rulesync 9.2.0 → 9.4.0

package/dist/{import-BkxwFCDM.js → import-BxqZVTKb.js}

@@ -3003,8 +3003,8 @@ const DEVIN_SKILLS_DIR_PATH = join(DEVIN_DIR, "skills");
 const DEVIN_AGENTS_DIR_PATH = join(DEVIN_DIR, "agents");
 const DEVIN_GLOBAL_CONFIG_DIR_PATH = join(".config", "devin");
 const DEVIN_GLOBAL_AGENTS_DIR_PATH = join(DEVIN_GLOBAL_CONFIG_DIR_PATH, "agents");
+const DEVIN_GLOBAL_SKILLS_DIR_PATH = join(DEVIN_GLOBAL_CONFIG_DIR_PATH, "skills");
 const CODEIUM_WINDSURF_GLOBAL_WORKFLOWS_DIR_PATH = join(CODEIUM_WINDSURF_DIR, "global_workflows");
-const CODEIUM_WINDSURF_SKILLS_DIR_PATH = join(CODEIUM_WINDSURF_DIR, "skills");
 const DEVIN_CONFIG_FILE_NAME = "config.json";
 const DEVIN_HOOKS_V1_FILE_NAME = "hooks.v1.json";
 const DEVIN_GLOBAL_AGENTS_FILE_NAME = "AGENTS.md";
@@ -3892,6 +3892,297 @@ const OPENCODE_JSON_FILE_NAME = "opencode.json";
 const OPENCODE_RULE_FILE_NAME = "AGENTS.md";
 const OPENCODE_HOOKS_FILE_NAME = "rulesync-hooks.js";
 //#endregion
+//#region src/constants/takt-paths.ts
+const TAKT_DIR = ".takt";
+const TAKT_FACETS_SUBDIR = "facets";
+const TAKT_FACETS_DIR_PATH = join(TAKT_DIR, TAKT_FACETS_SUBDIR);
+const TAKT_RULES_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "policies");
+const TAKT_COMMANDS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "instructions");
+const TAKT_SKILLS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "knowledge");
+const TAKT_SUBAGENTS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "personas");
+const TAKT_OUTPUT_CONTRACTS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "output-contracts");
+const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
+/**
+* Takt's shared config file. Lives at `.takt/config.yaml` (project) and
+* `~/.takt/config.yaml` (global); it holds the active provider, provider
+* profiles (including permission modes), and other Takt settings.
+* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+const TAKT_CONFIG_FILE_NAME = "config.yaml";
+/**
+* Top-level key in Takt's `config.yaml` holding the workflow MCP transport
+* allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
+* transport must be explicitly enabled here before any workflow-defined MCP
+* server using it is permitted to run.
+* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+const TAKT_WORKFLOW_MCP_SERVERS_KEY = "workflow_mcp_servers";
+//#endregion
+//#region src/utils/prototype-pollution.ts
+/**
+* Keys that, if walked into when constructing or merging objects from
+* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
+* chain) and propagate state to every other object in the runtime. Any code
+* that copies arbitrary user-supplied keys into a fresh object — frontmatter
+* parsing, MCP config conversion, settings round-trip — should skip these.
+*/
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPrototypePollutionKey(key) {
+	return PROTOTYPE_POLLUTION_KEYS.has(key);
+}
+/**
+* Returns a shallow copy of a record's own entries with every
+* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
+*
+* Use when copying a nested, user-supplied string map — an MCP server's `env`
+* or `headers` table — into freshly generated config. Carrying such a map by
+* reference, or re-assigning its keys via bracket notation, would let a literal
+* `__proto__` key ride along (and re-assigning it would mutate the target's
+* prototype). Walking the entries through this helper severs that path while
+* preserving every legitimate key.
+*/
+function omitPrototypePollutionKeys(record) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+//#endregion
+//#region src/features/shared/shared-config-gateway.ts
+function sanitizeSharedConfigValue(value) {
+	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
+	if (!isPlainObject(value)) return value;
+	const result = {};
+	for (const [key, nested] of Object.entries(omitPrototypePollutionKeys(value))) result[key] = sanitizeSharedConfigValue(nested);
+	return result;
+}
+/**
+* Parse a shared config file into a plain document: an empty/whitespace file
+* is `{}`, prototype-pollution keys are dropped recursively, and a non-mapping
+* root follows `invalidRootPolicy`. Syntax errors are wrapped with the file
+* path when one is given.
+*/
+function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy = "coerce-empty" }) {
+	if (fileContent.trim() === "") return {};
+	const at = filePath === void 0 ? "" : ` at ${filePath}`;
+	let parsed;
+	try {
+		if (format === "yaml") parsed = load(fileContent);
+		else if (format === "json") parsed = JSON.parse(fileContent);
+		else parsed = parse(fileContent);
+	} catch (error) {
+		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
+	}
+	if (parsed === void 0 || parsed === null) return {};
+	if (!isPlainObject(parsed)) {
+		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
+		return {};
+	}
+	return sanitizeSharedConfigValue(parsed);
+}
+/**
+* Serialize a shared config document. YAML output always ends with exactly one
+* newline; JSON output matches the 2-space `JSON.stringify` shape the JSON
+* writers have always emitted (no trailing newline).
+*/
+function stringifySharedConfig({ format, document }) {
+	if (format === "yaml") return dump(document, {
+		noRefs: true,
+		sortKeys: false
+	}).trimEnd() + "\n";
+	return JSON.stringify(document, null, 2);
+}
+/**
+* Shallow merge: every top-level key in `patch` replaces the base key
+* wholesale; all other base keys are preserved. The policy for a feature that
+* owns a fixed set of top-level keys.
+*/
+function mergeSharedConfigShallow({ base, patch }) {
+	return {
+		...base,
+		...sanitizeSharedConfigValue(patch)
+	};
+}
+/**
+* Deep merge (`patch` wins): nested plain objects are merged key-by-key; every
+* other value (arrays, scalars) is replaced wholesale. The policy for a
+* feature whose contribution interleaves with user-authored siblings at any
+* depth (e.g. permissions overlays onto `approvals`/`security` structures, or
+* per-provider option tables) — nested sibling keys are preserved by
+* construction instead of by per-tool re-implementation. Prototype-pollution
+* keys are dropped.
+*/
+function mergeSharedConfigDeep({ base, patch }) {
+	const result = { ...base };
+	for (const [key, patchValue] of Object.entries(patch)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const baseValue = result[key];
+		if (isPlainObject(baseValue) && isPlainObject(patchValue)) result[key] = mergeSharedConfigDeep({
+			base: baseValue,
+			patch: patchValue
+		});
+		else result[key] = sanitizeSharedConfigValue(patchValue);
+	}
+	return result;
+}
+const CLAUDE_SETTINGS_SHARED_FILE_KEY = ".claude/settings.json";
+const HERMES_CONFIG_SHARED_FILE_KEY = ".hermes/config.yaml";
+const TAKT_CONFIG_SHARED_FILE_KEY = ".takt/config.yaml";
+/**
+* Who owns what in each gateway-managed shared config file, and which policy
+* resolves conflicts. Keys are `dir/file` tokens matching
+* `deriveSharedFileWriters()`; a test keeps each entry's feature set in
+* lock-step with the writers derived from the processor registry, so an
+* undeclared writer fails CI instead of merging by accident.
+*/
+const SHARED_CONFIG_OWNERSHIP = {
+	[CLAUDE_SETTINGS_SHARED_FILE_KEY]: {
+		format: "json",
+		features: {
+			ignore: {
+				kind: "custom",
+				policyFunction: "applyIgnoreReadDenies"
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "custom",
+				policyFunction: "applyPermissions"
+			}
+		}
+	},
+	[HERMES_CONFIG_SHARED_FILE_KEY]: {
+		format: "yaml",
+		features: {
+			subagents: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["plugins"]
+			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp_servers"]
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "deep-merge",
+				replaceKeys: ["permissions"]
+			}
+		}
+	},
+	[TAKT_CONFIG_SHARED_FILE_KEY]: {
+		format: "yaml",
+		invalidRootPolicy: "error",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: [TAKT_WORKFLOW_MCP_SERVERS_KEY]
+			},
+			permissions: { kind: "deep-merge" }
+		}
+	}
+};
+/**
+* Execute a feature's declared write to a gateway-managed shared file: parse
+* the existing content, merge the patch under the feature's declared policy,
+* and serialize. Throws when the file or feature is undeclared, when a
+* `replace-owned-keys` patch strays outside its owned keys, or when the
+* feature's policy is `custom` (those calls go to the named policy function
+* instead).
