rulesync 9.2.0 → 9.3.0

package/dist/{import-BkxwFCDM.js → import-B7VzSVUK.js}

@@ -3003,8 +3003,8 @@ const DEVIN_SKILLS_DIR_PATH = join(DEVIN_DIR, "skills");
 const DEVIN_AGENTS_DIR_PATH = join(DEVIN_DIR, "agents");
 const DEVIN_GLOBAL_CONFIG_DIR_PATH = join(".config", "devin");
 const DEVIN_GLOBAL_AGENTS_DIR_PATH = join(DEVIN_GLOBAL_CONFIG_DIR_PATH, "agents");
+const DEVIN_GLOBAL_SKILLS_DIR_PATH = join(DEVIN_GLOBAL_CONFIG_DIR_PATH, "skills");
 const CODEIUM_WINDSURF_GLOBAL_WORKFLOWS_DIR_PATH = join(CODEIUM_WINDSURF_DIR, "global_workflows");
-const CODEIUM_WINDSURF_SKILLS_DIR_PATH = join(CODEIUM_WINDSURF_DIR, "skills");
 const DEVIN_CONFIG_FILE_NAME = "config.json";
 const DEVIN_HOOKS_V1_FILE_NAME = "hooks.v1.json";
 const DEVIN_GLOBAL_AGENTS_FILE_NAME = "AGENTS.md";
@@ -5688,6 +5688,8 @@ const DEEPAGENTS_HOOK_EVENTS = [
 	"sessionEnd",
 	"beforeSubmitPrompt",
 	"permissionRequest",
+	"preToolUse",
+	"postToolUse",
 	"postToolUseFailure",
 	"stop",
 	"preCompact",
@@ -5713,7 +5715,13 @@ const CODEXCLI_HOOK_EVENTS = [
 * Goose adopts the Open Plugins hooks spec: each plugin's `hooks/hooks.json`
 * maps PascalCase event names to matcher/handler arrays. Every Goose event has a
 * 1:1 canonical equivalent, so no new canonical events are required.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+*
+* Goose's `HookEvent` enum defines exactly these 11 events (v1.41.0). Notably it
+* has NO `SubagentStart`/`SubagentStop` arms — emitting them would write keys
+* Goose silently ignores, so `subagentStart`/`subagentStop` are intentionally
+* excluded here and from `CANONICAL_TO_GOOSE_EVENT_NAMES`.
+* @see https://github.com/block/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 const GOOSE_HOOK_EVENTS = [
 	"sessionStart",
@@ -5726,9 +5734,7 @@ const GOOSE_HOOK_EVENTS = [
 	"beforeReadFile",
 	"afterFileEdit",
 	"beforeShellExecution",
-	"afterShellExecution",
-	"subagentStart",
-	"subagentStop"
+	"afterShellExecution"
 ];
 /** Hook events supported by Kiro CLI. */
 const KIRO_HOOK_EVENTS = [
@@ -6181,9 +6187,7 @@ const CANONICAL_TO_GOOSE_EVENT_NAMES = {
 	beforeReadFile: "BeforeReadFile",
 	afterFileEdit: "AfterFileEdit",
 	beforeShellExecution: "BeforeShellExecution",
-	afterShellExecution: "AfterShellExecution",
-	subagentStart: "SubagentStart",
-	subagentStop: "SubagentStop"
+	afterShellExecution: "AfterShellExecution"
 };
 /**
 * Map Goose PascalCase event names to canonical camelCase.
@@ -6197,6 +6201,8 @@ const CANONICAL_TO_DEEPAGENTS_EVENT_NAMES = {
 	sessionEnd: "session.end",
 	beforeSubmitPrompt: "user.prompt",
 	permissionRequest: "permission.request",
+	preToolUse: "tool.use",
+	postToolUse: "tool.result",
 	postToolUseFailure: "tool.error",
 	stop: "task.complete",
 	preCompact: "context.compact",
@@ -8191,7 +8197,7 @@ const GOOSE_CONVERTER_CONFIG = {
 *
 * The JSON shape matches Claude Code's: each PascalCase event maps to an array of
 * `{ matcher, hooks: [{ type: "command", command }] }` entries.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 var GooseHooks = class GooseHooks extends ToolHooks {
 	constructor(params) {
@@ -8242,7 +8248,7 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 			throw new Error(`Failed to parse Goose hooks content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: parsed.hooks,
+			hooks: parsed.hooks && typeof parsed.hooks === "object" && !Array.isArray(parsed.hooks) ? Object.fromEntries(Object.entries(parsed.hooks).filter(([eventName]) => Object.hasOwn(GOOSE_TO_CANONICAL_EVENT_NAMES, eventName))) : parsed.hooks,
 			converterConfig: GOOSE_CONVERTER_CONFIG
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify({
@@ -8297,6 +8303,24 @@ function mergeHermesConfig(fileContent, patch) {
 		...patch
 	});
 }
+/**
+* Recursively merge `patch` into `base` (patch wins). Nested plain objects are
+* merged key-by-key; every other value (arrays, scalars) is replaced wholesale.
+* Used to overlay the Hermes-scoped permission override onto the natively
+* emitted `approvals`/`security` structures without one clobbering the other
+* (e.g. `approvals.deny` from canonical deny rules coexisting with an
+* `approvals.mode` from the override). Prototype-pollution keys are dropped.
+*/
+function deepMergeHermesConfig(base, patch) {
+	const result = { ...base };
+	for (const [key, patchValue] of Object.entries(patch)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const baseValue = result[key];
+		if (isPlainObject(baseValue) && isPlainObject(patchValue)) result[key] = deepMergeHermesConfig(baseValue, patchValue);
+		else result[key] = sanitizeHermesConfigValue(patchValue);
+	}
+	return result;
+}
 //#endregion
 //#region src/features/hooks/hermesagent-hooks.ts
 /**
@@ -12279,6 +12303,38 @@ const RULESYNC_TO_CODEX_FIELD_MAP = {
 	envVars: "env_vars"
 };
 const MAX_REMOVE_EMPTY_ENTRIES_DEPTH$1 = 32;
+/**
+* Translate a server's `oauth` table from the canonical rulesync shape (Claude
+* Code style camelCase) into the shape Codex CLI understands. Codex expects the
+* OAuth client id under snake_case `client_id`; without it `codex mcp login`
+* falls back to dynamic client registration and fails for providers that do not
+* support it (e.g. Slack, see #2158). The canonical `clientId` is kept alongside
+* the added `client_id` so tools that read the camelCase shape keep working and
+* the round-trip stays stable.
+*/
+function mapOauthToCodex(oauth) {
+	const result = omitPrototypePollutionKeys(oauth);
+	if (typeof oauth["clientId"] === "string" && !("client_id" in result)) result["client_id"] = oauth["clientId"];
+	return result;
+}
+/**
+* Reverse of {@link mapOauthToCodex}: collapse Codex's `oauth.client_id` back to
+* the canonical `clientId` on import. When both keys are present (the shape
+* rulesync itself emits) the canonical `clientId` wins and `client_id` is
+* dropped so a subsequent generate does not accumulate duplicates.
+*/
+function mapOauthFromCodex(oauth) {
+	const result = {};
+	for (const [key, value] of Object.entries(oauth)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (key === "client_id") {
+			if (!("clientId" in oauth)) result["clientId"] = value;
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
 function convertFromCodexFormat(codexMcp) {
 	const result = {};
 	for (const [name, config] of Object.entries(codexMcp)) {
@@ -12288,7 +12344,8 @@ function convertFromCodexFormat(codexMcp) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "enabled") {
 				if (value === false) converted["disabled"] = true;
-			} else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthFromCodex(value);
+			else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
 				const mappedKey = CODEX_TO_RULESYNC_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `Ignored malformed array for ${key} in MCP server ${name}`);
@@ -12308,7 +12365,8 @@ function convertToCodexFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "disabled") {
 				if (value === true) converted["enabled"] = false;
-			} else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthToCodex(value);
+			else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
 				const mappedKey = RULESYNC_TO_CODEX_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string array, got ${typeof value}`);
@@ -13524,10 +13582,12 @@ function resolveHermesTimeout(config) {
 *
 * Hermes is close to the MCP spec but not identical: `command` must be a single
 * executable string (an array's tail folds into `args`), a server is disabled
-* via `enabled: false` (not the canonical `disabled: true`), and remote servers
-* use `url`/`headers`. Only fields Hermes understands are emitted, so the shared
-* `config.yaml` is not polluted with canonical-only aliases (`type`, `transport`,
-* `httpUrl`, `networkTimeout`, tool-filter keys, ...).
+* via `enabled: false` (not the canonical `disabled: true`), remote servers use
+* `url`/`headers`, and per-server tool scoping lives under a `tools: { include,
+* exclude }` block (from the canonical `enabledTools`/`disabledTools`). Only
+* fields Hermes understands are emitted, so the shared `config.yaml` is not
+* polluted with canonical-only aliases (`type`, `transport`, `httpUrl`,
+* `networkTimeout`, ...).
