rulesync 9.2.0 → 9.3.0

package/dist/{import-H0MKtu9x.cjs → import-CE3Rx3Wt.cjs}

@@ -3029,8 +3029,8 @@ const DEVIN_SKILLS_DIR_PATH = (0, node_path.join)(DEVIN_DIR, "skills");
 const DEVIN_AGENTS_DIR_PATH = (0, node_path.join)(DEVIN_DIR, "agents");
 const DEVIN_GLOBAL_CONFIG_DIR_PATH = (0, node_path.join)(".config", "devin");
 const DEVIN_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(DEVIN_GLOBAL_CONFIG_DIR_PATH, "agents");
+const DEVIN_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(DEVIN_GLOBAL_CONFIG_DIR_PATH, "skills");
 const CODEIUM_WINDSURF_GLOBAL_WORKFLOWS_DIR_PATH = (0, node_path.join)(CODEIUM_WINDSURF_DIR, "global_workflows");
-const CODEIUM_WINDSURF_SKILLS_DIR_PATH = (0, node_path.join)(CODEIUM_WINDSURF_DIR, "skills");
 const DEVIN_CONFIG_FILE_NAME = "config.json";
 const DEVIN_HOOKS_V1_FILE_NAME = "hooks.v1.json";
 const DEVIN_GLOBAL_AGENTS_FILE_NAME = "AGENTS.md";
@@ -5715,6 +5715,8 @@ const DEEPAGENTS_HOOK_EVENTS = [
 	"sessionEnd",
 	"beforeSubmitPrompt",
 	"permissionRequest",
+	"preToolUse",
+	"postToolUse",
 	"postToolUseFailure",
 	"stop",
 	"preCompact",
@@ -5740,7 +5742,13 @@ const CODEXCLI_HOOK_EVENTS = [
 * Goose adopts the Open Plugins hooks spec: each plugin's `hooks/hooks.json`
 * maps PascalCase event names to matcher/handler arrays. Every Goose event has a
 * 1:1 canonical equivalent, so no new canonical events are required.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+*
+* Goose's `HookEvent` enum defines exactly these 11 events (v1.41.0). Notably it
+* has NO `SubagentStart`/`SubagentStop` arms — emitting them would write keys
+* Goose silently ignores, so `subagentStart`/`subagentStop` are intentionally
+* excluded here and from `CANONICAL_TO_GOOSE_EVENT_NAMES`.
+* @see https://github.com/block/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 const GOOSE_HOOK_EVENTS = [
 	"sessionStart",
@@ -5753,9 +5761,7 @@ const GOOSE_HOOK_EVENTS = [
 	"beforeReadFile",
 	"afterFileEdit",
 	"beforeShellExecution",
-	"afterShellExecution",
-	"subagentStart",
-	"subagentStop"
+	"afterShellExecution"
 ];
 /** Hook events supported by Kiro CLI. */
 const KIRO_HOOK_EVENTS = [
@@ -6208,9 +6214,7 @@ const CANONICAL_TO_GOOSE_EVENT_NAMES = {
 	beforeReadFile: "BeforeReadFile",
 	afterFileEdit: "AfterFileEdit",
 	beforeShellExecution: "BeforeShellExecution",
-	afterShellExecution: "AfterShellExecution",
-	subagentStart: "SubagentStart",
-	subagentStop: "SubagentStop"
+	afterShellExecution: "AfterShellExecution"
 };
 /**
 * Map Goose PascalCase event names to canonical camelCase.
@@ -6224,6 +6228,8 @@ const CANONICAL_TO_DEEPAGENTS_EVENT_NAMES = {
 	sessionEnd: "session.end",
 	beforeSubmitPrompt: "user.prompt",
 	permissionRequest: "permission.request",
+	preToolUse: "tool.use",
+	postToolUse: "tool.result",
 	postToolUseFailure: "tool.error",
 	stop: "task.complete",
 	preCompact: "context.compact",
@@ -8218,7 +8224,7 @@ const GOOSE_CONVERTER_CONFIG = {
 *
 * The JSON shape matches Claude Code's: each PascalCase event maps to an array of
 * `{ matcher, hooks: [{ type: "command", command }] }` entries.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 var GooseHooks = class GooseHooks extends ToolHooks {
 	constructor(params) {
@@ -8269,7 +8275,7 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 			throw new Error(`Failed to parse Goose hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: parsed.hooks,
+			hooks: parsed.hooks && typeof parsed.hooks === "object" && !Array.isArray(parsed.hooks) ? Object.fromEntries(Object.entries(parsed.hooks).filter(([eventName]) => Object.hasOwn(GOOSE_TO_CANONICAL_EVENT_NAMES, eventName))) : parsed.hooks,
 			converterConfig: GOOSE_CONVERTER_CONFIG
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify({
@@ -8324,6 +8330,24 @@ function mergeHermesConfig(fileContent, patch) {
 		...patch
 	});
 }
+/**
+* Recursively merge `patch` into `base` (patch wins). Nested plain objects are
+* merged key-by-key; every other value (arrays, scalars) is replaced wholesale.
+* Used to overlay the Hermes-scoped permission override onto the natively
+* emitted `approvals`/`security` structures without one clobbering the other
+* (e.g. `approvals.deny` from canonical deny rules coexisting with an
+* `approvals.mode` from the override). Prototype-pollution keys are dropped.
+*/
+function deepMergeHermesConfig(base, patch) {
+	const result = { ...base };
+	for (const [key, patchValue] of Object.entries(patch)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const baseValue = result[key];
+		if (isPlainObject(baseValue) && isPlainObject(patchValue)) result[key] = deepMergeHermesConfig(baseValue, patchValue);
+		else result[key] = sanitizeHermesConfigValue(patchValue);
+	}
+	return result;
+}
 //#endregion
 //#region src/features/hooks/hermesagent-hooks.ts
 /**
@@ -12306,6 +12330,38 @@ const RULESYNC_TO_CODEX_FIELD_MAP = {
 	envVars: "env_vars"
 };
 const MAX_REMOVE_EMPTY_ENTRIES_DEPTH$1 = 32;
+/**
+* Translate a server's `oauth` table from the canonical rulesync shape (Claude
+* Code style camelCase) into the shape Codex CLI understands. Codex expects the
+* OAuth client id under snake_case `client_id`; without it `codex mcp login`
+* falls back to dynamic client registration and fails for providers that do not
+* support it (e.g. Slack, see #2158). The canonical `clientId` is kept alongside
+* the added `client_id` so tools that read the camelCase shape keep working and
+* the round-trip stays stable.
+*/
+function mapOauthToCodex(oauth) {
+	const result = omitPrototypePollutionKeys(oauth);
+	if (typeof oauth["clientId"] === "string" && !("client_id" in result)) result["client_id"] = oauth["clientId"];
+	return result;
+}
+/**
+* Reverse of {@link mapOauthToCodex}: collapse Codex's `oauth.client_id` back to
+* the canonical `clientId` on import. When both keys are present (the shape
+* rulesync itself emits) the canonical `clientId` wins and `client_id` is
+* dropped so a subsequent generate does not accumulate duplicates.
+*/
+function mapOauthFromCodex(oauth) {
+	const result = {};
+	for (const [key, value] of Object.entries(oauth)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (key === "client_id") {
+			if (!("clientId" in oauth)) result["clientId"] = value;
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
 function convertFromCodexFormat(codexMcp) {
 	const result = {};
 	for (const [name, config] of Object.entries(codexMcp)) {
@@ -12315,7 +12371,8 @@ function convertFromCodexFormat(codexMcp) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "enabled") {
 				if (value === false) converted["disabled"] = true;
-			} else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthFromCodex(value);
+			else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
 				const mappedKey = CODEX_TO_RULESYNC_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `Ignored malformed array for ${key} in MCP server ${name}`);
@@ -12335,7 +12392,8 @@ function convertToCodexFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "disabled") {
 				if (value === true) converted["enabled"] = false;
-			} else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthToCodex(value);
+			else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
 				const mappedKey = RULESYNC_TO_CODEX_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string array, got ${typeof value}`);
@@ -13551,10 +13609,12 @@ function resolveHermesTimeout(config) {
 *
 * Hermes is close to the MCP spec but not identical: `command` must be a single
 * executable string (an array's tail folds into `args`), a server is disabled
-* via `enabled: false` (not the canonical `disabled: true`), and remote servers
-* use `url`/`headers`. Only fields Hermes understands are emitted, so the shared
-* `config.yaml` is not polluted with canonical-only aliases (`type`, `transport`,
-* `httpUrl`, `networkTimeout`, tool-filter keys, ...).
+* via `enabled: false` (not the canonical `disabled: true`), remote servers use
+* `url`/`headers`, and per-server tool scoping lives under a `tools: { include,
+* exclude }` block (from the canonical `enabledTools`/`disabledTools`). Only
+* fields Hermes understands are emitted, so the shared `config.yaml` is not
+* polluted with canonical-only aliases (`type`, `transport`, `httpUrl`,
+* `networkTimeout`, ...).