+*/
+function applySharedConfigPatch({ fileKey, feature, existingContent, patch, filePath }) {
+	const declaration = SHARED_CONFIG_OWNERSHIP[fileKey];
+	if (!declaration) throw new Error(`Shared config file '${fileKey}' has no SHARED_CONFIG_OWNERSHIP declaration; declare its writers and policies before writing it through the gateway.`);
+	const policy = declaration.features[feature];
+	if (!policy) throw new Error(`Feature '${feature}' declares no ownership of '${fileKey}'; add it to SHARED_CONFIG_OWNERSHIP before writing.`);
+	if (policy.kind === "custom") throw new Error(`Feature '${feature}' writes '${fileKey}' through its dedicated policy function '${policy.policyFunction}' in shared-config-gateway.ts, not applySharedConfigPatch.`);
+	const base = parseSharedConfig({
+		format: declaration.format,
+		fileContent: existingContent,
+		filePath,
+		...declaration.invalidRootPolicy !== void 0 && { invalidRootPolicy: declaration.invalidRootPolicy }
+	});
+	if (policy.kind === "replace-owned-keys") {
+		const unowned = Object.keys(patch).filter((key) => !policy.ownedKeys.includes(key));
+		if (unowned.length > 0) throw new Error(`Feature '${feature}' tried to write undeclared keys [${unowned.join(", ")}] to '${fileKey}'; extend its ownedKeys declaration if that ownership is intended.`);
+		return stringifySharedConfig({
+			format: declaration.format,
+			document: mergeSharedConfigShallow({
+				base,
+				patch
+			})
+		});
+	}
+	const merged = mergeSharedConfigDeep({
+		base,
+		patch
+	});
+	for (const key of policy.replaceKeys ?? []) if (patch[key] !== void 0) merged[key] = sanitizeSharedConfigValue(patch[key]);
+	return stringifySharedConfig({
+		format: declaration.format,
+		document: merged
+	});
+}
+const READ_TOOL_NAME = "Read";
+const isReadDenyEntry = (entry) => entry.startsWith(`${READ_TOOL_NAME}(`) && entry.endsWith(")");
+const buildReadDenyEntry = (pattern) => `${READ_TOOL_NAME}(${pattern})`;
+const parsePermissionsBlock = (settings) => {
+	const permissions = settings.permissions ?? {};
+	return {
+		allow: permissions.allow ?? [],
+		ask: permissions.ask ?? [],
+		deny: permissions.deny ?? []
+	};
+};
+const withPermissions = (settings, next) => {
+	const permissions = { ...settings.permissions };
+	const assign = (key, values) => {
+		if (values.length > 0) permissions[key] = values;
+		else delete permissions[key];
+	};
+	assign("allow", next.allow);
+	assign("ask", next.ask);
+	assign("deny", next.deny);
+	return {
+		...settings,
+		permissions
+	};
+};
+const applyIgnoreReadDenies = (params) => {
+	const { settings, readDenies } = params;
+	const current = parsePermissionsBlock(settings);
+	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry) || readDenies.includes(entry));
+	return withPermissions(settings, {
+		allow: current.allow,
+		ask: current.ask,
+		deny: uniq([...preservedDeny, ...readDenies].toSorted())
+	});
+};
+const applyPermissions = (params) => {
+	const { settings, managedToolNames, toolNameOf, allow, ask, deny, logger } = params;
+	const current = parsePermissionsBlock(settings);
+	const keepUnmanaged = (entries) => entries.filter((entry) => !managedToolNames.has(toolNameOf(entry)));
+	if (logger && managedToolNames.has(READ_TOOL_NAME)) {
+		const overwrittenReadDenies = current.deny.filter((entry) => toolNameOf(entry) === READ_TOOL_NAME);
+		if (overwrittenReadDenies.length > 0) logger.warn(`Permissions feature manages '${READ_TOOL_NAME}' tool and will overwrite ${overwrittenReadDenies.length} existing ${READ_TOOL_NAME} deny entries. Permissions take precedence.`);
+	}
+	return withPermissions(settings, {
+		allow: uniq([...keepUnmanaged(current.allow), ...allow].toSorted()),
+		ask: uniq([...keepUnmanaged(current.ask), ...ask].toSorted()),
+		deny: uniq([...keepUnmanaged(current.deny), ...deny].toSorted())
+	});
+};
+//#endregion
 //#region src/features/opencode-config.ts
 /**
 * Reads and parses the OpenCode config (`opencode.jsonc` preferred, then
@@ -3916,9 +4207,10 @@ async function readOpencodeConfig({ outputRoot, global = false }) {
 	});
 	const fileContent = await readFileContentOrNull(join(configDir, "opencode.jsonc")) ?? await readFileContentOrNull(join(configDir, "opencode.json"));
 	if (!fileContent) return {};
-	const parsed = parse(fileContent);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-	return parsed;
+	return parseSharedConfig({
+		format: "jsonc",
+		fileContent
+	});
 }
 /**
 * Narrows an unknown value to a plain record of entries keyed by name, as used
@@ -4827,32 +5119,6 @@ var RovodevPromptsManifest = class extends ToolFile {
 	}
 };
 //#endregion
-//#region src/constants/takt-paths.ts
-const TAKT_DIR = ".takt";
-const TAKT_FACETS_SUBDIR = "facets";
-const TAKT_FACETS_DIR_PATH = join(TAKT_DIR, TAKT_FACETS_SUBDIR);
-const TAKT_RULES_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "policies");
-const TAKT_COMMANDS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "instructions");
-const TAKT_SKILLS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "knowledge");
-const TAKT_SUBAGENTS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "personas");
-const TAKT_OUTPUT_CONTRACTS_DIR_PATH = join(TAKT_FACETS_DIR_PATH, "output-contracts");
-const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
-/**
-* Takt's shared config file. Lives at `.takt/config.yaml` (project) and
-* `~/.takt/config.yaml` (global); it holds the active provider, provider
-* profiles (including permission modes), and other Takt settings.
-* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
-*/
-const TAKT_CONFIG_FILE_NAME = "config.yaml";
-/**
-* Top-level key in Takt's `config.yaml` holding the workflow MCP transport
-* allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
-* transport must be explicitly enabled here before any workflow-defined MCP
-* server using it is permitted to run.
-* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
-*/
-const TAKT_WORKFLOW_MCP_SERVERS_KEY = "workflow_mcp_servers";
-//#endregion
 //#region src/features/takt-shared.ts
 /**
 * Shared utilities for all TAKT-* tool file classes.
@@ -5688,6 +5954,8 @@ const DEEPAGENTS_HOOK_EVENTS = [
 	"sessionEnd",
 	"beforeSubmitPrompt",
 	"permissionRequest",
+	"preToolUse",
+	"postToolUse",
 	"postToolUseFailure",
 	"stop",
 	"preCompact",
@@ -5713,7 +5981,13 @@ const CODEXCLI_HOOK_EVENTS = [
 * Goose adopts the Open Plugins hooks spec: each plugin's `hooks/hooks.json`
 * maps PascalCase event names to matcher/handler arrays. Every Goose event has a
 * 1:1 canonical equivalent, so no new canonical events are required.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+*
+* Goose's `HookEvent` enum defines exactly these 11 events (v1.41.0). Notably it
+* has NO `SubagentStart`/`SubagentStop` arms — emitting them would write keys
+* Goose silently ignores, so `subagentStart`/`subagentStop` are intentionally
+* excluded here and from `CANONICAL_TO_GOOSE_EVENT_NAMES`.
+* @see https://github.com/block/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 const GOOSE_HOOK_EVENTS = [
 	"sessionStart",
@@ -5726,9 +6000,7 @@ const GOOSE_HOOK_EVENTS = [
 	"beforeReadFile",
 	"afterFileEdit",
 	"beforeShellExecution",
-	"afterShellExecution",
-	"subagentStart",
-	"subagentStop"
+	"afterShellExecution"
 ];
 /** Hook events supported by Kiro CLI. */
 const KIRO_HOOK_EVENTS = [
@@ -6181,9 +6453,7 @@ const CANONICAL_TO_GOOSE_EVENT_NAMES = {
 	beforeReadFile: "BeforeReadFile",
 	afterFileEdit: "AfterFileEdit",
 	beforeShellExecution: "BeforeShellExecution",
-	afterShellExecution: "AfterShellExecution",
-	subagentStart: "SubagentStart",
-	subagentStop: "SubagentStop"
+	afterShellExecution: "AfterShellExecution"
 };
 /**
 * Map Goose PascalCase event names to canonical camelCase.
@@ -6197,6 +6467,8 @@ const CANONICAL_TO_DEEPAGENTS_EVENT_NAMES = {
 	sessionEnd: "session.end",
 	beforeSubmitPrompt: "user.prompt",
 	permissionRequest: "permission.request",
+	preToolUse: "tool.use",
+	postToolUse: "tool.result",
 	postToolUseFailure: "tool.error",
 	stop: "task.complete",
 	preCompact: "context.compact",
@@ -6324,42 +6596,6 @@ const CANONICAL_TO_REASONIX_EVENT_NAMES = {
 */
 const REASONIX_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_REASONIX_EVENT_NAMES).map(([k, v]) => [v, k]));
 //#endregion
-//#region src/utils/prototype-pollution.ts
-/**
-* Keys that, if walked into when constructing or merging objects from
-* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
-* chain) and propagate state to every other object in the runtime. Any code
-* that copies arbitrary user-supplied keys into a fresh object — frontmatter
-* parsing, MCP config conversion, settings round-trip — should skip these.
-*/
-const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isPrototypePollutionKey(key) {
-	return PROTOTYPE_POLLUTION_KEYS.has(key);
-}
-/**
-* Returns a shallow copy of a record's own entries with every
-* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
-*
-* Use when copying a nested, user-supplied string map — an MCP server's `env`
-* or `headers` table — into freshly generated config. Carrying such a map by
-* reference, or re-assigning its keys via bracket notation, would let a literal
-* `__proto__` key ride along (and re-assigning it would mutate the target's
-* prototype). Walking the entries through this helper severs that path while
-* preserving every legitimate key.