 */
 function convertServerToHermes(config) {
 	const out = {};
@@ -13551,6 +13611,10 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
+	const tools = {};
+	if (isStringArray(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
 }
 /**
@@ -13592,6 +13656,10 @@ function convertFromHermesFormat(mcpServers) {
 		if (isPlainObject(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
 		if (config.enabled === false) server.disabled = true;
 		if (typeof config.timeout === "number") server.networkTimeout = config.timeout;
+		if (isRecord(config.tools)) {
+			if (isStringArray(config.tools.include)) server.enabledTools = config.tools.include;
+			if (isStringArray(config.tools.exclude)) server.disabledTools = config.tools.exclude;
+		}
 		result[name] = server;
 	}
 	return result;
@@ -15747,17 +15815,232 @@ const PermissionActionSchema = z.enum([
 */
 const PermissionRulesSchema = z.record(z.string(), PermissionActionSchema);
 /**
+* OpenCode-specific permission value. Unlike the shared canonical block, which
+* only accepts a pattern-to-action map, OpenCode also allows a bare action
+* string that applies to the whole category (e.g. `"external_directory": "deny"`).
+* This mirrors OpenCode's own permission schema in `opencode-permissions.ts`.
+*/
+const OpencodeOverridePermissionValueSchema = z.union([PermissionActionSchema, PermissionRulesSchema]);
+/**
+* Tool-scoped override block for OpenCode. Permission categories placed here
+* (e.g. OpenCode-only categories such as `external_directory`) are emitted only
+* into OpenCode's config and never leak into other tools' permission files. It
+* also lets a shared category be overridden with an OpenCode-specific value.
+* Kept `looseObject` so future OpenCode categories are accepted.
+*
+* @example
+* { "permission": { "external_directory": "deny", "webfetch": "allow" } }
+*/
+const OpencodePermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Hermes Agent. Keys placed here are deep-merged
+* into Hermes's `~/.hermes/config.yaml` and never leak into other tools' configs.
+* It carries Hermes-specific approval/security controls that have no canonical
+* permission category — e.g. `approvals` (`mode`, `cron_mode`, ...),
+* `security` (`allow_private_urls`, ...), `skills.write_approval`,
+* `memory.write_approval`. Kept `looseObject` (a verbatim passthrough) so any
+* current or future Hermes config key can be authored without modeling each one.
+*
+* @example
+* { "approvals": { "mode": "smart" }, "security": { "allow_private_urls": false } }
+*/
+const HermesPermissionsOverrideSchema = z.looseObject({});
+/**
+* Tool-scoped override block for Cline. Cline's `command-permissions.json`
+* carries a single global `allowRedirects` boolean (gates shell redirection
+* operators `>`/`>>`/`<`) that has no per-command dimension and therefore no
+* canonical permission category. Placing it here lets users author it
+* declaratively; it is emitted only into Cline's config. Kept `looseObject` so
+* future Cline-only knobs can be added.
+*
+* @example
+* { "allowRedirects": true }
+*/
+const ClinePermissionsOverrideSchema = z.looseObject({ allowRedirects: z.optional(z.boolean()) });
+/**
+* Tool-scoped override block for Kilo Code (an OpenCode fork). Kilo's permission
+* object is a free-form record with tool-specific keys that have no canonical
+* category — OpenCode-inherited ones (`external_directory`, `doom_loop`, `lsp`,
+* `question`, `todowrite`, `skill`, `task`, `list`) and Kilo-unique ones
+* (`agent_manager`, `notebook_read`, `notebook_edit`, `notebook_execute`,
+* `repo_clone`, `repo_overview`). Placing them here makes them authorable and
+* portable and keeps them out of other tools' configs. Mirrors the OpenCode
+* override; each value may be a bare action string or a pattern map.
+*
+* @example
+* { "permission": { "external_directory": "deny", "doom_loop": "ask" } }
+*/
+const KiloPermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Claude Code. Claude Code's `permissions` object
+* (in `.claude/settings.json`) carries non-list fields that have no canonical
+* permission category — `defaultMode` (the session-start permission mode) and
+* `additionalDirectories` (extra working directories) being the primary ones.
+* Fields placed under `claudecode.permissions` are merged into the settings
+* `permissions` object and emitted only for Claude Code, while the shared
+* `permission` block continues to drive the `allow`/`ask`/`deny` arrays. Kept a
+* `looseObject` passthrough so any current or future `permissions` field can be
+* authored without modeling each one; the managed `allow`/`ask`/`deny` arrays are
+* ignored here (rulesync owns them).
+*
+* @example
+* { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
+*/
+const ClaudecodePermissionsOverrideSchema = z.looseObject({ permissions: z.optional(z.looseObject({})) });
+/**
+* Tool-scoped override block for Mistral Vibe. Vibe's per-tool `BaseToolConfig`
+* carries a `sensitive_patterns` list — patterns that escalate to ASK even when
+* the tool's base permission is ALWAYS (allow). The canonical model can only set
+* a pattern to a single `allow`/`ask`/`deny`, so an "allow by default but ask on
+* these patterns" escalation cannot be expressed. Entries under
+* `vibe.permission.<category>.sensitive_patterns` carry that list per canonical
+* category; the shared `permission` block still drives the base permission and
+* allow/deny lists. Keyed by canonical category (e.g. `bash`, `edit`).
+*
+* @example
+* { "permission": { "bash": { "sensitive_patterns": ["rm *", "sudo *"] } } }
+*/
+const VibePermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(z.string(), z.looseObject({ sensitive_patterns: z.optional(z.array(z.string())) }))) });
+/**
+* Tool-scoped override block for Cursor CLI. Cursor's `cli.json` carries scalar
+* autonomy settings with no canonical permission category — `approvalMode`
+* (`allowlist` | `auto-review` | `unrestricted`) and a `sandbox` object
+* (`mode`/`networkAccess`). Fields placed here are merged into the top-level of
+* `.cursor/cli.json` (project) / `~/.cursor/cli-config.json` (global) and emitted
+* only for Cursor, while the shared `permission` block continues to drive the
+* `permissions.allow`/`permissions.deny` arrays. Kept a `looseObject` so extra
+* `cli.json` keys can be authored (they are merged verbatim on generate);
+* `sandbox`'s accepted values are not documented so it passes through verbatim.
+* Note: only `approvalMode` and `sandbox` round-trip back on import — other keys
+* authored here reach `cli.json` on generate but are not re-extracted.
+*
+* @example
+* { "approvalMode": "auto-review" }
+*/
+const CursorPermissionsOverrideSchema = z.looseObject({
+	approvalMode: z.optional(z.string()),
+	sandbox: z.optional(z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Qwen Code. Qwen's `settings.json` exposes
+* autonomy/sandbox controls with no canonical permission category — under
+* `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
+* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`). Fields
+* placed here are merged into the matching `settings.json` group and emitted
+* only for Qwen, while the shared `permission` block continues to drive the
+* `permissions.allow`/`ask`/`deny` arrays. Kept `looseObject` (verbatim
+* passthrough) so any current or future `tools`/`security` key can be authored.
+*
+* @example
+* { "tools": { "approvalMode": "auto-edit" }, "security": { "folderTrust": { "enabled": true } } }
+*/
+const QwencodePermissionsOverrideSchema = z.looseObject({
+	tools: z.optional(z.looseObject({})),
+	security: z.optional(z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Reasonix. Reasonix has security axes orthogonal
+* to per-tool allow/ask/deny with no canonical category — the `[sandbox]`
+* enforcement table (`workspace_root`, `allow_write`, `forbid_read`, `bash`,
+* `network`) and plan-mode read-only trust lists under `[agent]`
+* (`plan_mode_allowed_tools`, `plan_mode_read_only_commands`). Fields placed here
+* are merged into the matching `reasonix.toml` table and emitted only for
+* Reasonix, while the shared `permission` block continues to drive
+* `[permissions].allow`/`ask`/`deny`. Kept `looseObject` (verbatim passthrough).
+* Note: the whole `[sandbox]` table round-trips, but only the plan-mode keys are
+* re-extracted from `[agent]` on import — other `agent` keys authored here reach
+* `reasonix.toml` on generate but are not re-extracted back into the override.
+*
+* @example
+* { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
+*/
+const ReasonixPermissionsOverrideSchema = z.looseObject({
+	sandbox: z.optional(z.looseObject({})),
+	agent: z.optional(z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
+* exposes security controls with no canonical per-command allow/ask/deny slot —
+* `commandBlocklist` (a hard-block tier that can never be approved, distinct from
+* an approvable `deny`), `networkPolicy` (`allowedIps`), `sandbox`
+* (`enabled`/`mode`/`filesystem`/`network`), `mcpPolicy`, `enableDroidShield`,
+* and autonomy settings (`sessionDefaultSettings`, `maxAutonomyLevel`,
+* `interactionMode`). Fields placed here are merged into `settings.json` and
+* emitted only for Factory Droid, while the shared `permission` block continues
+* to drive `commandAllowlist`/`commandDenylist`. Kept `looseObject` passthrough.
+*
+* @example
+* { "commandBlocklist": ["rm -rf /*"], "sandbox": { "enabled": true } }
+*/
+const FactorydroidPermissionsOverrideSchema = z.looseObject({ commandBlocklist: z.optional(z.array(z.string())) });
+/**
+* Tool-scoped override block for Warp. Warp's `[agents.profiles]` table exposes
+* file-read/read-only autonomy keys with no canonical per-command allow/ask/deny
+* slot — `agent_mode_coding_permissions`
+* (`always_ask_before_reading` | `always_allow_reading` | `allow_reading_specific_files`),
+* `agent_mode_coding_file_read_allowlist` (a path array), and
+* `agent_mode_execute_readonly_commands` (a read-only auto-execution boolean).
