"
 };
 /**
+* Reasonix tool names a canonical category writes beside its primary name, for
+* a tool Reasonix renamed. studio-v2.58.0 replaced the `task` delegation family
+* with `spawn_agents` (commit ad2c96347), while the 1.x line and v2 up to
+* v2.57.x still register `task`. When Reasonix loads the config file it checks
+* only a rule's syntax: a rule naming a tool the running build lacks matches
+* nothing (v2.34.0+ reports it as dormant) and is not rejected. (The v2 Web UI
+* permissions editor refuses to newly add such a rule with `ErrUnknownTool`,
+* but keeps the ones already in the file.) So writing both names keeps an
+* `agent` rule in force on old and new builds alike. Both names are read back
+* to the same category.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.58.0/internal/runtime/delegation/spawn.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.57.0/internal/runtime/delegation/task.go
+*/
+const CANONICAL_TO_EXTRA_REASONIX_TOOL_NAMES = { agent: ["spawn_agents"] };
+/**
 * The Claude-Code-style spellings rulesync emitted before it followed the
 * Reasonix tool vocabulary. None of them reaches a Reasonix tool, so they are
 * read back on import (a file generated by an older rulesync still imports)
@@ -95213,7 +96160,8 @@ const CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES = {
 */
 const REASONIX_TO_CANONICAL_TOOL_NAMES = {
 	...invertRecord(CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES),
-	...invertRecord(CANONICAL_TO_REASONIX_TOOL_NAMES)
+	...invertRecord(CANONICAL_TO_REASONIX_TOOL_NAMES),
+	...Object.fromEntries(Object.entries(CANONICAL_TO_EXTRA_REASONIX_TOOL_NAMES).flatMap(([canonical, names]) => names.map((name) => [name, canonical])))
 };
 /** Every Reasonix tool name a canonical category owns on generate. */
 function reasonixToolNamesOf(canonical) {
@@ -95221,14 +96169,20 @@ function reasonixToolNamesOf(canonical) {
 		record: CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES,
 		key: canonical
 	});
-	const current = toReasonixToolName(canonical);
-	return legacy === void 0 ? [current] : [current, legacy];
+	const current = toReasonixToolNames(canonical);
+	return legacy === void 0 ? current : [...current, legacy];
 }
-function toReasonixToolName(canonical) {
-	return lookupOwn({
+/** The Reasonix tool names a canonical category's rules are written under. */
+function toReasonixToolNames(canonical) {
+	const primary = lookupOwn({
 		record: CANONICAL_TO_REASONIX_TOOL_NAMES,
 		key: canonical
 	}) ?? canonical;
+	const extra = lookupOwn({
+		record: CANONICAL_TO_EXTRA_REASONIX_TOOL_NAMES,
+		key: canonical
+	});
+	return extra === void 0 ? [primary] : [primary, ...extra];
 }
 function toCanonicalToolName$2(reasonixName) {
 	return lookupOwn({
@@ -95636,6 +96590,17 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			});
 			if (droppedReadDenyEntries.length > 0) logger.warn(`Permissions feature manages '${REASONIX_READ_TOOL_NAME}' tool and will overwrite ${droppedReadDenyEntries.length} existing read deny entries (possibly from ignore feature). Permissions take precedence.`);
 		}
+		warnOnLoosenedAgentEntries({
+			existingPermissions,
+			managedToolNames,
+			generated: {
+				allow: [...allow, ...rawAllow],
+				ask: [...ask, ...rawAsk],
+				deny: [...deny, ...rawDeny]
+			},
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		});
 		const mergedPermissions = { ...existingPermissions };
 		setOrDeleteEntries(mergedPermissions, "allow", [
 			...preservedAllow,
@@ -95811,6 +96776,55 @@ function preserveExistingEntries({ existingPermissions, managedToolNames, rawOwn
 		deny
 	};
 }
+/**
+* `spawn_agents` became a managed name with Reasonix v2.58.0 support, so a
+* stricter rule the user wrote for it by hand (e.g. a v2.58-era
+* `deny = ["spawn_agents"]` next to an older `agent: allow` source) would be
+* silently replaced by a looser one. Name every such loosening.