-*/
-function omitPrototypePollutionKeys(record) {
-	const sanitized = {};
-	for (const [key, value] of Object.entries(record)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = value;
-	}
-	return sanitized;
-}
-//#endregion
 //#region src/features/hooks/tool-hooks-converter.ts
 function isToolMatcherEntry(x) {
 	if (x === null || typeof x !== "object") return false;
@@ -7018,24 +7254,19 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		const paths = ClaudecodeHooks.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
-		let settings;
-		try {
-			settings = JSON.parse(existingContent);
-		} catch (error) {
-			throw new Error(`Failed to parse existing Claude settings at ${filePath}: ${formatError(error)}`, { cause: error });
-		}
 		const config = rulesyncHooks.getJson();
-		const claudeHooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.claudecode?.hooks,
-			converterConfig: CLAUDE_CONVERTER_CONFIG,
-			logger
+		const fileContent = applySharedConfigPatch({
+			fileKey: CLAUDE_SETTINGS_SHARED_FILE_KEY,
+			feature: "hooks",
+			existingContent,
+			patch: { hooks: canonicalToToolHooks({
+				config,
+				toolOverrideHooks: config.claudecode?.hooks,
+				converterConfig: CLAUDE_CONVERTER_CONFIG,
+				logger
+			}) },
+			filePath
 		});
-		const merged = {
-			...settings,
-			hooks: claudeHooks
-		};
-		const fileContent = JSON.stringify(merged, null, 2);
 		return new ClaudecodeHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -8191,7 +8422,7 @@ const GOOSE_CONVERTER_CONFIG = {
 *
 * The JSON shape matches Claude Code's: each PascalCase event maps to an array of
 * `{ matcher, hooks: [{ type: "command", command }] }` entries.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 var GooseHooks = class GooseHooks extends ToolHooks {
 	constructor(params) {
@@ -8242,7 +8473,7 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 			throw new Error(`Failed to parse Goose hooks content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: parsed.hooks,
+			hooks: parsed.hooks && typeof parsed.hooks === "object" && !Array.isArray(parsed.hooks) ? Object.fromEntries(Object.entries(parsed.hooks).filter(([eventName]) => Object.hasOwn(GOOSE_TO_CANONICAL_EVENT_NAMES, eventName))) : parsed.hooks,
 			converterConfig: GOOSE_CONVERTER_CONFIG
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify({
@@ -8267,37 +8498,6 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hermes-config.ts
-function sanitizeHermesConfigValue(value) {
-	if (Array.isArray(value)) return value.map(sanitizeHermesConfigValue);
-	if (!isPlainObject(value)) return value;
-	const sanitized = omitPrototypePollutionKeys(value);
-	const result = {};
-	for (const [key, nestedValue] of Object.entries(sanitized)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		result[key] = sanitizeHermesConfigValue(nestedValue);
-	}
-	return result;
-}
-function parseHermesConfig(fileContent) {
-	if (!fileContent.trim()) return {};
-	const parsed = load(fileContent);
-	if (isPlainObject(parsed)) return sanitizeHermesConfigValue(parsed);
-	return {};
-}
-function stringifyHermesConfig(config) {
-	return dump(config, {
-		noRefs: true,
-		sortKeys: false
-	}).trimEnd() + "\n";
-}
-function mergeHermesConfig(fileContent, patch) {
-	return stringifyHermesConfig({
-		...parseHermesConfig(fileContent),
-		...patch
-	});
-}
-//#endregion
 //#region src/features/hooks/hermesagent-hooks.ts
 /**
 * Canonical events that map to a Hermes tool-call event (`pre_tool_call` /
@@ -8425,10 +8625,21 @@ var HermesagentHooks = class HermesagentHooks extends ToolHooks {
 		return true;
 	}
 	setFileContent(fileContent) {
-		this.fileContent = mergeHermesConfig(fileContent, parseHermesConfig(this.fileContent));
+		this.fileContent = applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "hooks",
+			existingContent: fileContent,
+			patch: parseSharedConfig({
+				format: "yaml",
+				fileContent: this.fileContent
+			})
+		});
 	}
 	toRulesyncHooks() {
-		const hooks = hermesHooksToCanonical(parseHermesConfig(this.getFileContent()).hooks);
+		const hooks = hermesHooksToCanonical(parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent()
+		}).hooks);
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify({
 			version: 1,
 			hooks
@@ -8438,11 +8649,14 @@ var HermesagentHooks = class HermesagentHooks extends ToolHooks {
 		const config = rulesyncHooks.getJson();
 		return new HermesagentHooks({
 			outputRoot,
-			fileContent: stringifyHermesConfig({ hooks: canonicalToHermesHooks({
-				config,
-				toolOverrideHooks: config.hermesagent?.hooks,
-				logger
-			}) })
+			fileContent: stringifySharedConfig({
+				format: "yaml",
+				document: { hooks: canonicalToHermesHooks({
+					config,
+					toolOverrideHooks: config.hermesagent?.hooks,
+					logger
+				}) }
+			})
 		});
 	}
 };
@@ -10462,66 +10676,6 @@ var AugmentcodeIgnore = class AugmentcodeIgnore extends ToolIgnore {
 	}
 };
 //#endregion
-//#region src/features/claudecode-settings-gateway.ts
-/**
-* Single owner of the `.claude/settings.json` `permissions` block, which both
-* `ignore` (writes `Read(...)` into `permissions.deny`) and `permissions`
-* (writes the whole `allow`/`ask`/`deny`) read-modify-write. The entry format,
-* the merge, and the cross-feature ownership rule (permissions' explicit `Read`
-* rules win over ignore-derived `Read` denies) used to be duplicated across both
-* feature files; they live here once so each feature just states its intent and
-* never reasons about the other's existence.
-*/
-const READ_TOOL_NAME = "Read";
-const isReadDenyEntry = (entry) => entry.startsWith(`${READ_TOOL_NAME}(`) && entry.endsWith(")");
-const buildReadDenyEntry = (pattern) => `${READ_TOOL_NAME}(${pattern})`;
-const parsePermissionsBlock = (settings) => {
-	const permissions = settings.permissions ?? {};
-	return {
-		allow: permissions.allow ?? [],
-		ask: permissions.ask ?? [],
-		deny: permissions.deny ?? []
-	};
-};
-const withPermissions = (settings, next) => {
-	const permissions = { ...settings.permissions };
-	const assign = (key, values) => {
-		if (values.length > 0) permissions[key] = values;
-		else delete permissions[key];
-	};
-	assign("allow", next.allow);
-	assign("ask", next.ask);
-	assign("deny", next.deny);
-	return {
-		...settings,
-		permissions
-	};
-};
-const applyIgnoreReadDenies = (params) => {
-	const { settings, readDenies } = params;
-	const current = parsePermissionsBlock(settings);
-	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry) || readDenies.includes(entry));
-	return withPermissions(settings, {
-		allow: current.allow,
-		ask: current.ask,
-		deny: uniq([...preservedDeny, ...readDenies].toSorted())
-	});
-};
-const applyPermissions = (params) => {
-	const { settings, managedToolNames, toolNameOf, allow, ask, deny, logger } = params;
-	const current = parsePermissionsBlock(settings);
-	const keepUnmanaged = (entries) => entries.filter((entry) => !managedToolNames.has(toolNameOf(entry)));
-	if (logger && managedToolNames.has(READ_TOOL_NAME)) {
-		const overwrittenReadDenies = current.deny.filter((entry) => toolNameOf(entry) === READ_TOOL_NAME);
-		if (overwrittenReadDenies.length > 0) logger.warn(`Permissions feature manages '${READ_TOOL_NAME}' tool and will overwrite ${overwrittenReadDenies.length} existing ${READ_TOOL_NAME} deny entries. Permissions take precedence.`);
-	}
-	return withPermissions(settings, {
-		allow: uniq([...keepUnmanaged(current.allow), ...allow].toSorted()),
-		ask: uniq([...keepUnmanaged(current.ask), ...ask].toSorted()),
-		deny: uniq([...keepUnmanaged(current.deny), ...deny].toSorted())
-	});
-};
-//#endregion
 //#region src/features/ignore/claudecode-ignore.ts
 const DEFAULT_FILE_MODE = "shared";
 /**
@@ -11944,7 +12098,6 @@ var AntigravityIdeMcp = class extends AntigravityMcp {
 };
 //#endregion
 //#region src/features/mcp/augmentcode-mcp.ts
-const AUGMENTCODE_GLOBAL_ONLY_MESSAGE = "AugmentCode MCP is global-only; use --global to sync ~/.augment/settings.json";
 function parseAugmentcodeSettings(fileContent, relativeDirPath, relativeFilePath) {
 	const configPath = join(relativeDirPath, relativeFilePath);
 	let parsed;
@@ -11959,13 +12112,15 @@ function parseAugmentcodeSettings(fileContent, relativeDirPath, relativeFilePath
 /**
 * AugmentCode (Auggie CLI) MCP servers.