 */
 function convertServerToHermes(config) {
 	const out = {};
@@ -13578,6 +13638,10 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
+	const tools = {};
+	if (isStringArray(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
 }
 /**
@@ -13619,6 +13683,10 @@ function convertFromHermesFormat(mcpServers) {
 		if (isPlainObject(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
 		if (config.enabled === false) server.disabled = true;
 		if (typeof config.timeout === "number") server.networkTimeout = config.timeout;
+		if (isRecord(config.tools)) {
+			if (isStringArray(config.tools.include)) server.enabledTools = config.tools.include;
+			if (isStringArray(config.tools.exclude)) server.disabledTools = config.tools.exclude;
+		}
 		result[name] = server;
 	}
 	return result;
@@ -15774,17 +15842,232 @@ const PermissionActionSchema = zod_mini.z.enum([
 */
 const PermissionRulesSchema = zod_mini.z.record(zod_mini.z.string(), PermissionActionSchema);
 /**
+* OpenCode-specific permission value. Unlike the shared canonical block, which
+* only accepts a pattern-to-action map, OpenCode also allows a bare action
+* string that applies to the whole category (e.g. `"external_directory": "deny"`).
+* This mirrors OpenCode's own permission schema in `opencode-permissions.ts`.
+*/
+const OpencodeOverridePermissionValueSchema = zod_mini.z.union([PermissionActionSchema, PermissionRulesSchema]);
+/**
+* Tool-scoped override block for OpenCode. Permission categories placed here
+* (e.g. OpenCode-only categories such as `external_directory`) are emitted only
+* into OpenCode's config and never leak into other tools' permission files. It
+* also lets a shared category be overridden with an OpenCode-specific value.
+* Kept `looseObject` so future OpenCode categories are accepted.
+*
+* @example
+* { "permission": { "external_directory": "deny", "webfetch": "allow" } }
+*/
+const OpencodePermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Hermes Agent. Keys placed here are deep-merged
+* into Hermes's `~/.hermes/config.yaml` and never leak into other tools' configs.
+* It carries Hermes-specific approval/security controls that have no canonical
+* permission category — e.g. `approvals` (`mode`, `cron_mode`, ...),
+* `security` (`allow_private_urls`, ...), `skills.write_approval`,
+* `memory.write_approval`. Kept `looseObject` (a verbatim passthrough) so any
+* current or future Hermes config key can be authored without modeling each one.
+*
+* @example
+* { "approvals": { "mode": "smart" }, "security": { "allow_private_urls": false } }
+*/
+const HermesPermissionsOverrideSchema = zod_mini.z.looseObject({});
+/**
+* Tool-scoped override block for Cline. Cline's `command-permissions.json`
+* carries a single global `allowRedirects` boolean (gates shell redirection
+* operators `>`/`>>`/`<`) that has no per-command dimension and therefore no
+* canonical permission category. Placing it here lets users author it
+* declaratively; it is emitted only into Cline's config. Kept `looseObject` so
+* future Cline-only knobs can be added.
+*
+* @example
+* { "allowRedirects": true }
+*/
+const ClinePermissionsOverrideSchema = zod_mini.z.looseObject({ allowRedirects: zod_mini.z.optional(zod_mini.z.boolean()) });
+/**
+* Tool-scoped override block for Kilo Code (an OpenCode fork). Kilo's permission
+* object is a free-form record with tool-specific keys that have no canonical
+* category — OpenCode-inherited ones (`external_directory`, `doom_loop`, `lsp`,
+* `question`, `todowrite`, `skill`, `task`, `list`) and Kilo-unique ones
+* (`agent_manager`, `notebook_read`, `notebook_edit`, `notebook_execute`,
+* `repo_clone`, `repo_overview`). Placing them here makes them authorable and
+* portable and keeps them out of other tools' configs. Mirrors the OpenCode
+* override; each value may be a bare action string or a pattern map.
+*
+* @example
+* { "permission": { "external_directory": "deny", "doom_loop": "ask" } }
+*/
+const KiloPermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Claude Code. Claude Code's `permissions` object
+* (in `.claude/settings.json`) carries non-list fields that have no canonical
+* permission category — `defaultMode` (the session-start permission mode) and
+* `additionalDirectories` (extra working directories) being the primary ones.
+* Fields placed under `claudecode.permissions` are merged into the settings
+* `permissions` object and emitted only for Claude Code, while the shared
+* `permission` block continues to drive the `allow`/`ask`/`deny` arrays. Kept a
+* `looseObject` passthrough so any current or future `permissions` field can be
+* authored without modeling each one; the managed `allow`/`ask`/`deny` arrays are
+* ignored here (rulesync owns them).
+*
+* @example
+* { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
+*/
+const ClaudecodePermissionsOverrideSchema = zod_mini.z.looseObject({ permissions: zod_mini.z.optional(zod_mini.z.looseObject({})) });
+/**
+* Tool-scoped override block for Mistral Vibe. Vibe's per-tool `BaseToolConfig`
+* carries a `sensitive_patterns` list — patterns that escalate to ASK even when
+* the tool's base permission is ALWAYS (allow). The canonical model can only set
+* a pattern to a single `allow`/`ask`/`deny`, so an "allow by default but ask on
+* these patterns" escalation cannot be expressed. Entries under
+* `vibe.permission.<category>.sensitive_patterns` carry that list per canonical
+* category; the shared `permission` block still drives the base permission and
+* allow/deny lists. Keyed by canonical category (e.g. `bash`, `edit`).
+*
+* @example
+* { "permission": { "bash": { "sensitive_patterns": ["rm *", "sudo *"] } } }
+*/
+const VibePermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.looseObject({ sensitive_patterns: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) }))) });
+/**
+* Tool-scoped override block for Cursor CLI. Cursor's `cli.json` carries scalar
+* autonomy settings with no canonical permission category — `approvalMode`
+* (`allowlist` | `auto-review` | `unrestricted`) and a `sandbox` object
+* (`mode`/`networkAccess`). Fields placed here are merged into the top-level of
+* `.cursor/cli.json` (project) / `~/.cursor/cli-config.json` (global) and emitted
+* only for Cursor, while the shared `permission` block continues to drive the
+* `permissions.allow`/`permissions.deny` arrays. Kept a `looseObject` so extra
+* `cli.json` keys can be authored (they are merged verbatim on generate);
+* `sandbox`'s accepted values are not documented so it passes through verbatim.
+* Note: only `approvalMode` and `sandbox` round-trip back on import — other keys
+* authored here reach `cli.json` on generate but are not re-extracted.
+*
+* @example
+* { "approvalMode": "auto-review" }
+*/
+const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
+	approvalMode: zod_mini.z.optional(zod_mini.z.string()),
+	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Qwen Code. Qwen's `settings.json` exposes
+* autonomy/sandbox controls with no canonical permission category — under
+* `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
+* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`). Fields
+* placed here are merged into the matching `settings.json` group and emitted
+* only for Qwen, while the shared `permission` block continues to drive the
+* `permissions.allow`/`ask`/`deny` arrays. Kept `looseObject` (verbatim
+* passthrough) so any current or future `tools`/`security` key can be authored.
+*
+* @example
+* { "tools": { "approvalMode": "auto-edit" }, "security": { "folderTrust": { "enabled": true } } }
+*/
+const QwencodePermissionsOverrideSchema = zod_mini.z.looseObject({
+	tools: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	security: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Reasonix. Reasonix has security axes orthogonal
+* to per-tool allow/ask/deny with no canonical category — the `[sandbox]`
+* enforcement table (`workspace_root`, `allow_write`, `forbid_read`, `bash`,
+* `network`) and plan-mode read-only trust lists under `[agent]`
+* (`plan_mode_allowed_tools`, `plan_mode_read_only_commands`). Fields placed here
+* are merged into the matching `reasonix.toml` table and emitted only for
+* Reasonix, while the shared `permission` block continues to drive
+* `[permissions].allow`/`ask`/`deny`. Kept `looseObject` (verbatim passthrough).
+* Note: the whole `[sandbox]` table round-trips, but only the plan-mode keys are
+* re-extracted from `[agent]` on import — other `agent` keys authored here reach
+* `reasonix.toml` on generate but are not re-extracted back into the override.
+*
+* @example
+* { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
+*/
+const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
+	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	agent: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
+* exposes security controls with no canonical per-command allow/ask/deny slot —
+* `commandBlocklist` (a hard-block tier that can never be approved, distinct from
+* an approvable `deny`), `networkPolicy` (`allowedIps`), `sandbox`
+* (`enabled`/`mode`/`filesystem`/`network`), `mcpPolicy`, `enableDroidShield`,
+* and autonomy settings (`sessionDefaultSettings`, `maxAutonomyLevel`,
+* `interactionMode`). Fields placed here are merged into `settings.json` and
+* emitted only for Factory Droid, while the shared `permission` block continues
+* to drive `commandAllowlist`/`commandDenylist`. Kept `looseObject` passthrough.