+*/
+function warnOnLoosenedAgentEntries({ existingPermissions, managedToolNames, generated, relativeFilePath, logger }) {
+	if (!logger || !managedToolNames.has("spawn_agents")) return;
+	const loosened = findLoosenedEntries({
+		existingPermissions,
+		toolNames: new Set(reasonixToolNamesOf("agent")),
+		generated
+	});
+	if (loosened.length === 0) return;
+	logger.warn(`Permissions feature manages the Reasonix delegation tools ('task', 'spawn_agents') through the 'agent' category and will replace ${loosened.length} stricter existing entries in ${relativeFilePath}: ${loosened.join(", ")}. To keep them, tighten the 'agent' category in ${RULESYNC_RELATIVE_DIR_PATH}/${RULESYNC_PERMISSIONS_FILE_NAME} or move them to 'reasonix.rawDeny' / 'reasonix.rawAsk'.`);
+}
+const PERMISSION_STRICTNESS = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Existing entries for `toolNames` whose action is stricter than the one the
+* generated lists give the same entry, formatted `<list> "<entry>"`. An entry
+* the generated lists drop counts as no stricter than `allow`.
+*/
+function findLoosenedEntries({ existingPermissions, toolNames, generated }) {
+	const generatedStrictness = /* @__PURE__ */ new Map();
+	for (const list of [
+		"allow",
+		"ask",
+		"deny"
+	]) for (const entry of generated[list]) {
+		const key = normalizeToolPatternEntry(entry);
+		generatedStrictness.set(key, Math.max(generatedStrictness.get(key) ?? 0, PERMISSION_STRICTNESS[list]));
+	}
+	const loosened = [];
+	for (const list of ["ask", "deny"]) for (const entry of toStringArray$1(existingPermissions[list])) {
+		if (isReasonixExactCommandEntry(entry)) continue;
+		if (!toolNames.has(parseToolPatternEntry(entry).toolName)) continue;
+		const key = normalizeToolPatternEntry(entry);
+		if ((generatedStrictness.get(key) ?? 0) < PERMISSION_STRICTNESS[list]) loosened.push(`${list} "${entry}"`);
+	}
+	return loosened;
+}
+/** Spell an entry the way rulesync writes it, so `name(*)` equals `name`. */
+function normalizeToolPatternEntry(entry) {
+	return buildToolPatternEntry(parseToolPatternEntry(entry));
+}
 /** Sort, dedupe and set a permissions array key, deleting it when empty. */
 function setOrDeleteEntries(table, key, entries) {
 	const merged = uniq(entries.toSorted());
@@ -95824,22 +96838,19 @@ function convertRulesyncToReasonixPermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		const reasonixToolName = toReasonixToolName(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			const entry = buildToolPatternEntry({
-				toolName: reasonixToolName,
-				pattern
-			});
-			switch (action) {
-				case "allow":
-					allow.push(entry);
-					break;
-				case "ask":
-					ask.push(entry);
-					break;
-				case "deny": deny.push(entry);
-			}
+	for (const [category, rules] of Object.entries(config.permission)) for (const reasonixToolName of toReasonixToolNames(category)) for (const [pattern, action] of Object.entries(rules)) {
+		const entry = buildToolPatternEntry({
+			toolName: reasonixToolName,
+			pattern
+		});
+		switch (action) {
+			case "allow":
+				allow.push(entry);
+				break;
+			case "ask":
+				ask.push(entry);
+				break;
+			case "deny": deny.push(entry);
 		}
 	}
 	return {
@@ -96066,7 +97077,7 @@ var RooPermissions = class extends ToolPermissions {
 			validate: true
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const constructor = this.constructor;
 		let settings;
 		try {
@@ -96080,9 +97091,12 @@ var RooPermissions = class extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse ${constructor.getToolLabel()} VS Code settings in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const rules = {};
-		for (const pattern of toStringArray$1(settings[constructor.getAllowedCommandsKey()])) rules[pattern] = "allow";
-		for (const pattern of toStringArray$1(settings[constructor.getDeniedCommandsKey()])) rules[pattern] = "deny";
+		const rules = importVscodeCommandLists({