 *
-* MCP servers are persisted in the shared user settings file
-* `~/.augment/settings.json` (global only — the docs do not document a
-* project-level MCP location). That same file also holds `hooks` and
+* MCP servers are persisted in the shared settings file `.augment/settings.json`
+* at either scope: the committed workspace file for team-shared servers (project)
+* or `~/.augment/settings.json` (global). That same file also holds `hooks` and
 * `toolPermissions`, so generation merges the `mcpServers` block into the
-* existing settings instead of overwriting it, and the file is never deleted.
+* existing settings instead of overwriting it, and the file is never deleted. On
+* project-scope import the gitignored `.augment/settings.local.json` overrides
+* file is overlaid on top (the same layering the hooks/permissions adapters use).
 *
-* @see https://docs.augmentcode.com/cli/integrations
+* @see https://docs.augmentcode.com/cli/config
 */
 var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 	json;
@@ -11987,9 +12142,14 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 		};
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		if (!global) throw new Error(AUGMENTCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const json = parseAugmentcodeSettings(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}", paths.relativeDirPath, paths.relativeFilePath);
+		const json = parseAugmentcodeSettings(await readAugmentcodeSettingsWithLocalOverlay({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			baseFileName: paths.relativeFilePath,
+			baseFallbackContent: "{}",
+			includeLocalOverlay: !global
+		}), paths.relativeDirPath, paths.relativeFilePath);
 		const newJson = {
 			...json,
 			mcpServers: json.mcpServers ?? {}
@@ -12004,7 +12164,6 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
-		if (!global) throw new Error(AUGMENTCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const merged = {
 			...parseAugmentcodeSettings(await readOrInitializeFileContent(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath), JSON.stringify({}, null, 2)), paths.relativeDirPath, paths.relativeFilePath),
@@ -12279,6 +12438,38 @@ const RULESYNC_TO_CODEX_FIELD_MAP = {
 	envVars: "env_vars"
 };
 const MAX_REMOVE_EMPTY_ENTRIES_DEPTH$1 = 32;
+/**
+* Translate a server's `oauth` table from the canonical rulesync shape (Claude
+* Code style camelCase) into the shape Codex CLI understands. Codex expects the
+* OAuth client id under snake_case `client_id`; without it `codex mcp login`
+* falls back to dynamic client registration and fails for providers that do not
+* support it (e.g. Slack, see #2158). The canonical `clientId` is kept alongside
+* the added `client_id` so tools that read the camelCase shape keep working and
+* the round-trip stays stable.
+*/
+function mapOauthToCodex(oauth) {
+	const result = omitPrototypePollutionKeys(oauth);
+	if (typeof oauth["clientId"] === "string" && !("client_id" in result)) result["client_id"] = oauth["clientId"];
+	return result;
+}
+/**
+* Reverse of {@link mapOauthToCodex}: collapse Codex's `oauth.client_id` back to
+* the canonical `clientId` on import. When both keys are present (the shape
+* rulesync itself emits) the canonical `clientId` wins and `client_id` is
+* dropped so a subsequent generate does not accumulate duplicates.
+*/
+function mapOauthFromCodex(oauth) {
+	const result = {};
+	for (const [key, value] of Object.entries(oauth)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (key === "client_id") {
+			if (!("clientId" in oauth)) result["clientId"] = value;
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
 function convertFromCodexFormat(codexMcp) {
 	const result = {};
 	for (const [name, config] of Object.entries(codexMcp)) {
@@ -12288,7 +12479,8 @@ function convertFromCodexFormat(codexMcp) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "enabled") {
 				if (value === false) converted["disabled"] = true;
-			} else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthFromCodex(value);
+			else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
 				const mappedKey = CODEX_TO_RULESYNC_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `Ignored malformed array for ${key} in MCP server ${name}`);
@@ -12308,7 +12500,8 @@ function convertToCodexFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "disabled") {
 				if (value === true) converted["enabled"] = false;
-			} else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthToCodex(value);
+			else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
 				const mappedKey = RULESYNC_TO_CODEX_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string array, got ${typeof value}`);
@@ -13524,10 +13717,12 @@ function resolveHermesTimeout(config) {
 *
 * Hermes is close to the MCP spec but not identical: `command` must be a single
 * executable string (an array's tail folds into `args`), a server is disabled
-* via `enabled: false` (not the canonical `disabled: true`), and remote servers
-* use `url`/`headers`. Only fields Hermes understands are emitted, so the shared
-* `config.yaml` is not polluted with canonical-only aliases (`type`, `transport`,
-* `httpUrl`, `networkTimeout`, tool-filter keys, ...).
+* via `enabled: false` (not the canonical `disabled: true`), remote servers use
+* `url`/`headers`, and per-server tool scoping lives under a `tools: { include,
+* exclude }` block (from the canonical `enabledTools`/`disabledTools`). Only
+* fields Hermes understands are emitted, so the shared `config.yaml` is not
+* polluted with canonical-only aliases (`type`, `transport`, `httpUrl`,
+* `networkTimeout`, ...).
 */
 function convertServerToHermes(config) {
 	const out = {};
@@ -13551,6 +13746,10 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
+	const tools = {};
+	if (isStringArray(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
 }
 /**
@@ -13592,6 +13791,10 @@ function convertFromHermesFormat(mcpServers) {
 		if (isPlainObject(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
 		if (config.enabled === false) server.disabled = true;
 		if (typeof config.timeout === "number") server.networkTimeout = config.timeout;
+		if (isRecord(config.tools)) {
+			if (isStringArray(config.tools.include)) server.enabledTools = config.tools.include;
+			if (isStringArray(config.tools.exclude)) server.disabledTools = config.tools.exclude;
+		}
 		result[name] = server;
 	}
 	return result;
@@ -13610,7 +13813,10 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	config;
 	constructor(params) {
 		super(params);
-		this.config = this.fileContent !== void 0 ? parseHermesConfig(this.fileContent) : {};
+		this.config = this.fileContent !== void 0 ? parseSharedConfig({
+			format: "yaml",
+			fileContent: this.fileContent
+		}) : {};
 	}
 	getConfig() {
 		return this.config;
@@ -13619,9 +13825,17 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 		return true;
 	}
 	setFileContent(fileContent) {
-		const merged = mergeHermesMcpServers(parseHermesConfig(fileContent), isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const merged = mergeHermesMcpServers(parseSharedConfig({
+			format: "yaml",
+			fileContent
+		}), isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
 		this.config = merged;
-		super.setFileContent(stringifyHermesConfig(merged));
+		super.setFileContent(applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "mcp",
+			existingContent: fileContent,
+			patch: { mcp_servers: merged.mcp_servers }
+		}));
 	}
 	isDeletable() {
 		return false;
@@ -13648,12 +13862,21 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const merged = mergeHermesMcpServers(parseHermesConfig(await readOrInitializeFileContent(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath), "")), convertToHermesFormat(rulesyncMcp.getMcpServers()));
+		const fileContent = await readOrInitializeFileContent(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath), "");
+		const merged = mergeHermesMcpServers(parseSharedConfig({
+			format: "yaml",
+			fileContent
+		}), convertToHermesFormat(rulesyncMcp.getMcpServers()));
 		return new HermesagentMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: stringifyHermesConfig(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+				feature: "mcp",
+				existingContent: fileContent,
+				patch: { mcp_servers: merged.mcp_servers }
+			}),
 			validate,
 			global
 		});
@@ -14818,28 +15041,6 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 	}
 };
 //#endregion
-//#region src/features/shared/takt-config.ts
-/**
-* Parse a Takt `config.yaml` into a plain object, treating an empty file as `{}`.
-*
-* Shared by the Takt adapters that read-modify-write the same `config.yaml`
-* (mcp, permissions, ...). Uses `isPlainObject` (not `isRecord`) so class
-* instances are rejected for prototype-pollution hardening; a YAML mapping
-* always parses to a plain object.
-*/
-function parseTaktConfig(fileContent, relativeDirPath, relativeFilePath) {
-	const configPath = join(relativeDirPath, relativeFilePath);
-	let parsed;
-	try {
-		parsed = fileContent.trim() === "" ? {} : load(fileContent);
-	} catch (error) {
-		throw new Error(`Failed to parse Takt config at ${configPath}: ${formatError(error)}`, { cause: error });
-	}
-	if (parsed === void 0 || parsed === null) return {};
-	if (!isPlainObject(parsed)) throw new Error(`Failed to parse Takt config at ${configPath}: expected a YAML mapping`);
-	return parsed;
-}
-//#endregion
 //#region src/features/mcp/takt-mcp.ts
 /**
 * MCP adapter for Takt (`.takt/config.yaml` project / `~/.takt/config.yaml`
@@ -14905,17 +15106,20 @@ var TaktMcp = class TaktMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = TaktMcp.getSettablePaths({ global });
-		const config = parseTaktConfig(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath);
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const allowlist = deriveTransportAllowlist(rulesyncMcp.getMcpServers());
-		const merged = {
-			...config,
-			[TAKT_WORKFLOW_MCP_SERVERS_KEY]: allowlist
-		};
 		return new TaktMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: dump(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: TAKT_CONFIG_SHARED_FILE_KEY,
+				feature: "mcp",
+				existingContent,
+				patch: { [TAKT_WORKFLOW_MCP_SERVERS_KEY]: allowlist },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -15360,7 +15564,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 	["augmentcode", {
 		class: AugmentcodeMcp,
 		meta: {
-			supportsProject: false,
+			supportsProject: true,
 			supportsGlobal: true,
 			supportsEnabledTools: false,
 			supportsDisabledTools: false
@@ -15747,17 +15951,317 @@ const PermissionActionSchema = z.enum([
 */
 const PermissionRulesSchema = z.record(z.string(), PermissionActionSchema);
 /**
+* OpenCode-specific permission value. Unlike the shared canonical block, which
+* only accepts a pattern-to-action map, OpenCode also allows a bare action
+* string that applies to the whole category (e.g. `"external_directory": "deny"`).