+* Fields placed here are merged into `[agents.profiles]` of Warp's global
+* `settings.toml`, while the shared `permission` block continues to drive the
+* `agent_mode_command_execution_allowlist`/`_denylist` command regex arrays.
+* Warp permissions are global-only.
+*
+* @example
+* { "agent_mode_coding_permissions": "always_allow_reading", "agent_mode_execute_readonly_commands": true }
+*/
+const WarpPermissionsOverrideSchema = z.looseObject({
+	agent_mode_coding_permissions: z.optional(z.string()),
+	agent_mode_coding_file_read_allowlist: z.optional(z.array(z.string())),
+	agent_mode_execute_readonly_commands: z.optional(z.boolean())
+});
+/**
+* Tool-scoped override block for JetBrains Junie. Junie's `allowlist.json` has
+* two top-level autonomy knobs with no canonical per-glob slot:
+* `allowReadonlyCommands` (a boolean auto-allowing read-only commands) and
+* `defaultBehavior` (the fallback action applied when no rule matches — Junie
+* documents only `allow`/`ask`). Fields placed here are merged onto the
+* top level of `allowlist.json`, while the shared `permission` block continues
+* to drive the per-category `rules` groups.
+*
+* @example
+* { "allowReadonlyCommands": true, "defaultBehavior": "ask" }
+*/
+const JuniePermissionsOverrideSchema = z.looseObject({
+	allowReadonlyCommands: z.optional(z.boolean()),
+	defaultBehavior: z.optional(z.string())
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
+* The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
+* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie` keys are tool-scoped
+* overrides consumed only by their respective translator (see the matching
+* `*PermissionsOverrideSchema`); every other tool reads the shared `permission`
+* block and ignores them.
+*
 * @example
 * {
 *   "bash": { "*": "ask", "git *": "allow", "rm *": "deny" },
 *   "edit": { "*": "deny", "src/**": "allow" }
 * }
 */
-const PermissionsConfigSchema = z.looseObject({ permission: z.record(z.string(), PermissionRulesSchema) });
+const PermissionsConfigSchema = z.looseObject({
+	permission: z.record(z.string(), PermissionRulesSchema),
+	opencode: z.optional(OpencodePermissionsOverrideSchema),
+	hermes: z.optional(HermesPermissionsOverrideSchema),
+	cline: z.optional(ClinePermissionsOverrideSchema),
+	kilo: z.optional(KiloPermissionsOverrideSchema),
+	claudecode: z.optional(ClaudecodePermissionsOverrideSchema),
+	vibe: z.optional(VibePermissionsOverrideSchema),
+	cursor: z.optional(CursorPermissionsOverrideSchema),
+	qwencode: z.optional(QwencodePermissionsOverrideSchema),
+	reasonix: z.optional(ReasonixPermissionsOverrideSchema),
+	factorydroid: z.optional(FactorydroidPermissionsOverrideSchema),
+	warp: z.optional(WarpPermissionsOverrideSchema),
+	junie: z.optional(JuniePermissionsOverrideSchema)
+});
 /**
 * Full permissions file schema including optional $schema field.
 */
@@ -17128,6 +17411,14 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToClaudePermissions(config);
+		const overridePermissions = config.claudecode?.permissions;
+		if (overridePermissions && typeof overridePermissions === "object") {
+			const { allow: _a, ask: _k, deny: _d, ...nonListFields } = overridePermissions;
+			settings.permissions = {
+				...settings.permissions,
+				...nonListFields
+			};
+		}
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toClaudeToolName(category)));
 		const merged = applyPermissions({
 			settings,
@@ -17160,6 +17451,8 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
+		const { allow: _a, ask: _k, deny: _d, ...nonListFields } = permissions;
+		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17333,7 +17626,8 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Cline command-permissions at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(rulesyncPermissions.getJson().permission);
+		const config = rulesyncPermissions.getJson();
+		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(config.permission);
 		warnClineTranslationNotices({
 			droppedCategories,
 			translatedAskPatterns,
@@ -17349,7 +17643,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 			...existing,
 			allow: dedupedAllow,
 			deny: mergedDeny,
-			allowRedirects: existing.allowRedirects ?? false
+			allowRedirects: config.cline?.allowRedirects ?? existing.allowRedirects ?? false
 		};
 		return new ClinePermissions({
 			outputRoot,
@@ -17373,6 +17667,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		for (const pattern of parsed.allow ?? []) bashRules[pattern] = "allow";
 		for (const pattern of parsed.deny ?? []) bashRules[pattern] = "deny";
 		const config = Object.keys(bashRules).length > 0 ? { permission: { bash: bashRules } } : { permission: {} };
+		if (parsed.allowRedirects === true) config.cline = { allowRedirects: true };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17809,13 +18104,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX = "mcp__";
+const MCP_CANONICAL_PREFIX$1 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$1) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -17846,7 +18141,7 @@ function toCursorPattern(canonical, pattern) {
 function toCanonicalCategory$1(cursorType, pattern) {
 	if (cursorType === "Mcp") {
 		const match = pattern.match(/^([^:()]+):([^:()]+)$/);
-		if (match) return `${MCP_CANONICAL_PREFIX}${match[1] ?? "*"}__${match[2] ?? "*"}`;
+		if (match) return `${MCP_CANONICAL_PREFIX$1}${match[1] ?? "*"}__${match[2] ?? "*"}`;
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
 	return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
@@ -17980,8 +18275,10 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		mergedPermissions.allow = mergedAllow;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
+		const cursorOverride = config.cursor;
 		const merged = {
 			...settings,
+			...cursorOverride,
 			version: settings.version ?? 1,
 			editor: {
 				...existingEditor,
@@ -18007,11 +18304,15 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		}
 		const permissionsRaw = settings.permissions;
 		const permissions = permissionsRaw !== null && typeof permissionsRaw === "object" && !Array.isArray(permissionsRaw) ? permissionsRaw : {};
-		const config = convertCursorToRulesyncPermissions({
+		const result = { ...convertCursorToRulesyncPermissions({
 			allow: asCursorPermissionEntryArray(permissions.allow),
 			deny: asCursorPermissionEntryArray(permissions.deny)
-		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		}) };
+		const cursorOverride = {};
+		if (settings.approvalMode !== void 0) cursorOverride.approvalMode = settings.approvalMode;
+		if (settings.sandbox !== null && typeof settings.sandbox === "object" && !Array.isArray(settings.sandbox)) cursorOverride.sandbox = settings.sandbox;
+		if (Object.keys(cursorOverride).length > 0) result.cursor = cursorOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18070,7 +18371,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { type, pattern } = parseCursorPermissionEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$1) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -18319,6 +18620,16 @@ function convertDevinToRulesyncPermissions(params) {
 }
 //#endregion
 //#region src/features/permissions/factorydroid-permissions.ts
+const FACTORYDROID_OVERRIDE_KEYS = [
+	"commandBlocklist",
+	"networkPolicy",
+	"sandbox",
+	"mcpPolicy",
+	"enableDroidShield",
+	"sessionDefaultSettings",
+	"maxAutonomyLevel",
+	"interactionMode"
+];
 /**
 * Permissions adapter for Factory Droid.
 *
@@ -18336,18 +18647,14 @@ function convertDevinToRulesyncPermissions(params) {
 * skipped (with a warning when they carry `deny` rules, to surface the gap).
 *
 * Factory Droid also has a stronger `commandBlocklist` tier — commands that can
-* never run, not even under full autonomy. rulesync's canonical action model
-* has only `allow | ask | deny`, with no equivalent of a hard block that can
-* never be approved. So on **import** a `commandBlocklist` entry is collapsed
-* onto canonical `deny` (lossy: the never-runs guarantee is weakened to a deny
-* the user can still approve), rather than being silently dropped. On **export**
-* there is no canonical `block` to emit one from, so rulesync never writes
-* `commandBlocklist`; an existing one on disk is preserved verbatim as an
-* unmanaged key. (A consequence of the lossy collapse: importing a
-* `commandBlocklist` and re-exporting it to a *fresh* config writes it back as
-* `commandDenylist`, not `commandBlocklist` — the hard-block tier is not
-* reconstructed. Re-running over the original file keeps it intact via the
-* verbatim preservation above.)
+* never run, not even under full autonomy — plus other security controls
+* (`networkPolicy`, `sandbox`, `mcpPolicy`, `enableDroidShield`, autonomy
+* settings) that do not fit the canonical `allow | ask | deny` per-command
+* model. These are authored and round-tripped through the `factorydroid`
+* override namespace (see `FactorydroidPermissionsOverrideSchema`): on **import**
+* they are lifted from `settings.json` into the override, and on **export** they
+* are merged back in — so `commandBlocklist`'s never-runs guarantee is preserved
+* faithfully rather than being collapsed onto an approvable `deny`.