+			allowed: toStringArray$1(settings[constructor.getAllowedCommandsKey()]),
+			denied: toStringArray$1(settings[constructor.getDeniedCommandsKey()]),
+			toolLabel: constructor.getToolLabel(),
+			logger
+		});
 		const permission = {};
 		if (Object.keys(rules).length > 0) permission[COMMAND_CATEGORY] = rules;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
@@ -101406,6 +102420,9 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 var PermissionsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	sweepsThroughInRootLinks() {
+		return this.global;
+	}
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, logger }) {
 		super({
 			outputRoot,
@@ -104091,6 +105108,6 @@ const CHECKS_IMPORT_STRATEGY = {
 	missingLabel: "check files",
 	createdLabel: "check files"
 };
-export { RulesyncMcp as $, RULESYNC_USER_CONFIG_DIR_NAME as $n, isRootDirPath as $t, CODEBUDDY_LOCAL_RULE_FILE_NAME as A, CURATED_RULES_FEATURE_SUBDIR as An, resetRunWarningState as At, CLAUDECODE_MEMORIES_DIR_NAME as B, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Bn, assertTreeContainsNoSymlinks as Bt, LETTACODE_DIR as C, ALL_TOOL_TARGETS as Cn, findControlCharacter as Ct, COMMANDCODE_DIR as D, ALL_FEATURES as Dn, fallbackLogger as Dt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as E, ToolTargetSchema as En, WarningCollectingLogger as Et, CODEXCLI_BASH_RULES_FILE_NAME as F, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Fn, PathOutsideRootError as Ft, getLocalSkillDirNames as G, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Gn, ensureDir as Gt, CLAUDECODE_SKILLS_DIR_PATH as H, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Hn, checkPathTraversal as Ht, CODEXCLI_DIR as I, RULESYNC_CONFIG_RELATIVE_FILE_PATH as In, applyFileMode as It, RulesyncSkill as J, RULESYNC_RELATIVE_DIR_PATH as Jn, findFilesByGlobs as Jt, RulesyncSubagent as K, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Kn, fileExists as Kt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as L, RULESYNC_CONFIG_SCHEMA_URL as Ln, assertDirectoryIfExists as Lt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as M, MAX_FILE_SIZE as Mn, CLIError as Mt, caseFoldIdentity as N, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Nn, ErrorCodes as Nt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as O, ALL_FEATURES_WITH_WILDCARD as On, warnOnConflictingFlags as Ot, groupSpellingsByCaseFoldedIdentity as P, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Pn, parseJsonc as Pt, RulesyncPermissions as Q, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Qn, isFileSystemError as Qt, CLAUDECODE_DIR as R, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Rn, assertNoSymlinkBelowRoot as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, mapWithConcurrency as Sn, getSourceTransport as St, FACTORYDROID_DIR as T, PACKAGING_TOOL_TARGETS as Tn, JsonLogger as Tt, findProjectInstructionBudgetFindings as U, RULESYNC_MCP_RELATIVE_FILE_PATH as Un, createTempDirectory as Ut, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as V, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Vn, assertWritablePathInsideRoot as Vt, toInstructionBudgetFile as W, RULESYNC_MCP_SCHEMA_URL as Wn, directoryExists as Wt, RulesyncRule as X, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Xn, getHomeDirectory as Xt, RulesyncSkillFrontmatterSchema as Y, RULESYNC_RULES_RELATIVE_DIR_PATH as Yn, getFileSizeAndExecutableBit as Yt, RulesyncRuleFrontmatterSchema as Z, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Zn, isFileNotFoundError as Zt, SkillsProcessor as _, runWithDirectoryRollback as _n, CONFLICTING_TARGET_PAIRS as _t, convertFromTool as a, pathEscapesRoot as an, hasEnclosingMarkOutsideKeycap as ar, RulesyncCommandFrontmatterSchema as at, REASONIX_LOCAL_RULE_FILE_NAME as b, writeFileBuffer as bn, SourceEntrySchema as bt, ELLIPSIS_WIDTH as c, readFileContentOrNull as