+*
+* @example
+* { "commandBlocklist": ["rm -rf /*"], "sandbox": { "enabled": true } }
+*/
+const FactorydroidPermissionsOverrideSchema = zod_mini.z.looseObject({ commandBlocklist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) });
+/**
+* Tool-scoped override block for Warp. Warp's `[agents.profiles]` table exposes
+* file-read/read-only autonomy keys with no canonical per-command allow/ask/deny
+* slot — `agent_mode_coding_permissions`
+* (`always_ask_before_reading` | `always_allow_reading` | `allow_reading_specific_files`),
+* `agent_mode_coding_file_read_allowlist` (a path array), and
+* `agent_mode_execute_readonly_commands` (a read-only auto-execution boolean).
+* Fields placed here are merged into `[agents.profiles]` of Warp's global
+* `settings.toml`, while the shared `permission` block continues to drive the
+* `agent_mode_command_execution_allowlist`/`_denylist` command regex arrays.
+* Warp permissions are global-only.
+*
+* @example
+* { "agent_mode_coding_permissions": "always_allow_reading", "agent_mode_execute_readonly_commands": true }
+*/
+const WarpPermissionsOverrideSchema = zod_mini.z.looseObject({
+	agent_mode_coding_permissions: zod_mini.z.optional(zod_mini.z.string()),
+	agent_mode_coding_file_read_allowlist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	agent_mode_execute_readonly_commands: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* Tool-scoped override block for JetBrains Junie. Junie's `allowlist.json` has
+* two top-level autonomy knobs with no canonical per-glob slot:
+* `allowReadonlyCommands` (a boolean auto-allowing read-only commands) and
+* `defaultBehavior` (the fallback action applied when no rule matches — Junie
+* documents only `allow`/`ask`). Fields placed here are merged onto the
+* top level of `allowlist.json`, while the shared `permission` block continues
+* to drive the per-category `rules` groups.
+*
+* @example
+* { "allowReadonlyCommands": true, "defaultBehavior": "ask" }
+*/
+const JuniePermissionsOverrideSchema = zod_mini.z.looseObject({
+	allowReadonlyCommands: zod_mini.z.optional(zod_mini.z.boolean()),
+	defaultBehavior: zod_mini.z.optional(zod_mini.z.string())
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
+* The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
+* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie` keys are tool-scoped
+* overrides consumed only by their respective translator (see the matching
+* `*PermissionsOverrideSchema`); every other tool reads the shared `permission`
+* block and ignores them.
+*
 * @example
 * {
 *   "bash": { "*": "ask", "git *": "allow", "rm *": "deny" },
 *   "edit": { "*": "deny", "src/**": "allow" }
 * }
 */
-const PermissionsConfigSchema = zod_mini.z.looseObject({ permission: zod_mini.z.record(zod_mini.z.string(), PermissionRulesSchema) });
+const PermissionsConfigSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.record(zod_mini.z.string(), PermissionRulesSchema),
+	opencode: zod_mini.z.optional(OpencodePermissionsOverrideSchema),
+	hermes: zod_mini.z.optional(HermesPermissionsOverrideSchema),
+	cline: zod_mini.z.optional(ClinePermissionsOverrideSchema),
+	kilo: zod_mini.z.optional(KiloPermissionsOverrideSchema),
+	claudecode: zod_mini.z.optional(ClaudecodePermissionsOverrideSchema),
+	vibe: zod_mini.z.optional(VibePermissionsOverrideSchema),
+	cursor: zod_mini.z.optional(CursorPermissionsOverrideSchema),
+	qwencode: zod_mini.z.optional(QwencodePermissionsOverrideSchema),
+	reasonix: zod_mini.z.optional(ReasonixPermissionsOverrideSchema),
+	factorydroid: zod_mini.z.optional(FactorydroidPermissionsOverrideSchema),
+	warp: zod_mini.z.optional(WarpPermissionsOverrideSchema),
+	junie: zod_mini.z.optional(JuniePermissionsOverrideSchema)
+});
 /**
 * Full permissions file schema including optional $schema field.
 */
@@ -17155,6 +17438,14 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToClaudePermissions(config);
+		const overridePermissions = config.claudecode?.permissions;
+		if (overridePermissions && typeof overridePermissions === "object") {
+			const { allow: _a, ask: _k, deny: _d, ...nonListFields } = overridePermissions;
+			settings.permissions = {
+				...settings.permissions,
+				...nonListFields
+			};
+		}
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toClaudeToolName(category)));
 		const merged = applyPermissions({
 			settings,
@@ -17187,6 +17478,8 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
+		const { allow: _a, ask: _k, deny: _d, ...nonListFields } = permissions;
+		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17360,7 +17653,8 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Cline command-permissions at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(rulesyncPermissions.getJson().permission);
+		const config = rulesyncPermissions.getJson();
+		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(config.permission);
 		warnClineTranslationNotices({
 			droppedCategories,
 			translatedAskPatterns,
@@ -17376,7 +17670,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 			...existing,
 			allow: dedupedAllow,
 			deny: mergedDeny,
-			allowRedirects: existing.allowRedirects ?? false
+			allowRedirects: config.cline?.allowRedirects ?? existing.allowRedirects ?? false
 		};
 		return new ClinePermissions({
 			outputRoot,
@@ -17400,6 +17694,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		for (const pattern of parsed.allow ?? []) bashRules[pattern] = "allow";
 		for (const pattern of parsed.deny ?? []) bashRules[pattern] = "deny";
 		const config = Object.keys(bashRules).length > 0 ? { permission: { bash: bashRules } } : { permission: {} };
+		if (parsed.allowRedirects === true) config.cline = { allowRedirects: true };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17836,13 +18131,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX = "mcp__";
+const MCP_CANONICAL_PREFIX$1 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$1) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -17873,7 +18168,7 @@ function toCursorPattern(canonical, pattern) {
 function toCanonicalCategory$1(cursorType, pattern) {
 	if (cursorType === "Mcp") {
 		const match = pattern.match(/^([^:()]+):([^:()]+)$/);
-		if (match) return `${MCP_CANONICAL_PREFIX}${match[1] ?? "*"}__${match[2] ?? "*"}`;
+		if (match) return `${MCP_CANONICAL_PREFIX$1}${match[1] ?? "*"}__${match[2] ?? "*"}`;
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
 	return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
@@ -18007,8 +18302,10 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		mergedPermissions.allow = mergedAllow;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
+		const cursorOverride = config.cursor;
 		const merged = {
 			...settings,
+			...cursorOverride,
 			version: settings.version ?? 1,
 			editor: {
 				...existingEditor,
@@ -18034,11 +18331,15 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		}
 		const permissionsRaw = settings.permissions;
 		const permissions = permissionsRaw !== null && typeof permissionsRaw === "object" && !Array.isArray(permissionsRaw) ? permissionsRaw : {};
-		const config = convertCursorToRulesyncPermissions({
+		const result = { ...convertCursorToRulesyncPermissions({
 			allow: asCursorPermissionEntryArray(permissions.allow),
 			deny: asCursorPermissionEntryArray(permissions.deny)
-		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		}) };
+		const cursorOverride = {};
+		if (settings.approvalMode !== void 0) cursorOverride.approvalMode = settings.approvalMode;
+		if (settings.sandbox !== null && typeof settings.sandbox === "object" && !Array.isArray(settings.sandbox)) cursorOverride.sandbox = settings.sandbox;
+		if (Object.keys(cursorOverride).length > 0) result.cursor = cursorOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18097,7 +18398,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { type, pattern } = parseCursorPermissionEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$1) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -18346,6 +18647,16 @@ function convertDevinToRulesyncPermissions(params) {
 }
 //#endregion
 //#region src/features/permissions/factorydroid-permissions.ts
+const FACTORYDROID_OVERRIDE_KEYS = [
+	"commandBlocklist",
+	"networkPolicy",
+	"sandbox",
+	"mcpPolicy",
+	"enableDroidShield",
+	"sessionDefaultSettings",
+	"maxAutonomyLevel",
+	"interactionMode"
+];
 /**
 * Permissions adapter for Factory Droid.
 *
@@ -18363,18 +18674,14 @@ function convertDevinToRulesyncPermissions(params) {
 * skipped (with a warning when they carry `deny` rules, to surface the gap).