 */
 var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissions {
 	constructor(params) {
@@ -18390,11 +18697,16 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		} catch (error) {
 			throw new Error(`Failed to parse existing Factory Droid settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToFactorydroidPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
-		const merged = { ...settings };
+		const override = config.factorydroid;
+		const merged = {
+			...settings,
+			...override !== void 0 && typeof override === "object" ? override : {}
+		};
 		const mergedAllow = uniq(allow.toSorted());
 		const mergedDeny = uniq(deny.toSorted());
 		if (mergedAllow.length > 0) merged.commandAllowlist = mergedAllow;
@@ -18418,10 +18730,13 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		}
 		const config = convertFactorydroidToRulesyncPermissions({
 			allow: Array.isArray(settings.commandAllowlist) ? settings.commandAllowlist : [],
-			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : [],
-			block: Array.isArray(settings.commandBlocklist) ? settings.commandBlocklist : []
+			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const factorydroidOverride = {};
+		for (const key of FACTORYDROID_OVERRIDE_KEYS) if (settings[key] !== void 0) factorydroidOverride[key] = settings[key];
+		const result = { ...config };
+		if (Object.keys(factorydroidOverride).length > 0) result.factorydroid = factorydroidOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18468,18 +18783,18 @@ function convertRulesyncToFactorydroidPermissions({ config, logger }) {
 	};
 }
 /**
-* Convert Factory Droid allow/deny/block command lists back to rulesync config
-* under the `bash` category.
+* Convert Factory Droid allow/deny command lists back to rulesync config under
+* the `bash` category.
 *
-* `commandBlocklist` (hard block) has no canonical equivalent, so it collapses
-* onto `deny` — lossy (a deny can still be approved), but preferable to dropping
-* the rule entirely.
+* `commandBlocklist` (the hard-block tier) is no longer collapsed here — it has
+* no canonical equivalent and now round-trips through the `factorydroid`
+* override so the never-runs guarantee is preserved instead of being weakened to
+* an approvable `deny`.
 */
-function convertFactorydroidToRulesyncPermissions({ allow, deny, block }) {
+function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 	const bash = {};
 	for (const pattern of allow) bash[pattern] = "allow";
 	for (const pattern of deny) bash[pattern] = "deny";
-	for (const pattern of block) bash[pattern] = "deny";
 	return { permission: Object.keys(bash).length > 0 ? { bash } : {} };
 }
 //#endregion
@@ -18673,30 +18988,114 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 const GROKCLI_GLOBAL_ONLY_MESSAGE = "Grok CLI permissions are global-only; use --global to sync ~/.grok/config.toml";
 const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
+const GROKCLI_PERMISSION_KEY = "permission";
 const CATCH_ALL_PATTERN$2 = "*";
+const MCP_CANONICAL_PREFIX = "mcp__";
+const CATEGORY_TO_GROK_TOOL = {
+	bash: "Bash",
+	read: "Read",
+	edit: "Edit",
+	write: "Edit",
+	grep: "Grep",
+	webfetch: "WebFetch"
+};
+const GROK_TOOL_TO_CATEGORY = {
+	Bash: "bash",
+	Read: "read",
+	Edit: "edit",
+	Grep: "grep",
+	WebFetch: "webfetch"
+};
+const GROK_MCP_TOOL = "MCPTool";
+/**
+* Build a Grok Claude-style permission entry (e.g. `Bash(git *)`, `Read`,
+* `MCPTool(server__tool)`) from a canonical category + pattern. Returns `null`
+* for categories Grok cannot express so callers can skip them.
+*
+* Scoped MCP categories (`mcp__<remainder>`) fold their address into the
+* parentheses (`MCPTool(<remainder>)`); the bare `mcp` category becomes
+* `MCPTool`. For every other tool, a `*` pattern emits the bare tool name and a
+* concrete pattern emits `Tool(pattern)`.
+*/
+function buildGrokEntry(category, pattern) {
+	if (category.startsWith(MCP_CANONICAL_PREFIX)) {
+		const remainder = category.slice(5);
+		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
+	}
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	const tool = CATEGORY_TO_GROK_TOOL[category];
+	if (tool === void 0) return null;
+	return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? tool : `${tool}(${pattern})`;
+}
+/**
+* Parse a Grok Claude-style permission entry back into a canonical category +
+* pattern. Entries without parentheses are treated as catch-all (`*`). Returns
+* `null` for tool prefixes with no canonical equivalent (e.g. `any`).
+*/
+function parseGrokEntry(entry) {
+	const trimmed = entry.trim();
+	const parenIndex = trimmed.indexOf("(");
+	let tool;
+	let inner;
+	if (parenIndex === -1 || !trimmed.endsWith(")")) {
+		tool = trimmed;
+		inner = "";
+	} else {
+		tool = trimmed.slice(0, parenIndex);
+		inner = trimmed.slice(parenIndex + 1, -1).trim();
+	}
+	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
+		category: `${MCP_CANONICAL_PREFIX}${inner}`,
+		pattern: CATCH_ALL_PATTERN$2
+	} : {
+		category: "mcp",
+		pattern: CATCH_ALL_PATTERN$2
+	};
+	const category = GROK_TOOL_TO_CATEGORY[tool];
+	if (category === void 0) return null;
+	return {
+		category,
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$2
+	};
+}
 /**
 * Permissions adapter for the xAI Grok Build CLI (`grokcli`).
 *
-* Grok has no per-tool / per-pattern permission rules. Tool gating is a single
-* coarse toggle, `[ui] permission_mode`, in `~/.grok/config.toml`:
-*   - `ask` — prompt before each tool call (Grok's default).
-*   - `always-approve` — skip prompts.
-*
-* rulesync's permission model is per-category, per-pattern `allow`/`ask`/`deny`,
-* so the mapping is **lossy** (a single mode cannot express per-pattern rules):
-*   - Generate: any `deny` or `ask` rule anywhere ⇒ `ask` (conservative — keep
-*     prompting whenever the user expressed any restriction); otherwise, if at
-*     least one `allow` rule exists and nothing is denied/asked ⇒
-*     `always-approve`; an empty config falls back to the safe default `ask`.
-*   - Import: `always-approve` ⇒ `bash: { "*": "allow" }`; `ask` (or unset) ⇒
-*     `bash: { "*": "ask" }`. `bash` is used as the representative catch-all
-*     because it is the primary permission-gated surface, and this round-trips
-*     the generate mapping.
-*
-* This surface is **global only** — `permission_mode` lives in the user-level
-* `~/.grok/config.toml`; Grok has no project-scoped permission file. The shared
-* config is merged in place: the `[ui] permission_mode` value is set and every
-* other key (e.g. `[mcp_servers]`, legacy `approval_mode`) is preserved. The
+* Grok Build CLI ships a Claude-style rule system under `[permission]` in
+* `~/.grok/config.toml`: `allow` / `deny` / `ask` arrays of entries such as
+* `Bash(git *)`, `Read(src/**)`, `Edit`, `Grep`, `MCPTool(server__tool)`, and
+* `WebFetch`, evaluated with precedence `deny > ask > allow`
+* (https://docs.x.ai/build/settings/reference). rulesync's canonical
+* per-category, per-pattern model maps almost 1:1:
+*   - Generate: each `permission.<category>.<pattern> = allow|ask|deny` becomes
+*     the matching Grok entry and is bucketed into the `[permission]` array for
+*     that action. `bash|read|edit|grep|webfetch` map to their Grok tool;
+*     `write` collapses onto `Edit` (Grok has no `Write` tool); `mcp__*` maps to
+*     `MCPTool(...)` (a scoped MCP category folds its address into the
+*     parentheses, so a non-`*` argument pattern on it is not represented).
+*     Categories with no Grok tool (`websearch`, `glob`, `notebookedit`,
+*     `agent`) are skipped (with a warning when they carry a `deny` rule, to
+*     surface the gap). When two canonical rules collapse onto the same Grok
+*     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
+*     the strictest wins (`deny > ask > allow`) and a warning is logged, so the
+*     entry never lands contradictorily in two arrays.
+*   - Import: the `[permission]` arrays are parsed back into canonical
+*     categories. When no `[permission]` section is present (older configs), the
+*     coarse `[ui] permission_mode` is used as a fallback.
+*
+* The coarse `[ui] permission_mode` toggle is still written for backward
+* compatibility with older Grok versions: `always-approve` when the config is
+* pure-`allow`, otherwise `ask` (conservative — it is never `always-approve`
+* while any `deny`/`ask` rule exists, so it never contradicts the fine-grained
+* arrays).
+*
+* This surface is **global only** — the adapter syncs the user-level
+* `~/.grok/config.toml`. (Grok also supports a project-scoped `[permission]`
+* file; project scope is not modeled here.) The shared config is merged in
+* place: rulesync owns the `[permission]` `allow`/`deny`/`ask` entries for the
+* tools it models and the `[ui] permission_mode` value, while every other key
+* (e.g. `[mcp_servers]`, `[permission] rules`, `[sandbox]`) and any user-authored
+* entries for tools rulesync cannot model (e.g. `WebSearch`) are preserved. The
 * file is never deleted.