cn, stripControlCharactersKeepingLineFeeds as cr, stringifyFrontmatter as ct, McpProcessor as d, removeFile as dn, SHARED_USER_MANAGED_CONFIG_PATHS as dt, isSymlink as en, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as er, RulesyncIgnore as et, IgnoreProcessor as f, removeFileStrict as fn, SKILL_FILE_NAME as ft, SubagentsProcessor as g, resolvedRelativePath as gn, resolveEffectiveInputRoots as gt, RulesProcessor as h, resolvePath as hn, parseConfigFileContent as ht, inspectInputRoots as i, normalizePosixDirPath as in, hasDeceptiveHiddenCharacters as ir, RulesyncCommand as it, AUGMENTCODE_DIR as j, FEATURE_SOURCE_TREE_ENTRIES as jn, withWarnOnceScope as jt, CODEBUDDY_DIR as k, DEPRECATED_FEATURE_REPLACEMENTS as kn, withFallbackLoggerTarget as kt, displayWidthOf as l, removeDirectory as ln, stripControlCharactersKeepingLineFeedsAndTabs as lr, loadYaml as lt, ChecksProcessor as m, removeTempDirectory as mn, mergeInputRootConfigs as mt, formatSourceLoadFailure as n, listFilePathsRecursively as nn, formatError as nr, getRulesyncSourceCandidates as nt, getProcessorRegistryEntry as o, posixRelativePathEscapesRoot as on, quoteForLog as or, RulesyncCheck as ot, HooksProcessor as p, removeFileWithoutFollowingSymlinks as pn, ConfigResolver as pt, RulesyncSubagentFrontmatterSchema as q, RULESYNC_PERMISSIONS_SCHEMA_URL as qn, fileExistsStrict as qt, generate as r, listSubdirectoryNames as rn, truncateText as rr, resolveRulesyncSourceWritePath as rt, parseCommaSeparatedList as s, readFileContent as sn, stripControlCharacters as sr, RulesyncCheckFrontmatterSchema as st, importFromTool as t, listDirectoryEntryNames as tn, formatMegabytes as tr, RulesyncHooks as tt, shortenToWidth as u, removeDirectoryStrict as un, stripHiddenCharacters as ur, isRecord as ut, CRUSH_LOCAL_RULE_FILE_NAME as v, splitPathSegments as vn, ConfigFileSchema as vt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as w, ALL_TOOL_TARGETS_WITH_WILDCARD as wn, ConsoleLogger as wt, QWENCODE_DIR as x, writeFileContent as xn, assertTargetsFeaturesExclusive as xt, CommandsProcessor as y, toPosixPath as yn, GITIGNORE_DESTINATION_KEY as yt, CLAUDECODE_LOCAL_RULE_FILE_NAME as z, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as zn, assertPathResolvesInsideRoot as zt };
+export { RulesyncRule as $, RULESYNC_RULES_RELATIVE_DIR_PATH as $n, getFileSizeAndExecutableBit as $t, CODEBUDDY_LOCAL_RULE_FILE_NAME as A, ToolTargetSchema as An, fallbackLogger as At, CLAUDECODE_LOCAL_RULE_FILE_NAME as B, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Bn, assertDirectoryIfExists as Bt, LETTACODE_DIR as C, toPosixPath as Cn, SourceEntrySchema as Ct, COMMANDCODE_DIR as D, ALL_TOOL_TARGETS as Dn, ConsoleLogger as Dt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as E, mapWithConcurrency as En, findControlCharacter as Et, sweepRefusalReason as F, FEATURE_SOURCE_TREE_ENTRIES as Fn, CLIError as Ft, toInstructionBudgetFile as G, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Gn, assertWritablePathInsideRoot as Gt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as H, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Hn, assertNoSymlinkBelowRoot as Ht, CODEXCLI_BASH_RULES_FILE_NAME as I, MAX_FILE_SIZE as In, ErrorCodes as It, getLocalSkillDirNames as J, RULESYNC_MCP_SCHEMA_URL as Jn, directoryExists as Jt, classifyRemoteName as K, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Kn, checkPathTraversal as Kt, CODEXCLI_DIR as L, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Ln, parseJsonc as Lt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as M, ALL_FEATURES_WITH_WILDCARD as Mn, withFallbackLoggerTarget as Mt, caseFoldIdentity as N, DEPRECATED_FEATURE_REPLACEMENTS as Nn, resetRunWarningState as Nt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as O, ALL_TOOL_TARGETS_WITH_WILDCARD as On, JsonLogger as Ot, groupSpellingsByCaseFoldedIdentity as P, CURATED_RULES_FEATURE_SUBDIR