+* This mirrors OpenCode's own permission schema in `opencode-permissions.ts`.
+*/
+const OpencodeOverridePermissionValueSchema = z.union([PermissionActionSchema, PermissionRulesSchema]);
+/**
+* Tool-scoped override block for OpenCode. Permission categories placed here
+* (e.g. OpenCode-only categories such as `external_directory`) are emitted only
+* into OpenCode's config and never leak into other tools' permission files. It
+* also lets a shared category be overridden with an OpenCode-specific value.
+* Kept `looseObject` so future OpenCode categories are accepted.
+*
+* @example
+* { "permission": { "external_directory": "deny", "webfetch": "allow" } }
+*/
+const OpencodePermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Hermes Agent. Keys placed here are deep-merged
+* into Hermes's `~/.hermes/config.yaml` and never leak into other tools' configs.
+* It carries Hermes-specific approval/security controls that have no canonical
+* permission category — e.g. `approvals` (`mode`, `cron_mode`, ...),
+* `security` (`allow_private_urls`, ...), `skills.write_approval`,
+* `memory.write_approval`. Kept `looseObject` (a verbatim passthrough) so any
+* current or future Hermes config key can be authored without modeling each one.
+*
+* @example
+* { "approvals": { "mode": "smart" }, "security": { "allow_private_urls": false } }
+*/
+const HermesPermissionsOverrideSchema = z.looseObject({});
+/**
+* Tool-scoped override block for Cline. Cline's `command-permissions.json`
+* carries a single global `allowRedirects` boolean (gates shell redirection
+* operators `>`/`>>`/`<`) that has no per-command dimension and therefore no
+* canonical permission category. Placing it here lets users author it
+* declaratively; it is emitted only into Cline's config. Kept `looseObject` so
+* future Cline-only knobs can be added.
+*
+* @example
+* { "allowRedirects": true }
+*/
+const ClinePermissionsOverrideSchema = z.looseObject({ allowRedirects: z.optional(z.boolean()) });
+/**
+* Tool-scoped override block for Kilo Code (an OpenCode fork). Kilo's permission
+* object is a free-form record with tool-specific keys that have no canonical
+* category — OpenCode-inherited ones (`external_directory`, `doom_loop`, `lsp`,
+* `question`, `todowrite`, `skill`, `task`, `list`) and Kilo-unique ones
+* (`agent_manager`, `notebook_read`, `notebook_edit`, `notebook_execute`,
+* `repo_clone`, `repo_overview`). Placing them here makes them authorable and
+* portable and keeps them out of other tools' configs. Mirrors the OpenCode
+* override; each value may be a bare action string or a pattern map.
+*
+* @example
+* { "permission": { "external_directory": "deny", "doom_loop": "ask" } }
+*/
+const KiloPermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Claude Code. Claude Code's `permissions` object
+* (in `.claude/settings.json`) carries non-list fields that have no canonical
+* permission category — `defaultMode` (the session-start permission mode) and
+* `additionalDirectories` (extra working directories) being the primary ones.
+* Fields placed under `claudecode.permissions` are merged into the settings
+* `permissions` object and emitted only for Claude Code, while the shared
+* `permission` block continues to drive the `allow`/`ask`/`deny` arrays. Kept a
+* `looseObject` passthrough so any current or future `permissions` field can be
+* authored without modeling each one; the managed `allow`/`ask`/`deny` arrays are
+* ignored here (rulesync owns them).
+*
+* @example
+* { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
+*/
+const ClaudecodePermissionsOverrideSchema = z.looseObject({ permissions: z.optional(z.looseObject({})) });
+/**
+* Tool-scoped override block for Mistral Vibe. Vibe's per-tool `BaseToolConfig`
+* carries a `sensitive_patterns` list — patterns that escalate to ASK even when
+* the tool's base permission is ALWAYS (allow). The canonical model can only set
+* a pattern to a single `allow`/`ask`/`deny`, so an "allow by default but ask on
+* these patterns" escalation cannot be expressed. Entries under
+* `vibe.permission.<category>.sensitive_patterns` carry that list per canonical
+* category; the shared `permission` block still drives the base permission and
+* allow/deny lists. Keyed by canonical category (e.g. `bash`, `edit`).
+*
+* @example
+* { "permission": { "bash": { "sensitive_patterns": ["rm *", "sudo *"] } } }
+*/
+const VibePermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(z.string(), z.looseObject({ sensitive_patterns: z.optional(z.array(z.string())) }))) });
+/**
+* Tool-scoped override block for Cursor CLI. Cursor's `cli.json` carries scalar
+* autonomy settings with no canonical permission category — `approvalMode`
+* (`allowlist` | `auto-review` | `unrestricted`) and a `sandbox` object
+* (`mode`/`networkAccess`). Fields placed here are merged into the top-level of
+* `.cursor/cli.json` (project) / `~/.cursor/cli-config.json` (global) and emitted
+* only for Cursor, while the shared `permission` block continues to drive the
+* `permissions.allow`/`permissions.deny` arrays. Kept a `looseObject` so extra
+* `cli.json` keys can be authored (they are merged verbatim on generate);
+* `sandbox`'s accepted values are not documented so it passes through verbatim.
+* Note: only `approvalMode` and `sandbox` round-trip back on import — other keys
+* authored here reach `cli.json` on generate but are not re-extracted.
+*
+* @example
+* { "approvalMode": "auto-review" }
+*/
+const CursorPermissionsOverrideSchema = z.looseObject({
+	approvalMode: z.optional(z.string()),
+	sandbox: z.optional(z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Qwen Code. Qwen's `settings.json` exposes
+* autonomy/sandbox controls with no canonical permission category — under
+* `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
+* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`). Fields
+* placed here are merged into the matching `settings.json` group and emitted
+* only for Qwen, while the shared `permission` block continues to drive the
+* `permissions.allow`/`ask`/`deny` arrays. Kept `looseObject` (verbatim
+* passthrough) so any current or future `tools`/`security` key can be authored.
+*
+* @example
+* { "tools": { "approvalMode": "auto-edit" }, "security": { "folderTrust": { "enabled": true } } }
+*/
+const QwencodePermissionsOverrideSchema = z.looseObject({
+	tools: z.optional(z.looseObject({})),
+	security: z.optional(z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Reasonix. Reasonix has security axes orthogonal
+* to per-tool allow/ask/deny with no canonical category — the `[sandbox]`
+* enforcement table (`workspace_root`, `allow_write`, `forbid_read`, `bash`,
+* `network`) and plan-mode read-only trust lists under `[agent]`
+* (`plan_mode_allowed_tools`, `plan_mode_read_only_commands`). Fields placed here
+* are merged into the matching `reasonix.toml` table and emitted only for
+* Reasonix, while the shared `permission` block continues to drive
+* `[permissions].allow`/`ask`/`deny`. Kept `looseObject` (verbatim passthrough).
+* Note: the whole `[sandbox]` table round-trips, but only the plan-mode keys are
+* re-extracted from `[agent]` on import — other `agent` keys authored here reach
+* `reasonix.toml` on generate but are not re-extracted back into the override.
+*
+* @example
+* { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
+*/
+const ReasonixPermissionsOverrideSchema = z.looseObject({
+	sandbox: z.optional(z.looseObject({})),
+	agent: z.optional(z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
+* exposes security controls with no canonical per-command allow/ask/deny slot —
+* `commandBlocklist` (a hard-block tier that can never be approved, distinct from
+* an approvable `deny`), `networkPolicy` (`allowedIps`), `sandbox`
+* (`enabled`/`mode`/`filesystem`/`network`), `mcpPolicy`, `enableDroidShield`,
+* and autonomy settings (`sessionDefaultSettings`, `maxAutonomyLevel`,
+* `interactionMode`). Fields placed here are merged into `settings.json` and
+* emitted only for Factory Droid, while the shared `permission` block continues
+* to drive `commandAllowlist`/`commandDenylist`. Kept `looseObject` passthrough.
+*
+* @example
+* { "commandBlocklist": ["rm -rf /*"], "sandbox": { "enabled": true } }
+*/
+const FactorydroidPermissionsOverrideSchema = z.looseObject({ commandBlocklist: z.optional(z.array(z.string())) });
+/**
+* Tool-scoped override block for Warp. Warp's `[agents.profiles]` table exposes
+* file-read/read-only autonomy keys with no canonical per-command allow/ask/deny
+* slot — `agent_mode_coding_permissions`
+* (`always_ask_before_reading` | `always_allow_reading` | `allow_reading_specific_files`),
+* `agent_mode_coding_file_read_allowlist` (a path array), and
+* `agent_mode_execute_readonly_commands` (a read-only auto-execution boolean).