 */
 var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
@@ -18728,7 +19127,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			global: true
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
 		if (!global) throw new Error(GROKCLI_GLOBAL_ONLY_MESSAGE);
 		const paths = GrokcliPermissions.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -18739,7 +19138,16 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Grok config.toml at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const mode = deriveGrokPermissionMode(rulesyncPermissions.getJson());
+		const config = rulesyncPermissions.getJson();
+		const existingPermission = isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {};
+		const buckets = buildGrokPermissionArrays(config, existingPermission, logger);
+		parsed[GROKCLI_PERMISSION_KEY] = {
+			...existingPermission,
+			allow: buckets.allow,
+			deny: buckets.deny,
+			ask: buckets.ask
+		};
+		const mode = deriveGrokPermissionMode(config);
 		const existingUi = isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {};
 		parsed[GROKCLI_UI_KEY] = {
 			...existingUi,
@@ -18762,8 +19170,8 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Grok config.toml content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const action = (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
-		const rulesyncConfig = { permission: { bash: { [CATCH_ALL_PATTERN$2]: action } } };
+		const fineGrained = parseGrokPermissionArrays(isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$2]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -18783,6 +19191,84 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		});
 	}
 };
+const ACTION_RANK = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Collect user-authored entries from an existing `[permission]` array whose
+* tool prefix rulesync cannot model (e.g. `WebSearch`, `any`). Such entries are
+* preserved verbatim so replacing the arrays does not silently drop them
+* (mirrors the Cursor adapter's preservation of unmanaged types).
+*/
+function unmanagedEntries(existingPermission, key) {
+	return (isStringArray(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+}
+/**
+* Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
+* Claude-style entries, resolving collapse collisions via `deny > ask > allow`.
+* Categories Grok cannot express are skipped (with a warning when they carry a
+* `deny` rule); entries the user authored for tools rulesync cannot model are
+* preserved from `existingPermission`.
+*/
+function buildGrokPermissionArrays(config, existingPermission, logger) {
+	const ranked = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+		const entry = buildGrokEntry(category, pattern);
+		if (entry === null) {
+			if (action === "deny" && logger) logger.warn(`Grok CLI has no permission tool for the '${category}' category; its 'deny' rule could not be represented and was skipped.`);
+			continue;
+		}
+		const existing = ranked.get(entry);
+		if (existing !== void 0 && existing !== action) logger?.warn(`Grok permission entry '${entry}' received conflicting actions ('${existing}' and '${action}'); keeping the stricter one (deny > ask > allow).`);
+		if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) ranked.set(entry, action);
+	}
+	const allow = unmanagedEntries(existingPermission, "allow");
+	const deny = unmanagedEntries(existingPermission, "deny");
+	const ask = unmanagedEntries(existingPermission, "ask");
+	for (const [entry, action] of ranked) if (action === "allow") allow.push(entry);
+	else if (action === "deny") deny.push(entry);
+	else ask.push(entry);
+	return {
+		allow: uniq(allow.toSorted()),
+		deny: uniq(deny.toSorted()),
+		ask: uniq(ask.toSorted())
+	};
+}
+/**
+* Parse Grok's `[permission]` allow/deny/ask arrays back into a canonical
+* permission map. Returns `null` when the section defines none of the three
+* arrays, so the caller can fall back to the coarse `permission_mode`.
+* Precedence `deny > ask > allow` is applied so a tool listed in multiple
+* arrays resolves to the strictest action.
+*/
+function parseGrokPermissionArrays(permission) {
+	const allow = isStringArray(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray(permission.ask) ? permission.ask : void 0;
+	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) === 0) return null;
+	const result = {};
+	const apply = (entries, action) => {
+		for (const entry of entries ?? []) {
+			const parsed = parseGrokEntry(entry);
+			if (parsed === null) continue;
+			const bucket = result[parsed.category] ??= {};
+			bucket[parsed.pattern] = action;
+		}
+	};
+	apply(allow, "allow");
+	apply(ask, "ask");
+	apply(deny, "deny");
+	return result;
+}
+/**
+* Legacy coarse fallback: map `[ui] permission_mode` to a canonical action.
+* `always-approve` ⇒ `allow`; anything else (including a missing mode) ⇒ `ask`.
+*/
+function legacyModeAction(parsed) {
+	return (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
+}
 /**
 * Collapse a rulesync permissions config into Grok's single coarse mode.
 * Any `deny`/`ask` rule anywhere keeps prompting (`ask`); otherwise an existing
@@ -18798,6 +19284,10 @@ function deriveGrokPermissionMode(config) {
 }
 //#endregion
 //#region src/features/permissions/hermesagent-permissions.ts
+/** Collect the glob patterns in a canonical category that carry a given action. */
+function patternsByAction(category, action) {
+	return Object.entries(category ?? {}).filter(([, value]) => value === action).map(([pattern]) => pattern);
+}
 var HermesagentPermissions = class HermesagentPermissions extends ToolPermissions {
 	static getSettablePaths() {
 		return {
@@ -18821,7 +19311,11 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		return true;
 	}
 	setFileContent(fileContent) {
-		this.fileContent = mergeHermesConfig(fileContent, parseHermesConfig(this.fileContent));
+		const existing = parseHermesConfig(fileContent);
+		const generated = parseHermesConfig(this.fileContent);
+		const merged = deepMergeHermesConfig(existing, generated);
+		if (generated.permissions !== void 0) merged.permissions = generated.permissions;
+		this.fileContent = stringifyHermesConfig(merged);
 	}
 	toRulesyncPermissions() {
 		const config = parseHermesConfig(this.getFileContent());
@@ -18834,12 +19328,22 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 	}
 	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions }) {
 		const permissions = rulesyncPermissions.getJson();
+		const permissionBlock = permissions.permission ?? {};
+		const commandAllowlist = Object.entries(permissionBlock).flatMap(([, patterns]) => patternsByAction(patterns, "allow"));
+		const bashDeny = patternsByAction(permissionBlock.bash, "deny");
+		const webfetchDeny = patternsByAction(permissionBlock.webfetch, "deny");
+		let config = {};
+		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
+		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
+		if (webfetchDeny.length > 0) config.security = { website_blocklist: {
+			enabled: true,
+			domains: webfetchDeny
+		} };
+		if (permissions.hermes && typeof permissions.hermes === "object") config = deepMergeHermesConfig(config, permissions.hermes);
+		config.permissions = { rulesync: permissions };
 		return new HermesagentPermissions({
 			outputRoot,
-			fileContent: stringifyHermesConfig({
-				command_allowlist: Object.entries(permissions.permission ?? {}).flatMap(([, patterns]) => Object.entries(patterns).filter(([, action]) => action === "allow").map(([command]) => command)),
-				permissions: { rulesync: permissions }
-			})
+			fileContent: stringifyHermesConfig(config)
 		});
 	}
 };
@@ -18860,14 +19364,18 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *     "executables":       [ { "prefix": "git ", "action": "allow" } ],
 *     "fileEditing":       [ { "pattern": "src/**", "action": "allow" } ],
 *     "mcpTools":          [ { "prefix": "search", "action": "allow" } ],
-*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "deny" } ]
+*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "ask" } ]
 *   }
 * }
 * ```
 *
 * Each rule carries a literal `prefix` (matches commands that start with it) or
-* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`
-* (`allow` | `ask` | `deny`). rulesync's canonical actions map 1:1 onto Junie's.
+* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`. Junie
+* documents only `allow` and `ask` as valid actions — there is **no `deny`**
+* (https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html). rulesync's
+* canonical `allow`/`ask` map 1:1; a canonical `deny` has no Junie equivalent
+* and is mapped to the nearest valid action, `ask` (still withholds
+* auto-approval), with a warning so the downgrade is surfaced.
 *
 * Category mapping (rulesync canonical <-> Junie rule group):
 * - `bash`         <-> `executables`
@@ -18877,8 +19385,11 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *
 * Categories Junie cannot represent (e.g. `webfetch`) are skipped on export
 * (with a warning when they carry rules). The top-level `defaultBehavior` and
-* `allowReadonlyCommands` settings have no canonical equivalent: they are
-* preserved verbatim on export but not imported into the rulesync model.
+* `allowReadonlyCommands` settings have no canonical per-glob slot: they are
+* authored and round-tripped through the `junie` override namespace (see
+* `JuniePermissionsOverrideSchema`) — lifted into the override on import and
+* merged back onto the top level on export — and any other unmodeled top-level
+* key is preserved verbatim.
 *
 * @see https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html
 */
@@ -18901,7 +19412,6 @@ const JUNIE_GROUP_TO_CANONICAL = {
 	mcpTools: "mcp",
 	readOutsideProject: "read"
 };
-const JUNIE_DEFAULT_BEHAVIOR = "ask";
 function isPermissionAction$1(value) {
 	return PermissionActionSchema.safeParse(value).success;
 }
@@ -18951,13 +19461,16 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Junie allowlist at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const rules = convertRulesyncToJunieRules({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
+		const override = config.junie;
+		const overrideObj = override !== void 0 && typeof override === "object" ? override : {};
 		const merged = {
 			...existing,
-			defaultBehavior: existing.defaultBehavior ?? JUNIE_DEFAULT_BEHAVIOR,
+			...overrideObj,
 			rules
 		};
 		return new JuniePermissions({
@@ -18977,7 +19490,12 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Junie permissions content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const config = convertJunieToRulesyncPermissions({ allowlist });
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const junieOverride = {};
+		if (typeof allowlist.allowReadonlyCommands === "boolean") junieOverride.allowReadonlyCommands = allowlist.allowReadonlyCommands;
+		if (typeof allowlist.defaultBehavior === "string") junieOverride.defaultBehavior = allowlist.defaultBehavior;
+		const result = { ...config };
+		if (Object.keys(junieOverride).length > 0) result.junie = junieOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -19009,12 +19527,13 @@ function convertRulesyncToJunieRules({ config, logger }) {
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(patterns)) {
+			const junieAction = toJunieAction(action, category, pattern, logger);
 			const rule = isGlobPattern(pattern) ? {
 				pattern,
-				action
+				action: junieAction
 			} : {
 				prefix: pattern,
-				action
+				action: junieAction
 			};
 			(rules[group] ??= []).push(rule);
 		}
@@ -19022,6 +19541,19 @@ function convertRulesyncToJunieRules({ config, logger }) {
 	return rules;
 }
 /**
+* Map a canonical action onto a valid Junie allowlist action. Junie supports
+* only `allow` and `ask`; a canonical `deny` is downgraded to `ask` (the
+* nearest valid action — both withhold auto-approval) with a warning, so
+* rulesync never emits a `deny` that Junie would silently ignore.