 *
 * Factory Droid also has a stronger `commandBlocklist` tier — commands that can
-* never run, not even under full autonomy. rulesync's canonical action model
-* has only `allow | ask | deny`, with no equivalent of a hard block that can
-* never be approved. So on **import** a `commandBlocklist` entry is collapsed
-* onto canonical `deny` (lossy: the never-runs guarantee is weakened to a deny
-* the user can still approve), rather than being silently dropped. On **export**
-* there is no canonical `block` to emit one from, so rulesync never writes
-* `commandBlocklist`; an existing one on disk is preserved verbatim as an
-* unmanaged key. (A consequence of the lossy collapse: importing a
-* `commandBlocklist` and re-exporting it to a *fresh* config writes it back as
-* `commandDenylist`, not `commandBlocklist` — the hard-block tier is not
-* reconstructed. Re-running over the original file keeps it intact via the
-* verbatim preservation above.)
+* never run, not even under full autonomy — plus other security controls
+* (`networkPolicy`, `sandbox`, `mcpPolicy`, `enableDroidShield`, autonomy
+* settings) that do not fit the canonical `allow | ask | deny` per-command
+* model. These are authored and round-tripped through the `factorydroid`
+* override namespace (see `FactorydroidPermissionsOverrideSchema`): on **import**
+* they are lifted from `settings.json` into the override, and on **export** they
+* are merged back in — so `commandBlocklist`'s never-runs guarantee is preserved
+* faithfully rather than being collapsed onto an approvable `deny`.
 */
 var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissions {
 	constructor(params) {
@@ -18417,11 +18724,16 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		} catch (error) {
 			throw new Error(`Failed to parse existing Factory Droid settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToFactorydroidPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
-		const merged = { ...settings };
+		const override = config.factorydroid;
+		const merged = {
+			...settings,
+			...override !== void 0 && typeof override === "object" ? override : {}
+		};
 		const mergedAllow = (0, es_toolkit.uniq)(allow.toSorted());
 		const mergedDeny = (0, es_toolkit.uniq)(deny.toSorted());
 		if (mergedAllow.length > 0) merged.commandAllowlist = mergedAllow;
@@ -18445,10 +18757,13 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		}
 		const config = convertFactorydroidToRulesyncPermissions({
 			allow: Array.isArray(settings.commandAllowlist) ? settings.commandAllowlist : [],
-			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : [],
-			block: Array.isArray(settings.commandBlocklist) ? settings.commandBlocklist : []
+			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const factorydroidOverride = {};
+		for (const key of FACTORYDROID_OVERRIDE_KEYS) if (settings[key] !== void 0) factorydroidOverride[key] = settings[key];
+		const result = { ...config };
+		if (Object.keys(factorydroidOverride).length > 0) result.factorydroid = factorydroidOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18495,18 +18810,18 @@ function convertRulesyncToFactorydroidPermissions({ config, logger }) {
 	};
 }
 /**
-* Convert Factory Droid allow/deny/block command lists back to rulesync config
-* under the `bash` category.
+* Convert Factory Droid allow/deny command lists back to rulesync config under
+* the `bash` category.
 *
-* `commandBlocklist` (hard block) has no canonical equivalent, so it collapses
-* onto `deny` — lossy (a deny can still be approved), but preferable to dropping
-* the rule entirely.
+* `commandBlocklist` (the hard-block tier) is no longer collapsed here — it has
+* no canonical equivalent and now round-trips through the `factorydroid`
+* override so the never-runs guarantee is preserved instead of being weakened to
+* an approvable `deny`.
 */
-function convertFactorydroidToRulesyncPermissions({ allow, deny, block }) {
+function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 	const bash = {};
 	for (const pattern of allow) bash[pattern] = "allow";
 	for (const pattern of deny) bash[pattern] = "deny";
-	for (const pattern of block) bash[pattern] = "deny";
 	return { permission: Object.keys(bash).length > 0 ? { bash } : {} };
 }
 //#endregion
@@ -18700,30 +19015,114 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 const GROKCLI_GLOBAL_ONLY_MESSAGE = "Grok CLI permissions are global-only; use --global to sync ~/.grok/config.toml";
 const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
+const GROKCLI_PERMISSION_KEY = "permission";
 const CATCH_ALL_PATTERN$2 = "*";
+const MCP_CANONICAL_PREFIX = "mcp__";
+const CATEGORY_TO_GROK_TOOL = {
+	bash: "Bash",
+	read: "Read",
+	edit: "Edit",
+	write: "Edit",
+	grep: "Grep",
+	webfetch: "WebFetch"
+};
+const GROK_TOOL_TO_CATEGORY = {
+	Bash: "bash",
+	Read: "read",
+	Edit: "edit",
+	Grep: "grep",
+	WebFetch: "webfetch"
+};
+const GROK_MCP_TOOL = "MCPTool";
+/**
+* Build a Grok Claude-style permission entry (e.g. `Bash(git *)`, `Read`,
+* `MCPTool(server__tool)`) from a canonical category + pattern. Returns `null`
+* for categories Grok cannot express so callers can skip them.
+*
+* Scoped MCP categories (`mcp__<remainder>`) fold their address into the
+* parentheses (`MCPTool(<remainder>)`); the bare `mcp` category becomes
+* `MCPTool`. For every other tool, a `*` pattern emits the bare tool name and a
+* concrete pattern emits `Tool(pattern)`.
+*/
+function buildGrokEntry(category, pattern) {
+	if (category.startsWith(MCP_CANONICAL_PREFIX)) {
+		const remainder = category.slice(5);
+		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
+	}
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	const tool = CATEGORY_TO_GROK_TOOL[category];
+	if (tool === void 0) return null;
+	return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? tool : `${tool}(${pattern})`;
+}
+/**
+* Parse a Grok Claude-style permission entry back into a canonical category +
+* pattern. Entries without parentheses are treated as catch-all (`*`). Returns
+* `null` for tool prefixes with no canonical equivalent (e.g. `any`).
+*/
+function parseGrokEntry(entry) {
+	const trimmed = entry.trim();
+	const parenIndex = trimmed.indexOf("(");
+	let tool;
+	let inner;
+	if (parenIndex === -1 || !trimmed.endsWith(")")) {
+		tool = trimmed;
+		inner = "";
+	} else {
+		tool = trimmed.slice(0, parenIndex);
+		inner = trimmed.slice(parenIndex + 1, -1).trim();
+	}
+	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
+		category: `${MCP_CANONICAL_PREFIX}${inner}`,
+		pattern: CATCH_ALL_PATTERN$2
+	} : {
+		category: "mcp",
+		pattern: CATCH_ALL_PATTERN$2
+	};
+	const category = GROK_TOOL_TO_CATEGORY[tool];
+	if (category === void 0) return null;
+	return {
+		category,
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$2
+	};
+}
 /**
 * Permissions adapter for the xAI Grok Build CLI (`grokcli`).
 *
-* Grok has no per-tool / per-pattern permission rules. Tool gating is a single
-* coarse toggle, `[ui] permission_mode`, in `~/.grok/config.toml`:
-*   - `ask` — prompt before each tool call (Grok's default).
-*   - `always-approve` — skip prompts.
-*
-* rulesync's permission model is per-category, per-pattern `allow`/`ask`/`deny`,
-* so the mapping is **lossy** (a single mode cannot express per-pattern rules):
-*   - Generate: any `deny` or `ask` rule anywhere ⇒ `ask` (conservative — keep
-*     prompting whenever the user expressed any restriction); otherwise, if at
-*     least one `allow` rule exists and nothing is denied/asked ⇒
-*     `always-approve`; an empty config falls back to the safe default `ask`.
-*   - Import: `always-approve` ⇒ `bash: { "*": "allow" }`; `ask` (or unset) ⇒
-*     `bash: { "*": "ask" }`. `bash` is used as the representative catch-all
-*     because it is the primary permission-gated surface, and this round-trips
-*     the generate mapping.
-*
-* This surface is **global only** — `permission_mode` lives in the user-level
-* `~/.grok/config.toml`; Grok has no project-scoped permission file. The shared
-* config is merged in place: the `[ui] permission_mode` value is set and every
-* other key (e.g. `[mcp_servers]`, legacy `approval_mode`) is preserved. The
+* Grok Build CLI ships a Claude-style rule system under `[permission]` in
+* `~/.grok/config.toml`: `allow` / `deny` / `ask` arrays of entries such as
+* `Bash(git *)`, `Read(src/**)`, `Edit`, `Grep`, `MCPTool(server__tool)`, and
+* `WebFetch`, evaluated with precedence `deny > ask > allow`
+* (https://docs.x.ai/build/settings/reference). rulesync's canonical
+* per-category, per-pattern model maps almost 1:1:
+*   - Generate: each `permission.<category>.<pattern> = allow|ask|deny` becomes
+*     the matching Grok entry and is bucketed into the `[permission]` array for
+*     that action. `bash|read|edit|grep|webfetch` map to their Grok tool;
+*     `write` collapses onto `Edit` (Grok has no `Write` tool); `mcp__*` maps to
+*     `MCPTool(...)` (a scoped MCP category folds its address into the
+*     parentheses, so a non-`*` argument pattern on it is not represented).