+* Fields placed here are merged into `[agents.profiles]` of Warp's global
+* `settings.toml`, while the shared `permission` block continues to drive the
+* `agent_mode_command_execution_allowlist`/`_denylist` command regex arrays.
+* Warp permissions are global-only.
+*
+* @example
+* { "agent_mode_coding_permissions": "always_allow_reading", "agent_mode_execute_readonly_commands": true }
+*/
+const WarpPermissionsOverrideSchema = z.looseObject({
+	agent_mode_coding_permissions: z.optional(z.string()),
+	agent_mode_coding_file_read_allowlist: z.optional(z.array(z.string())),
+	agent_mode_execute_readonly_commands: z.optional(z.boolean())
+});
+/**
+* Tool-scoped override block for JetBrains Junie. Junie's `allowlist.json` has
+* two top-level autonomy knobs with no canonical per-glob slot:
+* `allowReadonlyCommands` (a boolean auto-allowing read-only commands) and
+* `defaultBehavior` (the fallback action applied when no rule matches — Junie
+* documents only `allow`/`ask`). Fields placed here are merged onto the
+* top level of `allowlist.json`, while the shared `permission` block continues
+* to drive the per-category `rules` groups.
+*
+* @example
+* { "allowReadonlyCommands": true, "defaultBehavior": "ask" }
+*/
+const JuniePermissionsOverrideSchema = z.looseObject({
+	allowReadonlyCommands: z.optional(z.boolean()),
+	defaultBehavior: z.optional(z.string())
+});
+/**
+* Tool-scoped override block for Takt. Takt's `config.yaml` carries two
+* permission surfaces the canonical coarse-mode mapping can't express:
+* `step_permission_overrides` — a per-workflow-step map (`<step>` →
+* `readonly`/`edit`/`full`) that lives inside the active provider profile
+* alongside `default_permission_mode` and layers on top of it at that step; and
+* `provider_options` — a top-level, per-provider table of sandbox/network knobs
+* orthogonal to the permission mode (e.g. `codex.network_access`,
+* `claude.sandbox.allow_unsandboxed_commands`, `opencode.allowed_tools`). Fields
+* placed here are merged into `config.yaml` and emitted only for Takt, while the
+* shared `permission` block continues to drive `default_permission_mode`. Kept
+* `looseObject` (verbatim passthrough); Takt validates its own value sets (e.g.
+* `provider_options.<p>.base_url` must be loopback). Both project and global
+* scope are supported.
+*
+* Note: Takt's config loader hard-rejects unknown top-level keys, so only keys
+* Takt actually recognizes belong here. `required_permission_mode` is NOT one —
+* it is a per-step field of the workflow YAML (not `config.yaml`), so it is out
+* of scope for this override.
+*
+* @example
+* { "step_permission_overrides": { "ai_review": "readonly" }, "provider_options": { "codex": { "network_access": true } } }
+*/
+const TaktPermissionsOverrideSchema = z.looseObject({
+	step_permission_overrides: z.optional(z.record(z.string(), z.string())),
+	provider_options: z.optional(z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Amp. Amp's `amp.permissions` array and sibling
+* settings carry shapes the canonical per-command allow/ask/deny model can't
+* express, so they are authored here and merged into the shared Amp settings
+* file, while the shared `permission` block continues to drive the canonical
+* `amp.permissions` (allow/ask/reject) + `amp.tools.disable` entries:
+* - `permissions` — extra `amp.permissions` entries with non-`cmd` matchers
+*   (`path`/`url`/`query`/…), regex/array match values, `context`
+*   (`thread`/`subagent`), `delegate` (+`to`), or `reject` (+`message`). These
+*   are appended AFTER the canonical-generated entries (Amp is first-match-wins,
+*   so generated allow/ask/reject rules take precedence; authored entries act as
+*   later fallbacks), preserving author order.
+* - `mcpPermissions` — Amp's `amp.mcpPermissions` array (`{ matches, action }`).
+* - `guardedFiles` — `amp.guardedFiles.allowlist` (globs allowed without
+*   confirmation).
+* - `dangerouslyAllowAll` — `amp.dangerouslyAllowAll` (disable all confirmation).
+* Kept `looseObject` (verbatim passthrough). Both project and global scope are
+* supported.
+*
+* @example
+* { "dangerouslyAllowAll": false, "guardedFiles": { "allowlist": ["docs/**"] },
+*   "permissions": [{ "tool": "Bash", "action": "delegate", "to": "approve.sh" }] }
+*/
+const AmpPermissionsOverrideSchema = z.looseObject({
+	permissions: z.optional(z.array(z.looseObject({
+		tool: z.string(),
+		action: z.string()
+	}))),
+	mcpPermissions: z.optional(z.array(z.looseObject({}))),
+	guardedFiles: z.optional(z.looseObject({ allowlist: z.optional(z.array(z.string())) })),
+	dangerouslyAllowAll: z.optional(z.boolean())
+});
+/**
+* Tool-scoped override block for the Google Antigravity CLI. Antigravity's CLI
+* `settings.json` carries two global autonomy/sandbox knobs outside the
+* `permissions.allow/ask/deny` arrays rulesync manages: `toolPermission` (the
+* global autonomy preset — `request-review` (default) / `proceed-in-sandbox` /
+* `always-proceed` / `strict`) and `enableTerminalSandbox` (a boolean confining
+* agent-run commands to OS containment). Antigravity applies the allow/deny
+* lists as per-rule exceptions to the preset at runtime, so rulesync only
+* authors these keys verbatim — no precedence modeling is needed on our side.
+* Fields placed here are merged onto the top level of
+* `~/.gemini/antigravity-cli/settings.json` (global-only) and emitted only for
+* the CLI. The Antigravity IDE exposes the same concepts through a GUI (no
+* documented JSON schema), so this override does NOT apply to `antigravity-ide`.
+* Verified against https://antigravity.google/docs/cli/reference and
+* https://antigravity.google/docs/cli/sandbox.
+*
+* @example
+* { "toolPermission": "strict", "enableTerminalSandbox": true }
+*/
+const AntigravityCliPermissionsOverrideSchema = z.looseObject({
+	toolPermission: z.optional(z.string()),
+	enableTerminalSandbox: z.optional(z.boolean())
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
+* The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
+* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie`/`takt`/`amp`/
+* `antigravity-cli` keys are tool-scoped overrides consumed only by their
+* respective translator (see the matching `*PermissionsOverrideSchema`); every
+* other tool reads the shared `permission` block and ignores them.
+*
 * @example
 * {
 *   "bash": { "*": "ask", "git *": "allow", "rm *": "deny" },
 *   "edit": { "*": "deny", "src/**": "allow" }
 * }
 */
-const PermissionsConfigSchema = z.looseObject({ permission: z.record(z.string(), PermissionRulesSchema) });
+const PermissionsConfigSchema = z.looseObject({
+	permission: z.record(z.string(), PermissionRulesSchema),
+	opencode: z.optional(OpencodePermissionsOverrideSchema),
+	hermes: z.optional(HermesPermissionsOverrideSchema),
+	cline: z.optional(ClinePermissionsOverrideSchema),
+	kilo: z.optional(KiloPermissionsOverrideSchema),
+	claudecode: z.optional(ClaudecodePermissionsOverrideSchema),
+	vibe: z.optional(VibePermissionsOverrideSchema),
+	cursor: z.optional(CursorPermissionsOverrideSchema),
+	qwencode: z.optional(QwencodePermissionsOverrideSchema),
+	reasonix: z.optional(ReasonixPermissionsOverrideSchema),
+	factorydroid: z.optional(FactorydroidPermissionsOverrideSchema),
+	warp: z.optional(WarpPermissionsOverrideSchema),
+	junie: z.optional(JuniePermissionsOverrideSchema),
+	takt: z.optional(TaktPermissionsOverrideSchema),
+	amp: z.optional(AmpPermissionsOverrideSchema),
+	"antigravity-cli": z.optional(AntigravityCliPermissionsOverrideSchema)
+});
 /**
 * Full permissions file schema including optional $schema field.
 */
@@ -15868,6 +16372,39 @@ const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 * Reference: https://ampcode.com/manual ("amp.permissions").
 */
 const AMP_PERMISSIONS_KEY = "amp.permissions";
+/**
+* The `amp.guardedFiles.allowlist` array (file globs allowed without
+* confirmation), `amp.dangerouslyAllowAll` boolean (disable all confirmation),
+* and `amp.mcpPermissions` array — sibling settings authored through the `amp`
+* permissions override. Reference: https://ampcode.com/manual.
+*/
+const AMP_GUARDED_FILES_ALLOWLIST_KEY = "amp.guardedFiles.allowlist";
+const AMP_DANGEROUSLY_ALLOW_ALL_KEY = "amp.dangerouslyAllowAll";
+const AMP_MCP_PERMISSIONS_KEY = "amp.mcpPermissions";
+/**
+* The read-only `cmd` string of an entry's `matches`, or `undefined` when the
+* matcher is absent or uses a non-`cmd` key / non-string value.