+*/
+function toJunieAction(action, category, pattern, logger) {
+	if (action === "deny") {
+		logger?.warn(`Junie's allowlist supports only 'allow'/'ask' actions; the '${category}' deny rule for '${pattern}' was downgraded to 'ask' (Junie has no 'deny').`);
+		return "ask";
+	}
+	return action;
+}
+/**
 * Convert a Junie allowlist back into rulesync permissions config. The
 * top-level `defaultBehavior` / `allowReadonlyCommands` settings have no
 * canonical equivalent and are not imported.
@@ -19055,6 +19587,31 @@ const KiloPermissionSchema = z.union([z.enum([
 ]))]);
 const KiloPermissionsConfigSchema = z.looseObject({ permission: z.optional(z.record(z.string(), KiloPermissionSchema)) });
 /**
+* Kilo permission keys that share a name with a canonical rulesync category and
+* therefore stay in the shared `permission` block. Everything else (Kilo-only
+* keys such as `external_directory`, `doom_loop`, `notebook_edit`, ...) is
+* routed into the `kilo` override on import so it does not leak into other
+* tools' configs. Kilo folds `write` into `edit`, uses `notebook_edit`/`task`
+* rather than the canonical `notebookedit`/`agent`, and has no `mcp` key (MCP is
+* addressed via `mcp__*` tool-name keys), so those canonical names are not Kilo
+* keys in practice — they simply never appear on the shared side.
+*/
+const KILO_SHARED_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedKiloCategory(key) {
+	return key === "*" || KILO_SHARED_CATEGORIES.has(key) || key.startsWith("mcp__");
+}
+/**
 * Parse a JSONC string and throw on syntax errors. The `jsonc-parser` `parse()` function is
 * non-throwing best-effort: invalid input silently yields a partial value (often `undefined`,
 * coerced to `{}` by callers). That behavior would silently drop a user's existing `deny` rules
@@ -19166,12 +19723,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		const parsed = parseKiloJsoncStrict(await readFileContentOrNull(filePath) ?? "{}", filePath);
 		const parsedPermission = parsed.permission;
 		const existingPermission = parsedPermission && typeof parsedPermission === "object" && !Array.isArray(parsedPermission) ? { ...parsedPermission } : {};
-		const rulesyncPermission = rulesyncPermissions.getJson().permission;
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const kiloOverride = rulesyncJson.kilo;
+		const incomingPermission = {
+			...rulesyncJson.permission,
+			...kiloOverride?.permission
+		};
 		const droppedDenyByKey = {};
-		for (const key of Object.keys(rulesyncPermission)) {
-			const previous = existingPermission[key];
-			const previousDenyPatterns = collectKiloDenyPatterns(previous);
-			const nextDenyPatterns = new Set(collectKiloDenyPatterns(rulesyncPermission[key]));
+		for (const [key, value] of Object.entries(incomingPermission)) {
+			const previousDenyPatterns = collectKiloDenyPatterns(existingPermission[key]);
+			const nextDenyPatterns = new Set(collectKiloDenyPatterns(value));
 			const dropped = previousDenyPatterns.filter((p) => !nextDenyPatterns.has(p));
 			if (dropped.length > 0) droppedDenyByKey[key] = dropped;
 		}
@@ -19179,8 +19740,10 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			const summary = Object.entries(droppedDenyByKey).map(([key, patterns]) => `${key}: [${patterns.join(", ")}]`).join("; ");
 			logger?.warn(`WARNING: Kilo permissions regeneration drops existing 'deny' rule(s) because rulesync output owns these tool keys. Dropped — ${summary}. To preserve these denies, add them to '.rulesync/permissions.json'.`);
 		}
-		const mergedPermission = { ...existingPermission };
-		for (const [key, value] of Object.entries(rulesyncPermission)) mergedPermission[key] = value;
+		const mergedPermission = {
+			...existingPermission,
+			...incomingPermission
+		};
 		const nextJson = {
 			...parsed,
 			permission: mergedPermission
@@ -19194,8 +19757,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission ?? {};
+		const shared = {};
+		const overrideOnly = {};
+		for (const [key, value] of Object.entries(rawPermission)) if (isSharedKiloCategory(key)) shared[key] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[key] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			kilo: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19225,10 +19796,6 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			validate: false
 		});
 	}
-	normalizePermission(permission) {
-		if (!permission) return {};
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
-	}
 };
 //#endregion
 //#region src/features/permissions/kiro-permissions.ts
@@ -19286,29 +19853,16 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 		}
 		const permission = {};
 		const toolsSettings = parsed.toolsSettings ?? {};
-		const shellSettings = asRecord$1(toolsSettings.shell);
-		const shellAllow = asStringArray(shellSettings.allowedCommands);
-		const shellDeny = asStringArray(shellSettings.deniedCommands);
-		if (shellAllow.length > 0 || shellDeny.length > 0) {
-			permission.bash = {};
-			for (const pattern of shellAllow) permission.bash[pattern] = "allow";
-			for (const pattern of shellDeny) permission.bash[pattern] = "deny";
-		}
-		const readSettings = asRecord$1(toolsSettings.read);
-		const readAllow = asStringArray(readSettings.allowedPaths);
-		const readDeny = asStringArray(readSettings.deniedPaths);
-		if (readAllow.length > 0 || readDeny.length > 0) {
-			permission.read = {};
-			for (const pattern of readAllow) permission.read[pattern] = "allow";
-			for (const pattern of readDeny) permission.read[pattern] = "deny";
-		}
-		const writeSettings = asRecord$1(toolsSettings.write);
-		const writeAllow = asStringArray(writeSettings.allowedPaths);
-		const writeDeny = asStringArray(writeSettings.deniedPaths);
-		if (writeAllow.length > 0 || writeDeny.length > 0) {
-			permission.write = {};
-			for (const pattern of writeAllow) permission.write[pattern] = "allow";
-			for (const pattern of writeDeny) permission.write[pattern] = "deny";
+		const shellRules = rulesFromArrays(asRecord$1(toolsSettings.shell), "allowedCommands", "deniedCommands");
+		if (Object.keys(shellRules).length > 0) permission.bash = shellRules;
+		for (const category of [
+			"read",
+			"write",
+			"grep",
+			"glob"
+		]) {
+			const rules = rulesFromArrays(asRecord$1(toolsSettings[category]), "allowedPaths", "deniedPaths");
+			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const allowedTools = new Set(parsed.allowedTools ?? []);
 		if (allowedTools.has("web_fetch")) permission.webfetch = { "*": "allow" };
@@ -19334,45 +19888,63 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 function buildKiroPermissionsFromRulesync({ config, logger, existing }) {
 	const nextAllowedTools = new Set(existing.allowedTools ?? []);
 	const nextToolsSettings = { ...asRecord$1(existing.toolsSettings) };
+	const pathBuckets = {};
+	const pushPath = (key, action, pattern) => {
+		const bucket = pathBuckets[key] ??= {
+			allow: [],
+			deny: []
+		};
+		(action === "allow" ? bucket.allow : bucket.deny).push(pattern);
+	};
 	const shell = {
 		allowedCommands: [],
 		deniedCommands: []
 	};
-	const read = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
-	const write = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
 	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
 		if (action === "ask") {
 			logger?.warn(`Kiro permissions do not support "ask". Skipping ${category}:${pattern}`);
 			continue;
 		}
 		if (category === "bash") (action === "allow" ? shell.allowedCommands : shell.deniedCommands).push(pattern);
-		else if (category === "read") (action === "allow" ? read.allowedPaths : read.deniedPaths).push(pattern);
-		else if (category === "edit" || category === "write") (action === "allow" ? write.allowedPaths : write.deniedPaths).push(pattern);
-		else if (category === "webfetch" || category === "websearch") {
-			if (pattern !== "*") {
-				logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
-				continue;
-			}
-			const toolName = category === "webfetch" ? "web_fetch" : "web_search";
-			if (action === "allow") nextAllowedTools.add(toolName);
-			else nextAllowedTools.delete(toolName);
-		} else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
+		else if (category === "read" || category === "grep" || category === "glob") pushPath(category, action, pattern);
+		else if (category === "edit" || category === "write") pushPath("write", action, pattern);
+		else if (category === "webfetch" || category === "websearch") applyKiroWebPermission({
+			category,
+			pattern,
+			action,
+			nextAllowedTools,
+			logger
+		});
+		else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
 	}
 	nextToolsSettings.shell = shell;
-	nextToolsSettings.read = read;
-	nextToolsSettings.write = write;
+	nextToolsSettings.read = pathTable(pathBuckets.read);
+	nextToolsSettings.write = pathTable(pathBuckets.write);
+	for (const key of ["grep", "glob"]) {
+		const bucket = pathBuckets[key];
+		if (bucket && (bucket.allow.length > 0 || bucket.deny.length > 0)) nextToolsSettings[key] = pathTable(bucket);
+	}
 	return {
 		...existing,
 		allowedTools: [...nextAllowedTools].toSorted(),
 		toolsSettings: nextToolsSettings
 	};
 }
+function pathTable(bucket) {
+	return {
+		allowedPaths: bucket?.allow ?? [],
+		deniedPaths: bucket?.deny ?? []
+	};
+}
+function applyKiroWebPermission({ category, pattern, action, nextAllowedTools, logger }) {
+	if (pattern !== "*") {
+		logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
+		return;
+	}
+	const toolName = category === "webfetch" ? "web_fetch" : "web_search";
+	if (action === "allow") nextAllowedTools.add(toolName);
+	else nextAllowedTools.delete(toolName);
+}
 function asRecord$1(value) {
 	const result = UnknownRecordSchema.safeParse(value);
 	return result.success ? result.data : {};
@@ -19380,6 +19952,17 @@ function asRecord$1(value) {
 function asStringArray(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
+/**
+* Build a canonical `{ pattern: action }` map from a Kiro tool settings record's
+* allow/deny string arrays (e.g. `allowedPaths`/`deniedPaths` or
+* `allowedCommands`/`deniedCommands`).