as Pn, withWarnOnceScope as Pt, RulesyncSkillFrontmatterSchema as Q, RULESYNC_RELATIVE_DIR_PATH as Qn, findFilesByGlobs as Qt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as R, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Rn, PathOutsideRootError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, splitPathSegments as Sn, GITIGNORE_DESTINATION_KEY as St, FACTORYDROID_DIR as T, writeFileContent as Tn, getSourceTransport as Tt, CLAUDECODE_SKILLS_DIR_PATH as U, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Un, assertPathResolvesInsideRoot as Ut, CLAUDECODE_MEMORIES_DIR_NAME as V, RULESYNC_CONFIG_SCHEMA_URL as Vn, assertLandingOutsideVcsMetadata as Vt, findProjectInstructionBudgetFindings as W, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Wn, assertTreeContainsNoSymlinks as Wt, RulesyncSubagentFrontmatterSchema as X, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Xn, fileExists as Xt, RulesyncSubagent as Y, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Yn, ensureDir as Yt, RulesyncSkill as Z, RULESYNC_PERMISSIONS_SCHEMA_URL as Zn, fileExistsStrict as Zt, SkillsProcessor as _, removeFileWithoutFollowingSymlinks as _n, mergeInputRootConfigs as _t, convertFromTool as a, listDirectoryEntryNames as an, formatMegabytes as ar, getRulesyncSourceCandidates as at, REASONIX_LOCAL_RULE_FILE_NAME as b, resolvedRelativePath as bn, CONFLICTING_TARGET_PAIRS as bt, ELLIPSIS_WIDTH as c, normalizePosixDirPath as cn, hasEnclosingMarkOutsideKeycap as cr, RulesyncCommandFrontmatterSchema as ct, McpProcessor as d, readFileContent as dn, stripControlCharactersKeepingLineFeeds as dr, stringifyFrontmatter as dt, getHomeDirectory as en, RULESYNC_SKILLS_RELATIVE_DIR_PATH as er, RulesyncRuleFrontmatterSchema as et, IgnoreProcessor as f, readFileContentOrNull as fn, stripControlCharactersKeepingLineFeedsAndTabs as fr, loadYaml as ft, SubagentsProcessor as g, removeFileStrict as gn, ConfigResolver as gt, RulesProcessor as h, removeFile as hn, SKILL_FILE_NAME as ht, inspectInputRoots as i, isSymlink as in, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as ir, RulesyncHooks as it, AUGMENTCODE_DIR as j, ALL_FEATURES as jn, warnOnConflictingFlags as jt, CODEBUDDY_DIR as k, PACKAGING_TOOL_TARGETS as kn, WarningCollectingLogger as kt, displayWidthOf as l, pathEscapesRoot as ln, quoteForLog as lr, RulesyncCheck as lt, ChecksProcessor as m, removeDirectoryStrict as mn, SHARED_USER_MANAGED_CONFIG_PATHS as mt, formatSourceLoadFailure as n, isFileSystemError as nn, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as nr, RulesyncMcp as nt, getProcessorRegistryEntry as o, listFilePathsRecursively as on, formatError as or, resolveRulesyncSourceWritePath as ot, HooksProcessor as p, removeDirectory as pn, stripHiddenCharacters as pr, isRecord as pt, hasWindowsFoldableName as q, RULESYNC_MCP_RELATIVE_FILE_PATH as qn, createTempDirectory as qt, generate as r, isRootDirPath as rn, RULESYNC_USER_CONFIG_DIR_NAME as rr, RulesyncIgnore as rt, parseCommaSeparatedList as s, listSubdirectoryNames as sn, truncateText as sr, RulesyncCommand as st, importFromTool as t, isFileNotFoundError as tn, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as tr, RulesyncPermissions as tt, shortenToWidth as u, posixRelativePathEscapesRoot as un, stripControlCharacters as ur, RulesyncCheckFrontmatterSchema as ut, CRUSH_LOCAL_RULE_FILE_NAME as v, removeTempDirectory as vn, parseConfigFileContent as vt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as w, writeFileBuffer as wn, assertTargetsFeaturesExclusive as wt, QWENCODE_DIR as x, runWithDirectoryRollback as xn, ConfigFileSchema as xt, CommandsProcessor as y, resolvePath as yn, resolveEffectiveInputRoots as yt, CLAUDECODE_DIR as z, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as zn, applyFileMode as zt };
 
-//# sourceMappingURL=import-tr3jHcG2.js.map
+//# sourceMappingURL=import-Cu5o6uKO.js.map