+*/
+function ampMatchesCmd(entry) {
+	const cmd = entry.matches?.cmd;
+	return typeof cmd === "string" ? cmd : void 0;
+}
+/**
+* Whether an `amp.permissions` entry is fully expressible in the canonical
+* per-command allow/ask/deny model: a plain `allow`/`ask`/`reject` action with
+* no `context`/`message`/`to` and a matcher that is either absent or exactly a
+* single string `cmd`. Everything else (non-`cmd` matchers, regex/array match
+* values, `delegate`, `reject`+`message`, `context`) is routed to the `amp`
+* override verbatim instead of being flattened with loss or dropped.
+*/
+function isCanonicalAmpEntry(entry) {
+	if (entry.action === "delegate") return false;
+	if (entry.context !== void 0 || entry.message !== void 0 || entry.to !== void 0) return false;
+	const matches = entry.matches;
+	if (matches === void 0) return true;
+	const keys = Object.keys(matches);
+	return keys.length === 0 || keys.length === 1 && typeof matches.cmd === "string";
+}
 function parseAmpSettings(fileContent) {
 	const errors = [];
 	const parsed = parse(fileContent || "{}", errors, { allowTrailingComma: true });
@@ -15883,10 +16420,20 @@ function toDisableList(value) {
 	return value.filter((entry) => typeof entry === "string");
 }
 /**
+* Read `amp.guardedFiles.allowlist` (an array of file glob strings) from parsed
+* settings, returning `undefined` when the key is absent or not an array so the
+* override omits it.
+*/
+function extractAmpGuardedAllowlist(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter((entry) => typeof entry === "string");
+}
+/**
 * Read an `amp.permissions` array from untrusted parsed settings. Only entries
-* whose shape rulesync understands are retained; the original objects are kept
-* by reference (with a normalized `action`) so unknown sibling keys survive a
-* round-trip when the entry is preserved.
+* whose `tool`/`action` rulesync understands are retained; every other key —
+* including the full `matches` object (so non-`cmd` matchers, regex/array
+* values, `context`, `to`, `message`) — is kept verbatim so it survives a
+* round-trip.
 */
 function toPermissionsList(value) {
 	if (!Array.isArray(value)) return [];
@@ -15896,14 +16443,11 @@ function toPermissionsList(value) {
 		const { tool, action } = raw;
 		if (typeof tool !== "string" || typeof action !== "string") continue;
 		if (action !== "allow" && action !== "reject" && action !== "ask" && action !== "delegate") continue;
-		const matches = raw.matches;
-		let normalizedMatches;
-		if (isPlainObject(matches) && typeof matches.cmd === "string") normalizedMatches = { cmd: matches.cmd };
 		entries.push({
 			...raw,
 			tool,
 			action,
-			...normalizedMatches ? { matches: normalizedMatches } : {}
+			...isPlainObject(raw.matches) ? { matches: raw.matches } : {}
 		});
 	}
 	return entries;
@@ -15928,6 +16472,13 @@ function toPermissionsList(value) {
 * The settings file is shared with the MCP feature (`amp.mcpServers`), so reads
 * and writes merge into the existing JSON rather than overwriting it, and the
 * file is never deleted.
+*
+* Amp shapes with no canonical category are authored and round-tripped through
+* the `amp` permissions override (see `AmpPermissionsOverrideSchema`): extra
+* `amp.permissions` entries with non-`cmd` matchers / `context` / `delegate` /
+* `reject`+`message` (appended after the generated canonical entries), plus the
+* sibling `amp.mcpPermissions`, `amp.guardedFiles.allowlist`, and
+* `amp.dangerouslyAllowAll` settings.
 */
 var AmpPermissions = class AmpPermissions extends ToolPermissions {
 	constructor(params) {
@@ -15997,15 +16548,25 @@ var AmpPermissions = class AmpPermissions extends ToolPermissions {
 		const jsonDir = join(outputRoot, basePaths.relativeDirPath);
 		const { fileContent, relativeFilePath } = await this.resolveSettingsFile(jsonDir);
 		const json = fileContent ? parseAmpSettings(fileContent) : {};
-		const { disable, permissions } = convertRulesyncToAmp(rulesyncPermissions.getJson());
-		const preservedDelegates = toPermissionsList(json[AMP_PERMISSIONS_KEY]).filter((entry) => entry.action === "delegate");
+		const config = rulesyncPermissions.getJson();
+		const { disable, permissions } = convertRulesyncToAmp(config);
+		const override = config.amp;
+		const authoredExtras = override?.permissions ? toPermissionsList(override.permissions) : [];
+		const preservedDelegates = override?.permissions ? [] : toPermissionsList(json[AMP_PERMISSIONS_KEY]).filter((entry) => entry.action === "delegate");
 		const newJson = {
 			...json,
 			[AMP_TOOLS_DISABLE_KEY]: disable
 		};
-		const mergedPermissions = [...permissions, ...preservedDelegates];
+		const mergedPermissions = mergeAmpPermissions([
+			...permissions,
+			...authoredExtras,
+			...preservedDelegates
+		]);
 		if (mergedPermissions.length > 0) newJson[AMP_PERMISSIONS_KEY] = mergedPermissions;
 		else delete newJson[AMP_PERMISSIONS_KEY];
+		if (override?.guardedFiles?.allowlist !== void 0) newJson[AMP_GUARDED_FILES_ALLOWLIST_KEY] = override.guardedFiles.allowlist;
+		if (override?.dangerouslyAllowAll !== void 0) newJson[AMP_DANGEROUSLY_ALLOW_ALL_KEY] = override.dangerouslyAllowAll;
+		if (override?.mcpPermissions !== void 0) newJson[AMP_MCP_PERMISSIONS_KEY] = override.mcpPermissions;
 		return new AmpPermissions({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
@@ -16016,11 +16577,22 @@ var AmpPermissions = class AmpPermissions extends ToolPermissions {
 	}
 	toRulesyncPermissions() {
 		const json = parseAmpSettings(this.getFileContent());
+		const allPermissions = toPermissionsList(json[AMP_PERMISSIONS_KEY]);
+		const canonicalEntries = allPermissions.filter(isCanonicalAmpEntry);
+		const overrideEntries = allPermissions.filter((entry) => !isCanonicalAmpEntry(entry));
 		const config = convertAmpToRulesync({
 			disable: toDisableList(json[AMP_TOOLS_DISABLE_KEY]),
-			permissions: toPermissionsList(json[AMP_PERMISSIONS_KEY])
-		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+			permissions: canonicalEntries
+		});
+		const ampOverride = {};
+		if (overrideEntries.length > 0) ampOverride.permissions = overrideEntries;
+		if (Array.isArray(json[AMP_MCP_PERMISSIONS_KEY])) ampOverride.mcpPermissions = json[AMP_MCP_PERMISSIONS_KEY];
+		const allowlist = extractAmpGuardedAllowlist(json[AMP_GUARDED_FILES_ALLOWLIST_KEY]);
+		if (allowlist !== void 0) ampOverride.guardedFiles = { allowlist };
+		if (typeof json[AMP_DANGEROUSLY_ALLOW_ALL_KEY] === "boolean") ampOverride.dangerouslyAllowAll = json[AMP_DANGEROUSLY_ALLOW_ALL_KEY];
+		const result = { ...config };
+		if (Object.keys(ampOverride).length > 0) result.amp = ampOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -16067,6 +16639,37 @@ const ACTION_PRIORITY = {
 	allow: 2
 };
 /**
+* Fail-closed action priority for merging the full `amp.permissions` list
+* (generated + authored/preserved). `reject` leads so no `allow` can shadow it
+* under first-match-wins; `delegate` (which defers to an external approver, so
+* it never auto-allows) trails as the final fallback.
+*/
+const MERGE_ACTION_PRIORITY = {
+	reject: 0,
+	ask: 1,
+	allow: 2,
+	delegate: 3
+};
+/**
+* Stable fail-closed merge of generated and authored `amp.permissions` entries:
+* order by {@link MERGE_ACTION_PRIORITY} only, preserving each source's relative
+* order within an action class. Guarantees an authored `reject` cannot be
+* shadowed by a generated catch-all `allow`.
+*/
+function mergeAmpPermissions(entries) {
+	const decorated = entries.map((entry, index) => ({
+		entry,
+		index
+	}));
+	decorated.sort((a, b) => {
+		const ap = MERGE_ACTION_PRIORITY[a.entry.action] ?? MERGE_ACTION_PRIORITY.allow;
+		const bp = MERGE_ACTION_PRIORITY[b.entry.action] ?? MERGE_ACTION_PRIORITY.allow;
+		if (ap !== bp) return ap - bp;
+		return a.index - b.index;
+	});
+	return decorated.map((d) => d.entry);
+}
+/**
 * Convert a rulesync permissions config into Amp's two permission surfaces.