+*     Categories with no Grok tool (`websearch`, `glob`, `notebookedit`,
+*     `agent`) are skipped (with a warning when they carry a `deny` rule, to
+*     surface the gap). When two canonical rules collapse onto the same Grok
+*     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
+*     the strictest wins (`deny > ask > allow`) and a warning is logged, so the
+*     entry never lands contradictorily in two arrays.
+*   - Import: the `[permission]` arrays are parsed back into canonical
+*     categories. When no `[permission]` section is present (older configs), the
+*     coarse `[ui] permission_mode` is used as a fallback.
+*
+* The coarse `[ui] permission_mode` toggle is still written for backward
+* compatibility with older Grok versions: `always-approve` when the config is
+* pure-`allow`, otherwise `ask` (conservative — it is never `always-approve`
+* while any `deny`/`ask` rule exists, so it never contradicts the fine-grained
+* arrays).
+*
+* This surface is **global only** — the adapter syncs the user-level
+* `~/.grok/config.toml`. (Grok also supports a project-scoped `[permission]`
+* file; project scope is not modeled here.) The shared config is merged in
+* place: rulesync owns the `[permission]` `allow`/`deny`/`ask` entries for the
+* tools it models and the `[ui] permission_mode` value, while every other key
+* (e.g. `[mcp_servers]`, `[permission] rules`, `[sandbox]`) and any user-authored
+* entries for tools rulesync cannot model (e.g. `WebSearch`) are preserved. The
 * file is never deleted.
 */
 var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
@@ -18755,7 +19154,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			global: true
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
 		if (!global) throw new Error(GROKCLI_GLOBAL_ONLY_MESSAGE);
 		const paths = GrokcliPermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -18766,7 +19165,16 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Grok config.toml at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const mode = deriveGrokPermissionMode(rulesyncPermissions.getJson());
+		const config = rulesyncPermissions.getJson();
+		const existingPermission = isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {};
+		const buckets = buildGrokPermissionArrays(config, existingPermission, logger);
+		parsed[GROKCLI_PERMISSION_KEY] = {
+			...existingPermission,
+			allow: buckets.allow,
+			deny: buckets.deny,
+			ask: buckets.ask
+		};
+		const mode = deriveGrokPermissionMode(config);
 		const existingUi = isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {};
 		parsed[GROKCLI_UI_KEY] = {
 			...existingUi,
@@ -18789,8 +19197,8 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const action = (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
-		const rulesyncConfig = { permission: { bash: { [CATCH_ALL_PATTERN$2]: action } } };
+		const fineGrained = parseGrokPermissionArrays(isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$2]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -18810,6 +19218,84 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		});
 	}
 };
+const ACTION_RANK = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Collect user-authored entries from an existing `[permission]` array whose
+* tool prefix rulesync cannot model (e.g. `WebSearch`, `any`). Such entries are
+* preserved verbatim so replacing the arrays does not silently drop them
+* (mirrors the Cursor adapter's preservation of unmanaged types).
+*/
+function unmanagedEntries(existingPermission, key) {
+	return (isStringArray(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+}
+/**
+* Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
+* Claude-style entries, resolving collapse collisions via `deny > ask > allow`.
+* Categories Grok cannot express are skipped (with a warning when they carry a
+* `deny` rule); entries the user authored for tools rulesync cannot model are
+* preserved from `existingPermission`.
+*/
+function buildGrokPermissionArrays(config, existingPermission, logger) {
+	const ranked = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+		const entry = buildGrokEntry(category, pattern);
+		if (entry === null) {
+			if (action === "deny" && logger) logger.warn(`Grok CLI has no permission tool for the '${category}' category; its 'deny' rule could not be represented and was skipped.`);
+			continue;
+		}
+		const existing = ranked.get(entry);
+		if (existing !== void 0 && existing !== action) logger?.warn(`Grok permission entry '${entry}' received conflicting actions ('${existing}' and '${action}'); keeping the stricter one (deny > ask > allow).`);
+		if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) ranked.set(entry, action);
+	}
+	const allow = unmanagedEntries(existingPermission, "allow");
+	const deny = unmanagedEntries(existingPermission, "deny");
+	const ask = unmanagedEntries(existingPermission, "ask");
+	for (const [entry, action] of ranked) if (action === "allow") allow.push(entry);
+	else if (action === "deny") deny.push(entry);
+	else ask.push(entry);
+	return {
+		allow: (0, es_toolkit.uniq)(allow.toSorted()),
+		deny: (0, es_toolkit.uniq)(deny.toSorted()),
+		ask: (0, es_toolkit.uniq)(ask.toSorted())
+	};
+}
+/**
+* Parse Grok's `[permission]` allow/deny/ask arrays back into a canonical
+* permission map. Returns `null` when the section defines none of the three
+* arrays, so the caller can fall back to the coarse `permission_mode`.
+* Precedence `deny > ask > allow` is applied so a tool listed in multiple
+* arrays resolves to the strictest action.
+*/
+function parseGrokPermissionArrays(permission) {
+	const allow = isStringArray(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray(permission.ask) ? permission.ask : void 0;
+	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) === 0) return null;
+	const result = {};
+	const apply = (entries, action) => {
+		for (const entry of entries ?? []) {
+			const parsed = parseGrokEntry(entry);
+			if (parsed === null) continue;
+			const bucket = result[parsed.category] ??= {};
+			bucket[parsed.pattern] = action;
+		}
+	};
+	apply(allow, "allow");
+	apply(ask, "ask");
+	apply(deny, "deny");
+	return result;
+}
+/**
+* Legacy coarse fallback: map `[ui] permission_mode` to a canonical action.
+* `always-approve` ⇒ `allow`; anything else (including a missing mode) ⇒ `ask`.
+*/
+function legacyModeAction(parsed) {
+	return (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
+}
 /**
 * Collapse a rulesync permissions config into Grok's single coarse mode.
 * Any `deny`/`ask` rule anywhere keeps prompting (`ask`); otherwise an existing
@@ -18825,6 +19311,10 @@ function deriveGrokPermissionMode(config) {
 }
 //#endregion
 //#region src/features/permissions/hermesagent-permissions.ts
+/** Collect the glob patterns in a canonical category that carry a given action. */
+function patternsByAction(category, action) {
+	return Object.entries(category ?? {}).filter(([, value]) => value === action).map(([pattern]) => pattern);
+}
 var HermesagentPermissions = class HermesagentPermissions extends ToolPermissions {
 	static getSettablePaths() {
 		return {
@@ -18848,7 +19338,11 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		return true;
 	}
 	setFileContent(fileContent) {
-		this.fileContent = mergeHermesConfig(fileContent, parseHermesConfig(this.fileContent));
+		const existing = parseHermesConfig(fileContent);
+		const generated = parseHermesConfig(this.fileContent);
+		const merged = deepMergeHermesConfig(existing, generated);
+		if (generated.permissions !== void 0) merged.permissions = generated.permissions;
+		this.fileContent = stringifyHermesConfig(merged);
 	}
 	toRulesyncPermissions() {
 		const config = parseHermesConfig(this.getFileContent());
@@ -18861,12 +19355,22 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 	}
 	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions }) {
 		const permissions = rulesyncPermissions.getJson();
+		const permissionBlock = permissions.permission ?? {};
+		const commandAllowlist = Object.entries(permissionBlock).flatMap(([, patterns]) => patternsByAction(patterns, "allow"));
+		const bashDeny = patternsByAction(permissionBlock.bash, "deny");
+		const webfetchDeny = patternsByAction(permissionBlock.webfetch, "deny");
+		let config = {};
+		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
+		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
+		if (webfetchDeny.length > 0) config.security = { website_blocklist: {
+			enabled: true,
+			domains: webfetchDeny
+		} };
+		if (permissions.hermes && typeof permissions.hermes === "object") config = deepMergeHermesConfig(config, permissions.hermes);
+		config.permissions = { rulesync: permissions };
 		return new HermesagentPermissions({
 			outputRoot,
-			fileContent: stringifyHermesConfig({
-				command_allowlist: Object.entries(permissions.permission ?? {}).flatMap(([, patterns]) => Object.entries(patterns).filter(([, action]) => action === "allow").map(([command]) => command)),
-				permissions: { rulesync: permissions }
-			})
+			fileContent: stringifyHermesConfig(config)
 		});
 	}
 };
@@ -18887,14 +19391,18 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *     "executables":       [ { "prefix": "git ", "action": "allow" } ],
 *     "fileEditing":       [ { "pattern": "src/**", "action": "allow" } ],
 *     "mcpTools":          [ { "prefix": "search", "action": "allow" } ],
-*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "deny" } ]
+*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "ask" } ]
 *   }
 * }
 * ```
 *
 * Each rule carries a literal `prefix` (matches commands that start with it) or
-* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`
-* (`allow` | `ask` | `deny`). rulesync's canonical actions map 1:1 onto Junie's.
+* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`. Junie
+* documents only `allow` and `ask` as valid actions — there is **no `deny`**
+* (https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html). rulesync's
+* canonical `allow`/`ask` map 1:1; a canonical `deny` has no Junie equivalent
+* and is mapped to the nearest valid action, `ask` (still withholds
+* auto-approval), with a warning so the downgrade is surfaced.
 *
 * Category mapping (rulesync canonical <-> Junie rule group):
 * - `bash`         <-> `executables`
@@ -18904,8 +19412,11 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *
 * Categories Junie cannot represent (e.g. `webfetch`) are skipped on export
 * (with a warning when they carry rules). The top-level `defaultBehavior` and
-* `allowReadonlyCommands` settings have no canonical equivalent: they are
-* preserved verbatim on export but not imported into the rulesync model.
+* `allowReadonlyCommands` settings have no canonical per-glob slot: they are
+* authored and round-tripped through the `junie` override namespace (see
+* `JuniePermissionsOverrideSchema`) — lifted into the override on import and
+* merged back onto the top level on export — and any other unmodeled top-level
+* key is preserved verbatim.
 *
 * @see https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html
 */
@@ -18928,7 +19439,6 @@ const JUNIE_GROUP_TO_CANONICAL = {
 	mcpTools: "mcp",
 	readOutsideProject: "read"
 };
-const JUNIE_DEFAULT_BEHAVIOR = "ask";
 function isPermissionAction$1(value) {
 	return PermissionActionSchema.safeParse(value).success;
 }
@@ -18978,13 +19488,16 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Junie allowlist at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const rules = convertRulesyncToJunieRules({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
+		const override = config.junie;
+		const overrideObj = override !== void 0 && typeof override === "object" ? override : {};
 		const merged = {
 			...existing,
-			defaultBehavior: existing.defaultBehavior ?? JUNIE_DEFAULT_BEHAVIOR,
+			...overrideObj,
 			rules
 		};
 		return new JuniePermissions({
@@ -19004,7 +19517,12 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Junie permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const config = convertJunieToRulesyncPermissions({ allowlist });
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const junieOverride = {};
+		if (typeof allowlist.allowReadonlyCommands === "boolean") junieOverride.allowReadonlyCommands = allowlist.allowReadonlyCommands;
+		if (typeof allowlist.defaultBehavior === "string") junieOverride.defaultBehavior = allowlist.defaultBehavior;
+		const result = { ...config };
+		if (Object.keys(junieOverride).length > 0) result.junie = junieOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -19036,12 +19554,13 @@ function convertRulesyncToJunieRules({ config, logger }) {
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(patterns)) {
+			const junieAction = toJunieAction(action, category, pattern, logger);
 			const rule = isGlobPattern(pattern) ? {
 				pattern,
-				action
+				action: junieAction
 			} : {
 				prefix: pattern,
-				action
+				action: junieAction
 			};
 			(rules[group] ??= []).push(rule);
 		}
@@ -19049,6 +19568,19 @@ function convertRulesyncToJunieRules({ config, logger }) {
 	return rules;
 }
 /**
+* Map a canonical action onto a valid Junie allowlist action. Junie supports
+* only `allow` and `ask`; a canonical `deny` is downgraded to `ask` (the
+* nearest valid action — both withhold auto-approval) with a warning, so
+* rulesync never emits a `deny` that Junie would silently ignore.
+*/
+function toJunieAction(action, category, pattern, logger) {
+	if (action === "deny") {
+		logger?.warn(`Junie's allowlist supports only 'allow'/'ask' actions; the '${category}' deny rule for '${pattern}' was downgraded to 'ask' (Junie has no 'deny').`);
+		return "ask";
+	}
+	return action;
+}
+/**
 * Convert a Junie allowlist back into rulesync permissions config. The
 * top-level `defaultBehavior` / `allowReadonlyCommands` settings have no
 * canonical equivalent and are not imported.
@@ -19082,6 +19614,31 @@ const KiloPermissionSchema = zod_mini.z.union([zod_mini.z.enum([
 ]))]);
 const KiloPermissionsConfigSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), KiloPermissionSchema)) });
 /**
+* Kilo permission keys that share a name with a canonical rulesync category and
+* therefore stay in the shared `permission` block. Everything else (Kilo-only
+* keys such as `external_directory`, `doom_loop`, `notebook_edit`, ...) is
+* routed into the `kilo` override on import so it does not leak into other
+* tools' configs. Kilo folds `write` into `edit`, uses `notebook_edit`/`task`
+* rather than the canonical `notebookedit`/`agent`, and has no `mcp` key (MCP is
+* addressed via `mcp__*` tool-name keys), so those canonical names are not Kilo
+* keys in practice — they simply never appear on the shared side.
+*/
+const KILO_SHARED_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedKiloCategory(key) {
+	return key === "*" || KILO_SHARED_CATEGORIES.has(key) || key.startsWith("mcp__");
+}
+/**
 * Parse a JSONC string and throw on syntax errors. The `jsonc-parser` `parse()` function is
 * non-throwing best-effort: invalid input silently yields a partial value (often `undefined`,
 * coerced to `{}` by callers). That behavior would silently drop a user's existing `deny` rules
@@ -19193,12 +19750,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		const parsed = parseKiloJsoncStrict(await readFileContentOrNull(filePath) ?? "{}", filePath);
 		const parsedPermission = parsed.permission;
 		const existingPermission = parsedPermission && typeof parsedPermission === "object" && !Array.isArray(parsedPermission) ? { ...parsedPermission } : {};
-		const rulesyncPermission = rulesyncPermissions.getJson().permission;
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const kiloOverride = rulesyncJson.kilo;
+		const incomingPermission = {
+			...rulesyncJson.permission,
+			...kiloOverride?.permission
+		};
 		const droppedDenyByKey = {};
-		for (const key of Object.keys(rulesyncPermission)) {
-			const previous = existingPermission[key];
-			const previousDenyPatterns = collectKiloDenyPatterns(previous);
-			const nextDenyPatterns = new Set(collectKiloDenyPatterns(rulesyncPermission[key]));
+		for (const [key, value] of Object.entries(incomingPermission)) {
+			const previousDenyPatterns = collectKiloDenyPatterns(existingPermission[key]);
+			const nextDenyPatterns = new Set(collectKiloDenyPatterns(value));
 			const dropped = previousDenyPatterns.filter((p) => !nextDenyPatterns.has(p));
 			if (dropped.length > 0) droppedDenyByKey[key] = dropped;
 		}
@@ -19206,8 +19767,10 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			const summary = Object.entries(droppedDenyByKey).map(([key, patterns]) => `${key}: [${patterns.join(", ")}]`).join("; ");
 			logger?.warn(`WARNING: Kilo permissions regeneration drops existing 'deny' rule(s) because rulesync output owns these tool keys. Dropped — ${summary}. To preserve these denies, add them to '.rulesync/permissions.json'.`);
 		}
-		const mergedPermission = { ...existingPermission };
-		for (const [key, value] of Object.entries(rulesyncPermission)) mergedPermission[key] = value;
+		const mergedPermission = {
+			...existingPermission,
+			...incomingPermission
+		};
 		const nextJson = {
 			...parsed,
 			permission: mergedPermission
@@ -19221,8 +19784,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission ?? {};
+		const shared = {};
+		const overrideOnly = {};
+		for (const [key, value] of Object.entries(rawPermission)) if (isSharedKiloCategory(key)) shared[key] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[key] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			kilo: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19252,10 +19823,6 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			validate: false
 		});
 	}
-	normalizePermission(permission) {
-		if (!permission) return {};
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
-	}
 };
 //#endregion
 //#region src/features/permissions/kiro-permissions.ts
@@ -19313,29 +19880,16 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 		}
 		const permission = {};