+*/
+function rulesFromArrays(settings, allowKey, denyKey) {
+	const rules = {};
+	for (const pattern of asStringArray(settings[allowKey])) rules[pattern] = "allow";
+	for (const pattern of asStringArray(settings[denyKey])) rules[pattern] = "deny";
+	return rules;
+}
 //#endregion
 //#region src/features/permissions/opencode-permissions.ts
 const OpencodePermissionSchema = z.union([z.enum([
@@ -19391,6 +19974,28 @@ const OpencodePermissionSchema = z.union([z.enum([
 	"ask",
 	"deny"
 ]))]);
+/**
+* Canonical rulesync permission categories that carry a cross-tool meaning (see
+* the "Supported tool categories" list in `docs/reference/file-formats.md`).
+* On import, any OpenCode category outside this set — plus MCP tool names — is
+* treated as OpenCode-only and routed into the `opencode` override block so a
+* subsequent `rulesync generate` does not leak it into other tools' configs.
+*/
+const CANONICAL_PERMISSION_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedPermissionCategory(category) {
+	return category === "*" || CANONICAL_PERMISSION_CATEGORIES.has(category) || category.startsWith("mcp__");
+}
 const OpencodePermissionsConfigSchema = z.looseObject({ permission: z.optional(z.union([z.enum([
 	"allow",
 	"ask",
@@ -19452,9 +20057,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
+		const parsed = parse(fileContent ?? "{}");
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const overridePermission = rulesyncJson.opencode?.permission ?? {};
 		const nextJson = {
-			...parse(fileContent ?? "{}"),
-			permission: rulesyncPermissions.getJson().permission
+			...parsed,
+			permission: {
+				...rulesyncJson.permission,
+				...overridePermission
+			}
 		};
 		return new OpencodePermissions({
 			outputRoot,
@@ -19465,8 +20076,20 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission;
+		if (rawPermission === void 0 || typeof rawPermission === "string") {
+			const permission = this.normalizePermission(rawPermission);
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		}
+		const shared = {};
+		const overrideOnly = {};
+		for (const [category, value] of Object.entries(rawPermission)) if (isSharedPermissionCategory(category)) shared[category] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[category] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			opencode: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19496,10 +20119,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			validate: false
 		});
 	}
+	/**
+	* Normalize the uniform/undefined forms of OpenCode's `permission` field into
+	* the canonical rulesync shape. The object form is handled directly in
+	* `toRulesyncPermissions` (it needs to split shared vs OpenCode-only
+	* categories), so this only covers the two remaining cases.
+	*/
 	normalizePermission(permission) {
 		if (!permission) return {};
-		if (typeof permission === "string") return { "*": { "*": permission } };
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
+		return { "*": { "*": permission } };
 	}
 };
 //#endregion
@@ -19573,6 +20201,24 @@ function buildQwenPermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
 	return `${toolName}(${pattern})`;
 }
+const QWEN_OVERRIDE_TOOLS_KEYS = [
+	"approvalMode",
+	"autoAccept",
+	"sandbox",
+	"sandboxImage",
+	"disabled"
+];
+const QWEN_OVERRIDE_SECURITY_KEYS = ["folderTrust"];
+function asPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+/** Pick the override-managed keys out of a settings group into a fresh record. */
+function pickQwenOverrideKeys(group, keys) {
+	const source = asPlainRecord(group);
+	const picked = {};
+	for (const key of keys) if (source[key] !== void 0) picked[key] = source[key];
+	return picked;
+}
 var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -19638,6 +20284,15 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			...settings,
 			permissions: mergedPermissions
 		};
+		const override = config.qwencode;
+		if (override?.tools !== void 0) merged.tools = {
+			...asPlainRecord(settings.tools),
+			...asPlainRecord(override.tools)
+		};
+		if (override?.security !== void 0) merged.security = {
+			...asPlainRecord(settings.security),
+			...asPlainRecord(override.security)
+		};
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new QwencodePermissions({
 			outputRoot,
@@ -19663,7 +20318,14 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const overrideTools = pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS);
+		const overrideSecurity = pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS);
+		const qwencodeOverride = {};
+		if (Object.keys(overrideTools).length > 0) qwencodeOverride.tools = overrideTools;
+		if (Object.keys(overrideSecurity).length > 0) qwencodeOverride.security = overrideSecurity;
+		const result = { ...config };
+		if (Object.keys(qwencodeOverride).length > 0) result.qwencode = qwencodeOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -19824,6 +20486,16 @@ function toPermissionsTable(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return { ...value };
 }
+const REASONIX_OVERRIDE_AGENT_KEYS = ["plan_mode_allowed_tools", "plan_mode_read_only_commands"];
+function asReasonixRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function pickReasonixKeys(source, keys) {
+	const record = asReasonixRecord(source);
+	const picked = {};
+	for (const key of keys) if (record[key] !== void 0) picked[key] = record[key];
+	return picked;
+}
 var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	toml;
 	constructor(params) {
@@ -19885,6 +20557,15 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			...parsed,
 			permissions: mergedPermissions
 		};
+		const override = config.reasonix;
+		if (override?.sandbox !== void 0) merged.sandbox = {
+			...asReasonixRecord(parsed.sandbox),
+			...asReasonixRecord(override.sandbox)
+		};
+		if (override?.agent !== void 0) merged.agent = {
+			...asReasonixRecord(parsed.agent),
+			...asReasonixRecord(override.agent)
+		};
 		const fileContent = smolToml.stringify(merged);
 		return new ReasonixPermissions({
 			outputRoot,
@@ -19901,7 +20582,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			ask: toStringArray$1(permissions.ask),
 			deny: toStringArray$1(permissions.deny)
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const sandbox = asReasonixRecord(this.toml.sandbox);
+		const agentPlanMode = pickReasonixKeys(this.toml.agent, REASONIX_OVERRIDE_AGENT_KEYS);
+		const reasonixOverride = {};
+		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
+		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
+		const result = { ...config };
+		if (Object.keys(reasonixOverride).length > 0) result.reasonix = reasonixOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -20465,6 +21153,7 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			if (deny.size > 0) nextTool.denylist = [...deny].toSorted();
 			tools[vibeToolName] = nextTool;
 		}
+		applyVibeSensitivePatterns(tools, rulesyncPermissions.getJson().vibe);
 		config.tools = tools;
 		if (enabledTools.size > 0) config.enabled_tools = [...enabledTools].toSorted();
 		else delete config.enabled_tools;
@@ -20481,16 +21170,25 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 	}
 	toRulesyncPermissions() {
 		const permission = {};
+		const vibeOverridePermission = {};
 		for (const tool of toStringArray(this.toml.enabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "allow";
 		for (const tool of toStringArray(this.toml.disabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "deny";
 		for (const [vibeToolName, toolConfig] of Object.entries(toVibeToolsRecord(this.toml.tools))) {
-			const rules = ensurePermission(permission, toCanonicalToolName$1(vibeToolName));
+			const category = toCanonicalToolName$1(vibeToolName);
+			const rules = ensurePermission(permission, category);
 			const action = fromVibePermission(toolConfig.permission);
 			if (action !== void 0) rules["*"] = action;
 			for (const pattern of toStringArray(toolConfig.allow ?? toolConfig.allowlist)) rules[pattern] = "allow";
 			for (const pattern of toStringArray(toolConfig.deny ?? toolConfig.denylist)) rules[pattern] = "deny";
+			const sensitivePatterns = toStringArray(toolConfig.sensitive_patterns);
+			if (sensitivePatterns.length > 0) vibeOverridePermission[category] = { sensitive_patterns: sensitivePatterns };
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
+		const json = Object.keys(vibeOverridePermission).length > 0 ? {
+			permission,
+			vibe: { permission: vibeOverridePermission }
+		} : { permission };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -20517,6 +21215,22 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		});
 	}
 };
+/**
+* Apply the Vibe-scoped override's per-tool `sensitive_patterns` (patterns that
+* escalate to ASK even when the base permission is ALWAYS). rulesync owns this
+* list for any category the override names: a present list is set, an empty
+* one clears it. Categories not named keep whatever the existing file had.