 		const toolsSettings = parsed.toolsSettings ?? {};
-		const shellSettings = asRecord$1(toolsSettings.shell);
-		const shellAllow = asStringArray(shellSettings.allowedCommands);
-		const shellDeny = asStringArray(shellSettings.deniedCommands);
-		if (shellAllow.length > 0 || shellDeny.length > 0) {
-			permission.bash = {};
-			for (const pattern of shellAllow) permission.bash[pattern] = "allow";
-			for (const pattern of shellDeny) permission.bash[pattern] = "deny";
-		}
-		const readSettings = asRecord$1(toolsSettings.read);
-		const readAllow = asStringArray(readSettings.allowedPaths);
-		const readDeny = asStringArray(readSettings.deniedPaths);
-		if (readAllow.length > 0 || readDeny.length > 0) {
-			permission.read = {};
-			for (const pattern of readAllow) permission.read[pattern] = "allow";
-			for (const pattern of readDeny) permission.read[pattern] = "deny";
-		}
-		const writeSettings = asRecord$1(toolsSettings.write);
-		const writeAllow = asStringArray(writeSettings.allowedPaths);
-		const writeDeny = asStringArray(writeSettings.deniedPaths);
-		if (writeAllow.length > 0 || writeDeny.length > 0) {
-			permission.write = {};
-			for (const pattern of writeAllow) permission.write[pattern] = "allow";
-			for (const pattern of writeDeny) permission.write[pattern] = "deny";
+		const shellRules = rulesFromArrays(asRecord$1(toolsSettings.shell), "allowedCommands", "deniedCommands");
+		if (Object.keys(shellRules).length > 0) permission.bash = shellRules;
+		for (const category of [
+			"read",
+			"write",
+			"grep",
+			"glob"
+		]) {
+			const rules = rulesFromArrays(asRecord$1(toolsSettings[category]), "allowedPaths", "deniedPaths");
+			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const allowedTools = new Set(parsed.allowedTools ?? []);
 		if (allowedTools.has("web_fetch")) permission.webfetch = { "*": "allow" };
@@ -19361,45 +19915,63 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 function buildKiroPermissionsFromRulesync({ config, logger, existing }) {
 	const nextAllowedTools = new Set(existing.allowedTools ?? []);
 	const nextToolsSettings = { ...asRecord$1(existing.toolsSettings) };
+	const pathBuckets = {};
+	const pushPath = (key, action, pattern) => {
+		const bucket = pathBuckets[key] ??= {
+			allow: [],
+			deny: []
+		};
+		(action === "allow" ? bucket.allow : bucket.deny).push(pattern);
+	};
 	const shell = {
 		allowedCommands: [],
 		deniedCommands: []
 	};
-	const read = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
-	const write = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
 	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
 		if (action === "ask") {
 			logger?.warn(`Kiro permissions do not support "ask". Skipping ${category}:${pattern}`);
 			continue;
 		}
 		if (category === "bash") (action === "allow" ? shell.allowedCommands : shell.deniedCommands).push(pattern);
-		else if (category === "read") (action === "allow" ? read.allowedPaths : read.deniedPaths).push(pattern);
-		else if (category === "edit" || category === "write") (action === "allow" ? write.allowedPaths : write.deniedPaths).push(pattern);
-		else if (category === "webfetch" || category === "websearch") {
-			if (pattern !== "*") {
-				logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
-				continue;
-			}
-			const toolName = category === "webfetch" ? "web_fetch" : "web_search";
-			if (action === "allow") nextAllowedTools.add(toolName);
-			else nextAllowedTools.delete(toolName);
-		} else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
+		else if (category === "read" || category === "grep" || category === "glob") pushPath(category, action, pattern);
+		else if (category === "edit" || category === "write") pushPath("write", action, pattern);
+		else if (category === "webfetch" || category === "websearch") applyKiroWebPermission({
+			category,
+			pattern,
+			action,
+			nextAllowedTools,
+			logger
+		});
+		else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
 	}
 	nextToolsSettings.shell = shell;
-	nextToolsSettings.read = read;
-	nextToolsSettings.write = write;
+	nextToolsSettings.read = pathTable(pathBuckets.read);
+	nextToolsSettings.write = pathTable(pathBuckets.write);
+	for (const key of ["grep", "glob"]) {
+		const bucket = pathBuckets[key];
+		if (bucket && (bucket.allow.length > 0 || bucket.deny.length > 0)) nextToolsSettings[key] = pathTable(bucket);
+	}
 	return {
 		...existing,
 		allowedTools: [...nextAllowedTools].toSorted(),
 		toolsSettings: nextToolsSettings
 	};
 }
+function pathTable(bucket) {
+	return {
+		allowedPaths: bucket?.allow ?? [],
+		deniedPaths: bucket?.deny ?? []
+	};
+}
+function applyKiroWebPermission({ category, pattern, action, nextAllowedTools, logger }) {
+	if (pattern !== "*") {
+		logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
+		return;
+	}
+	const toolName = category === "webfetch" ? "web_fetch" : "web_search";
+	if (action === "allow") nextAllowedTools.add(toolName);
+	else nextAllowedTools.delete(toolName);
+}
 function asRecord$1(value) {
 	const result = UnknownRecordSchema.safeParse(value);
 	return result.success ? result.data : {};
@@ -19407,6 +19979,17 @@ function asRecord$1(value) {
 function asStringArray(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
+/**
+* Build a canonical `{ pattern: action }` map from a Kiro tool settings record's
+* allow/deny string arrays (e.g. `allowedPaths`/`deniedPaths` or
+* `allowedCommands`/`deniedCommands`).
+*/
+function rulesFromArrays(settings, allowKey, denyKey) {
+	const rules = {};
+	for (const pattern of asStringArray(settings[allowKey])) rules[pattern] = "allow";
+	for (const pattern of asStringArray(settings[denyKey])) rules[pattern] = "deny";
+	return rules;
+}
 //#endregion
 //#region src/features/permissions/opencode-permissions.ts
 const OpencodePermissionSchema = zod_mini.z.union([zod_mini.z.enum([
@@ -19418,6 +20001,28 @@ const OpencodePermissionSchema = zod_mini.z.union([zod_mini.z.enum([
 	"ask",
 	"deny"
 ]))]);
+/**
+* Canonical rulesync permission categories that carry a cross-tool meaning (see
+* the "Supported tool categories" list in `docs/reference/file-formats.md`).
+* On import, any OpenCode category outside this set — plus MCP tool names — is
+* treated as OpenCode-only and routed into the `opencode` override block so a
+* subsequent `rulesync generate` does not leak it into other tools' configs.
+*/
+const CANONICAL_PERMISSION_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedPermissionCategory(category) {
+	return category === "*" || CANONICAL_PERMISSION_CATEGORIES.has(category) || category.startsWith("mcp__");
+}
 const OpencodePermissionsConfigSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.enum([
 	"allow",
 	"ask",
@@ -19479,9 +20084,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
+		const parsed = (0, jsonc_parser.parse)(fileContent ?? "{}");
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const overridePermission = rulesyncJson.opencode?.permission ?? {};
 		const nextJson = {
-			...(0, jsonc_parser.parse)(fileContent ?? "{}"),
-			permission: rulesyncPermissions.getJson().permission
+			...parsed,
+			permission: {
+				...rulesyncJson.permission,
+				...overridePermission
+			}
 		};
 		return new OpencodePermissions({
 			outputRoot,
@@ -19492,8 +20103,20 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission;
+		if (rawPermission === void 0 || typeof rawPermission === "string") {
+			const permission = this.normalizePermission(rawPermission);
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		}
+		const shared = {};
+		const overrideOnly = {};
+		for (const [category, value] of Object.entries(rawPermission)) if (isSharedPermissionCategory(category)) shared[category] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[category] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			opencode: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19523,10 +20146,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			validate: false
 		});
 	}
+	/**
+	* Normalize the uniform/undefined forms of OpenCode's `permission` field into
+	* the canonical rulesync shape. The object form is handled directly in
+	* `toRulesyncPermissions` (it needs to split shared vs OpenCode-only
+	* categories), so this only covers the two remaining cases.
+	*/
 	normalizePermission(permission) {
 		if (!permission) return {};
-		if (typeof permission === "string") return { "*": { "*": permission } };
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
+		return { "*": { "*": permission } };
 	}
 };
 //#endregion
@@ -19600,6 +20228,24 @@ function buildQwenPermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
 	return `${toolName}(${pattern})`;
 }
+const QWEN_OVERRIDE_TOOLS_KEYS = [
+	"approvalMode",
+	"autoAccept",
+	"sandbox",
+	"sandboxImage",
+	"disabled"
+];
+const QWEN_OVERRIDE_SECURITY_KEYS = ["folderTrust"];
+function asPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+/** Pick the override-managed keys out of a settings group into a fresh record. */
+function pickQwenOverrideKeys(group, keys) {
+	const source = asPlainRecord(group);
+	const picked = {};
+	for (const key of keys) if (source[key] !== void 0) picked[key] = source[key];
+	return picked;
+}
 var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -19665,6 +20311,15 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			...settings,
 			permissions: mergedPermissions
 		};
+		const override = config.qwencode;
+		if (override?.tools !== void 0) merged.tools = {
+			...asPlainRecord(settings.tools),
+			...asPlainRecord(override.tools)
+		};
+		if (override?.security !== void 0) merged.security = {
+			...asPlainRecord(settings.security),
+			...asPlainRecord(override.security)
+		};
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new QwencodePermissions({
 			outputRoot,
@@ -19690,7 +20345,14 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const overrideTools = pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS);
+		const overrideSecurity = pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS);
+		const qwencodeOverride = {};
+		if (Object.keys(overrideTools).length > 0) qwencodeOverride.tools = overrideTools;
+		if (Object.keys(overrideSecurity).length > 0) qwencodeOverride.security = overrideSecurity;
+		const result = { ...config };
+		if (Object.keys(qwencodeOverride).length > 0) result.qwencode = qwencodeOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -19851,6 +20513,16 @@ function toPermissionsTable(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return { ...value };
 }
+const REASONIX_OVERRIDE_AGENT_KEYS = ["plan_mode_allowed_tools", "plan_mode_read_only_commands"];
+function asReasonixRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function pickReasonixKeys(source, keys) {
+	const record = asReasonixRecord(source);
+	const picked = {};
+	for (const key of keys) if (record[key] !== void 0) picked[key] = record[key];
+	return picked;
+}
 var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	toml;
 	constructor(params) {
@@ -19912,6 +20584,15 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			...parsed,
 			permissions: mergedPermissions
 		};
+		const override = config.reasonix;
+		if (override?.sandbox !== void 0) merged.sandbox = {
+			...asReasonixRecord(parsed.sandbox),
+			...asReasonixRecord(override.sandbox)
+		};
+		if (override?.agent !== void 0) merged.agent = {
+			...asReasonixRecord(parsed.agent),
+			...asReasonixRecord(override.agent)
+		};
 		const fileContent = smol_toml.stringify(merged);
 		return new ReasonixPermissions({
 			outputRoot,
@@ -19928,7 +20609,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			ask: toStringArray$1(permissions.ask),
 			deny: toStringArray$1(permissions.deny)
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const sandbox = asReasonixRecord(this.toml.sandbox);
+		const agentPlanMode = pickReasonixKeys(this.toml.agent, REASONIX_OVERRIDE_AGENT_KEYS);
+		const reasonixOverride = {};
+		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
+		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
+		const result = { ...config };
+		if (Object.keys(reasonixOverride).length > 0) result.reasonix = reasonixOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -20492,6 +21180,7 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			if (deny.size > 0) nextTool.denylist = [...deny].toSorted();
 			tools[vibeToolName] = nextTool;
 		}
+		applyVibeSensitivePatterns(tools, rulesyncPermissions.getJson().vibe);
 		config.tools = tools;
 		if (enabledTools.size > 0) config.enabled_tools = [...enabledTools].toSorted();
 		else delete config.enabled_tools;
@@ -20508,16 +21197,25 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 	}
 	toRulesyncPermissions() {
 		const permission = {};
+		const vibeOverridePermission = {};
 		for (const tool of toStringArray(this.toml.enabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "allow";
 		for (const tool of toStringArray(this.toml.disabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "deny";
 		for (const [vibeToolName, toolConfig] of Object.entries(toVibeToolsRecord(this.toml.tools))) {
-			const rules = ensurePermission(permission, toCanonicalToolName$1(vibeToolName));
+			const category = toCanonicalToolName$1(vibeToolName);
+			const rules = ensurePermission(permission, category);
 			const action = fromVibePermission(toolConfig.permission);
 			if (action !== void 0) rules["*"] = action;
 			for (const pattern of toStringArray(toolConfig.allow ?? toolConfig.allowlist)) rules[pattern] = "allow";
 			for (const pattern of toStringArray(toolConfig.deny ?? toolConfig.denylist)) rules[pattern] = "deny";
+			const sensitivePatterns = toStringArray(toolConfig.sensitive_patterns);
+			if (sensitivePatterns.length > 0) vibeOverridePermission[category] = { sensitive_patterns: sensitivePatterns };
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
+		const json = Object.keys(vibeOverridePermission).length > 0 ? {
+			permission,
+			vibe: { permission: vibeOverridePermission }
+		} : { permission };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -20544,6 +21242,22 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		});
 	}
 };
+/**
+* Apply the Vibe-scoped override's per-tool `sensitive_patterns` (patterns that
+* escalate to ASK even when the base permission is ALWAYS). rulesync owns this
+* list for any category the override names: a present list is set, an empty
+* one clears it. Categories not named keep whatever the existing file had.
+*/
+function applyVibeSensitivePatterns(tools, vibeOverride) {
+	for (const [category, toolOverride] of Object.entries(vibeOverride?.permission ?? {})) {
+		const vibeToolName = toVibeToolName(category);
+		const nextTool = toVibeToolConfig(tools[vibeToolName]);
+		const patterns = toStringArray(toolOverride.sensitive_patterns);
+		if (patterns.length > 0) nextTool.sensitive_patterns = [...patterns].toSorted();
+		else delete nextTool.sensitive_patterns;
+		tools[vibeToolName] = nextTool;
+	}
+}
 function parseVibeConfig(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -20588,6 +21302,11 @@ function ensurePermission(permission, category) {
 const WARP_GLOBAL_ONLY_MESSAGE = "Warp permissions are global-only; use --global to sync Warp's settings.toml";
 const ALLOWLIST_KEY = "agent_mode_command_execution_allowlist";
 const DENYLIST_KEY = "agent_mode_command_execution_denylist";
+const WARP_OVERRIDE_KEYS = [
+	"agent_mode_coding_permissions",
+	"agent_mode_coding_file_read_allowlist",
+	"agent_mode_execute_readonly_commands"
+];
 /**
 * Warp's `settings.toml` lives in a different directory per platform (Stable
 * channel). The home directory is resolved by the processor through
@@ -20623,8 +21342,16 @@ function warpSettingsDir() {
 * patterns as regexes when targeting Warp (mirrors the Zed permissions
 * adapter). Warp has no per-command "ask" list, so `ask` rules are dropped; and
 * the command lists only model shell commands, so non-`bash` categories are
-* skipped (with a warning when they carry `deny` rules). MCP allow/deny and the
-* file-read permissions are separate surfaces not modeled here.
+* skipped (with a warning when they carry `deny` rules).
+*
+* Warp's `[agents.profiles]` table also exposes file-read/read-only autonomy
+* knobs that do not fit the canonical `allow | ask | deny` per-command model:
+* `agent_mode_coding_permissions`, `agent_mode_coding_file_read_allowlist`, and
+* `agent_mode_execute_readonly_commands`. These are authored and round-tripped
+* through the `warp` override namespace (see `WarpPermissionsOverrideSchema`):
+* on **import** they are lifted from `settings.toml` into the override, and on
+* **export** they are merged back into `[agents.profiles]` (the override wins).
+* MCP allow/deny is a separate surface not modeled here.
 *
 * The `settings.toml` file holds all of Warp's settings, so the
 * `[agents.profiles]` block is merged in place and the file is never deleted.
@@ -20669,12 +21396,15 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Warp settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToWarpPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
 		const agents = isRecord(settings.agents) ? { ...settings.agents } : {};
 		const profiles = isRecord(agents.profiles) ? { ...agents.profiles } : {};
+		const override = config.warp;
+		if (isRecord(override)) Object.assign(profiles, override);
 		const mergedAllow = (0, es_toolkit.uniq)(allow.toSorted());
 		const mergedDeny = (0, es_toolkit.uniq)(deny.toSorted());
 		if (mergedAllow.length > 0) profiles[ALLOWLIST_KEY] = mergedAllow;
@@ -20705,7 +21435,11 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 			allow: isStringArray(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
 			deny: isStringArray(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const warpOverride = {};
+		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
+		const result = { ...config };
+		if (Object.keys(warpOverride).length > 0) result.warp = warpOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -24071,8 +24805,9 @@ const DevinSkillFrontmatterSchema = zod_mini.z.looseObject({
 * Represents a Devin (now Devin Desktop) skill directory.
 * Devin supports skills in both project mode under .devin/skills/
 * (preferred since the Devin Desktop rebrand; .devin/skills/ is the legacy
-* fallback the tool still reads) and global mode under ~/.codeium/windsurf/skills/
-* (unchanged by the rebrand).
+* fallback the tool still reads) and global mode under the Devin-native
+* ~/.config/devin/skills/ (consistent with Devin's global agents/rules paths;
+* the legacy channel-dependent ~/.codeium/<channel>/skills/ is no longer emitted).
 */
 var DevinSkill = class DevinSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = DevinSkill.getSettablePaths().relativeDirPath, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -24094,7 +24829,7 @@ var DevinSkill = class DevinSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global = false } = {}) {
-		if (global) return { relativeDirPath: CODEIUM_WINDSURF_SKILLS_DIR_PATH };
+		if (global) return { relativeDirPath: DEVIN_GLOBAL_SKILLS_DIR_PATH };
 		return { relativeDirPath: DEVIN_SKILLS_DIR_PATH };
 	}
 	getFrontmatter() {
@@ -27153,7 +27888,7 @@ const QwencodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	disallowedTools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	maxTurns: zod_mini.z.optional(zod_mini.z.number()),
 	color: zod_mini.z.optional(zod_mini.z.string()),
-	mcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	mcpServers: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.array(zod_mini.z.string()), zod_mini.z.record(zod_mini.z.string(), zod_mini.z.looseObject({}))])),
 	hooks: zod_mini.z.optional(zod_mini.z.unknown())
 });
 var QwencodeSubagent = class QwencodeSubagent extends ToolSubagent {