+*/
+function applyVibeSensitivePatterns(tools, vibeOverride) {
+	for (const [category, toolOverride] of Object.entries(vibeOverride?.permission ?? {})) {
+		const vibeToolName = toVibeToolName(category);
+		const nextTool = toVibeToolConfig(tools[vibeToolName]);
+		const patterns = toStringArray(toolOverride.sensitive_patterns);
+		if (patterns.length > 0) nextTool.sensitive_patterns = [...patterns].toSorted();
+		else delete nextTool.sensitive_patterns;
+		tools[vibeToolName] = nextTool;
+	}
+}
 function parseVibeConfig(fileContent) {
 	const parsed = smolToml.parse(fileContent || smolToml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -20561,6 +21275,11 @@ function ensurePermission(permission, category) {
 const WARP_GLOBAL_ONLY_MESSAGE = "Warp permissions are global-only; use --global to sync Warp's settings.toml";
 const ALLOWLIST_KEY = "agent_mode_command_execution_allowlist";
 const DENYLIST_KEY = "agent_mode_command_execution_denylist";
+const WARP_OVERRIDE_KEYS = [
+	"agent_mode_coding_permissions",
+	"agent_mode_coding_file_read_allowlist",
+	"agent_mode_execute_readonly_commands"
+];
 /**
 * Warp's `settings.toml` lives in a different directory per platform (Stable
 * channel). The home directory is resolved by the processor through
@@ -20596,8 +21315,16 @@ function warpSettingsDir() {
 * patterns as regexes when targeting Warp (mirrors the Zed permissions
 * adapter). Warp has no per-command "ask" list, so `ask` rules are dropped; and
 * the command lists only model shell commands, so non-`bash` categories are
-* skipped (with a warning when they carry `deny` rules). MCP allow/deny and the
-* file-read permissions are separate surfaces not modeled here.
+* skipped (with a warning when they carry `deny` rules).
+*
+* Warp's `[agents.profiles]` table also exposes file-read/read-only autonomy
+* knobs that do not fit the canonical `allow | ask | deny` per-command model:
+* `agent_mode_coding_permissions`, `agent_mode_coding_file_read_allowlist`, and
+* `agent_mode_execute_readonly_commands`. These are authored and round-tripped
+* through the `warp` override namespace (see `WarpPermissionsOverrideSchema`):
+* on **import** they are lifted from `settings.toml` into the override, and on
+* **export** they are merged back into `[agents.profiles]` (the override wins).
+* MCP allow/deny is a separate surface not modeled here.
 *
 * The `settings.toml` file holds all of Warp's settings, so the
 * `[agents.profiles]` block is merged in place and the file is never deleted.
@@ -20642,12 +21369,15 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Warp settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToWarpPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
 		const agents = isRecord(settings.agents) ? { ...settings.agents } : {};
 		const profiles = isRecord(agents.profiles) ? { ...agents.profiles } : {};
+		const override = config.warp;
+		if (isRecord(override)) Object.assign(profiles, override);
 		const mergedAllow = uniq(allow.toSorted());
 		const mergedDeny = uniq(deny.toSorted());
 		if (mergedAllow.length > 0) profiles[ALLOWLIST_KEY] = mergedAllow;
@@ -20678,7 +21408,11 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 			allow: isStringArray(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
 			deny: isStringArray(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const warpOverride = {};
+		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
+		const result = { ...config };
+		if (Object.keys(warpOverride).length > 0) result.warp = warpOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -24044,8 +24778,9 @@ const DevinSkillFrontmatterSchema = z.looseObject({
 * Represents a Devin (now Devin Desktop) skill directory.
 * Devin supports skills in both project mode under .devin/skills/
 * (preferred since the Devin Desktop rebrand; .devin/skills/ is the legacy
-* fallback the tool still reads) and global mode under ~/.codeium/windsurf/skills/
-* (unchanged by the rebrand).
+* fallback the tool still reads) and global mode under the Devin-native
+* ~/.config/devin/skills/ (consistent with Devin's global agents/rules paths;
+* the legacy channel-dependent ~/.codeium/<channel>/skills/ is no longer emitted).
 */
 var DevinSkill = class DevinSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = DevinSkill.getSettablePaths().relativeDirPath, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -24067,7 +24802,7 @@ var DevinSkill = class DevinSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global = false } = {}) {
-		if (global) return { relativeDirPath: CODEIUM_WINDSURF_SKILLS_DIR_PATH };
+		if (global) return { relativeDirPath: DEVIN_GLOBAL_SKILLS_DIR_PATH };
 		return { relativeDirPath: DEVIN_SKILLS_DIR_PATH };
 	}
 	getFrontmatter() {
@@ -27126,7 +27861,7 @@ const QwencodeSubagentFrontmatterSchema = z.looseObject({
 	disallowedTools: z.optional(z.array(z.string())),
 	maxTurns: z.optional(z.number()),
 	color: z.optional(z.string()),
-	mcpServers: z.optional(z.array(z.string())),
+	mcpServers: z.optional(z.union([z.array(z.string()), z.record(z.string(), z.looseObject({}))])),
 	hooks: z.optional(z.unknown())
 });
 var QwencodeSubagent = class QwencodeSubagent extends ToolSubagent {
@@ -37107,4 +37842,4 @@ async function importPermissionsCore(params) {
 //#endregion
 export { CLIError as $, IgnoreProcessor as A, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as At, toolCommandFactories as B, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Bt, PermissionsProcessorToolTargetSchema as C, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Ct, McpProcessorToolTargetSchema as D, RULESYNC_HOOKS_FILE_NAME as Dt, McpProcessor as E, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Et, HooksProcessorToolTargetSchema as F, RULESYNC_PERMISSIONS_FILE_NAME as Ft, CLAUDECODE_SKILLS_DIR_PATH as G, CLAUDECODE_LOCAL_RULE_FILE_NAME as H, formatError as Ht, toolHooksFactories as I, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as It, stringifyFrontmatter as J, RulesyncCommand as K, RulesyncHooks as L, RULESYNC_RELATIVE_DIR_PATH as Lt, toolIgnoreFactories as M, RULESYNC_MCP_RELATIVE_FILE_PATH as Mt, RulesyncIgnore as N, RULESYNC_MCP_SCHEMA_URL as Nt, toolMcpFactories as O, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Ot, HooksProcessor as P, RULESYNC_OVERVIEW_FILE_NAME as Pt, JsonLogger as Q, CommandsProcessor as R, RULESYNC_RULES_RELATIVE_DIR_PATH as Rt, PermissionsProcessor as S, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as St, RulesyncPermissions as T, RULESYNC_CONFIG_SCHEMA_URL as Tt, CLAUDECODE_MEMORIES_DIR_NAME as U, ALL_FEATURES as Ut, CLAUDECODE_DIR as V, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Vt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as W, ALL_FEATURES_WITH_WILDCARD as Wt, findControlCharacter as X, ConfigResolver as Y, ConsoleLogger as Z, toolSkillFactories as _, ALL_TOOL_TARGETS as _t, RulesProcessor as a, fileExists as at, RulesyncSkillFrontmatterSchema as b, MAX_FILE_SIZE as bt, RulesyncRule as c, getHomeDirectory as ct, SubagentsProcessorToolTargetSchema as d, readFileContent as dt, ErrorCodes as et, toolSubagentFactories as f, removeDirectory as ft, SkillsProcessorToolTargetSchema as g, writeFileContent as gt, SkillsProcessor as h, toPosixPath as ht, convertFromTool as i, ensureDir as it, IgnoreProcessorToolTargetSchema as j, RULESYNC_MCP_FILE_NAME as jt, RulesyncMcp as k, RULESYNC_IGNORE_RELATIVE_FILE_PATH as kt, RulesyncRuleFrontmatterSchema as l, isSymlink as lt, RulesyncSubagentFrontmatterSchema as m, removeTempDirectory as mt, checkRulesyncDirExists as n, createTempDirectory as nt, RulesProcessorToolTargetSchema as o, findFilesByGlobs as ot, RulesyncSubagent as p, removeFile as pt, RulesyncCommandFrontmatterSchema as q, generate as r, directoryExists as rt, toolRuleFactories as s, getFileSize as st, importFromTool as t, checkPathTraversal as tt, SubagentsProcessor as u, listDirectoryFiles as ut, getLocalSkillDirNames as v, ALL_TOOL_TARGETS_WITH_WILDCARD as vt, toolPermissionsFactories as w, RULESYNC_CONFIG_RELATIVE_FILE_PATH as wt, SKILL_FILE_NAME as x, RULESYNC_AIIGNORE_FILE_NAME as xt, RulesyncSkill as y, ToolTargetSchema as yt, CommandsProcessorToolTargetSchema as z, RULESYNC_SKILLS_RELATIVE_DIR_PATH as zt };
 
-//# sourceMappingURL=import-BkxwFCDM.js.map
+//# sourceMappingURL=import-B7VzSVUK.js.map