 *
 * For each `(category, pattern, action)` — where the category name IS the Amp
@@ -16131,14 +16734,14 @@ function sortAmpPermissions(entries) {
 		const ap = ACTION_PRIORITY[a.entry.action] ?? 0;
 		const bp = ACTION_PRIORITY[b.entry.action] ?? 0;
 		if (ap !== bp) return ap - bp;
-		const aHasCmd = a.entry.matches?.cmd !== void 0 ? 0 : 1;
-		const bHasCmd = b.entry.matches?.cmd !== void 0 ? 0 : 1;
+		const aHasCmd = ampMatchesCmd(a.entry) !== void 0 ? 0 : 1;
+		const bHasCmd = ampMatchesCmd(b.entry) !== void 0 ? 0 : 1;
 		if (aHasCmd !== bHasCmd) return aHasCmd - bHasCmd;
 		const at = a.entry.tool;
 		const bt = b.entry.tool;
 		if (at !== bt) return at < bt ? -1 : 1;
-		const ac = a.entry.matches?.cmd ?? "";
-		const bc = b.entry.matches?.cmd ?? "";
+		const ac = ampMatchesCmd(a.entry) ?? "";
+		const bc = ampMatchesCmd(b.entry) ?? "";
 		if (ac !== bc) return ac < bc ? -1 : 1;
 		return a.index - b.index;
 	});
@@ -16177,7 +16780,7 @@ function convertAmpToRulesync({ disable, permissions }) {
 	for (const tool of disable) assign(tool, "*", "deny");
 	for (const entry of permissions) {
 		if (entry.action === "delegate") continue;
-		const pattern = entry.matches?.cmd ?? "*";
+		const pattern = ampMatchesCmd(entry) ?? "*";
 		const action = entry.action === "reject" ? "deny" : entry.action === "ask" ? "ask" : "allow";
 		assign(entry.tool, pattern, action);
 	}
@@ -16259,6 +16862,11 @@ function buildPermissionEntry$1(toolName, pattern) {
 * Permissions are written to the global `~/.gemini/antigravity-cli/settings.json`
 * file (global scope only). The file holds other CLI settings besides
 * permissions, so it is never deleted.
+*
+* Two CLI-only autonomy/sandbox knobs outside the allow/ask/deny arrays —
+* `toolPermission` (the global autonomy preset) and `enableTerminalSandbox` — are
+* authored and round-tripped through the `antigravity-cli` permissions override
+* (see `AntigravityCliPermissionsOverrideSchema`).
 */
 var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPermissions {
 	constructor(params) {
@@ -16319,6 +16927,9 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			...settings,
 			permissions: mergedPermissions
 		};
+		const override = config["antigravity-cli"];
+		if (override?.toolPermission !== void 0) merged.toolPermission = override.toolPermission;
+		if (override?.enableTerminalSandbox !== void 0) merged.enableTerminalSandbox = override.enableTerminalSandbox;
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new AntigravityCliPermissions({
 			outputRoot,
@@ -16342,7 +16953,12 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const override = {};
+		if (typeof settings.toolPermission === "string") override.toolPermission = settings.toolPermission;
+		if (typeof settings.enableTerminalSandbox === "boolean") override.enableTerminalSandbox = settings.enableTerminalSandbox;
+		const result = { ...config };
+		if (Object.keys(override).length > 0) result["antigravity-cli"] = override;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -17128,6 +17744,14 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToClaudePermissions(config);
+		const overridePermissions = config.claudecode?.permissions;
+		if (overridePermissions && typeof overridePermissions === "object") {
+			const { allow: _a, ask: _k, deny: _d, ...nonListFields } = overridePermissions;
+			settings.permissions = {
+				...settings.permissions,
+				...nonListFields
+			};
+		}
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toClaudeToolName(category)));
 		const merged = applyPermissions({
 			settings,
@@ -17160,6 +17784,8 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
+		const { allow: _a, ask: _k, deny: _d, ...nonListFields } = permissions;
+		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17333,7 +17959,8 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Cline command-permissions at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(rulesyncPermissions.getJson().permission);
+		const config = rulesyncPermissions.getJson();
+		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(config.permission);
 		warnClineTranslationNotices({
 			droppedCategories,
 			translatedAskPatterns,
@@ -17349,7 +17976,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 			...existing,
 			allow: dedupedAllow,
 			deny: mergedDeny,
-			allowRedirects: existing.allowRedirects ?? false
+			allowRedirects: config.cline?.allowRedirects ?? existing.allowRedirects ?? false
 		};
 		return new ClinePermissions({
 			outputRoot,
@@ -17373,6 +18000,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		for (const pattern of parsed.allow ?? []) bashRules[pattern] = "allow";
 		for (const pattern of parsed.deny ?? []) bashRules[pattern] = "deny";
 		const config = Object.keys(bashRules).length > 0 ? { permission: { bash: bashRules } } : { permission: {} };
+		if (parsed.allowRedirects === true) config.cline = { allowRedirects: true };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17809,13 +18437,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX = "mcp__";
+const MCP_CANONICAL_PREFIX$1 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$1) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -17846,7 +18474,7 @@ function toCursorPattern(canonical, pattern) {
 function toCanonicalCategory$1(cursorType, pattern) {
 	if (cursorType === "Mcp") {
 		const match = pattern.match(/^([^:()]+):([^:()]+)$/);
-		if (match) return `${MCP_CANONICAL_PREFIX}${match[1] ?? "*"}__${match[2] ?? "*"}`;
+		if (match) return `${MCP_CANONICAL_PREFIX$1}${match[1] ?? "*"}__${match[2] ?? "*"}`;
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
 	return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
@@ -17980,8 +18608,10 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		mergedPermissions.allow = mergedAllow;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
+		const cursorOverride = config.cursor;
 		const merged = {
 			...settings,
+			...cursorOverride,
 			version: settings.version ?? 1,
 			editor: {
 				...existingEditor,
@@ -18007,11 +18637,15 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		}
 		const permissionsRaw = settings.permissions;
 		const permissions = permissionsRaw !== null && typeof permissionsRaw === "object" && !Array.isArray(permissionsRaw) ? permissionsRaw : {};
-		const config = convertCursorToRulesyncPermissions({
+		const result = { ...convertCursorToRulesyncPermissions({
 			allow: asCursorPermissionEntryArray(permissions.allow),
 			deny: asCursorPermissionEntryArray(permissions.deny)
-		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		}) };
+		const cursorOverride = {};
+		if (settings.approvalMode !== void 0) cursorOverride.approvalMode = settings.approvalMode;
+		if (settings.sandbox !== null && typeof settings.sandbox === "object" && !Array.isArray(settings.sandbox)) cursorOverride.sandbox = settings.sandbox;
+		if (Object.keys(cursorOverride).length > 0) result.cursor = cursorOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18070,7 +18704,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { type, pattern } = parseCursorPermissionEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$1) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -18319,6 +18953,16 @@ function convertDevinToRulesyncPermissions(params) {
 }
 //#endregion
 //#region src/features/permissions/factorydroid-permissions.ts
+const FACTORYDROID_OVERRIDE_KEYS = [
+	"commandBlocklist",
+	"networkPolicy",
+	"sandbox",
+	"mcpPolicy",
+	"enableDroidShield",
+	"sessionDefaultSettings",
+	"maxAutonomyLevel",
+	"interactionMode"
+];
 /**
 * Permissions adapter for Factory Droid.
 *
@@ -18336,18 +18980,14 @@ function convertDevinToRulesyncPermissions(params) {
 * skipped (with a warning when they carry `deny` rules, to surface the gap).
 *
 * Factory Droid also has a stronger `commandBlocklist` tier — commands that can
-* never run, not even under full autonomy. rulesync's canonical action model
-* has only `allow | ask | deny`, with no equivalent of a hard block that can
-* never be approved. So on **import** a `commandBlocklist` entry is collapsed
-* onto canonical `deny` (lossy: the never-runs guarantee is weakened to a deny
-* the user can still approve), rather than being silently dropped. On **export**
-* there is no canonical `block` to emit one from, so rulesync never writes
-* `commandBlocklist`; an existing one on disk is preserved verbatim as an
-* unmanaged key. (A consequence of the lossy collapse: importing a
-* `commandBlocklist` and re-exporting it to a *fresh* config writes it back as
-* `commandDenylist`, not `commandBlocklist` — the hard-block tier is not
-* reconstructed. Re-running over the original file keeps it intact via the
-* verbatim preservation above.)
+* never run, not even under full autonomy — plus other security controls
+* (`networkPolicy`, `sandbox`, `mcpPolicy`, `enableDroidShield`, autonomy
+* settings) that do not fit the canonical `allow | ask | deny` per-command
+* model. These are authored and round-tripped through the `factorydroid`
+* override namespace (see `FactorydroidPermissionsOverrideSchema`): on **import**
+* they are lifted from `settings.json` into the override, and on **export** they
+* are merged back in — so `commandBlocklist`'s never-runs guarantee is preserved
+* faithfully rather than being collapsed onto an approvable `deny`.
 */
 var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissions {
 	constructor(params) {
@@ -18390,11 +19030,16 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		} catch (error) {
 			throw new Error(`Failed to parse existing Factory Droid settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToFactorydroidPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
-		const merged = { ...settings };
+		const override = config.factorydroid;
+		const merged = {
+			...settings,
+			...override !== void 0 && typeof override === "object" ? override : {}
+		};
 		const mergedAllow = uniq(allow.toSorted());
 		const mergedDeny = uniq(deny.toSorted());
 		if (mergedAllow.length > 0) merged.commandAllowlist = mergedAllow;
@@ -18418,10 +19063,13 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		}
 		const config = convertFactorydroidToRulesyncPermissions({
 			allow: Array.isArray(settings.commandAllowlist) ? settings.commandAllowlist : [],
-			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : [],
-			block: Array.isArray(settings.commandBlocklist) ? settings.commandBlocklist : []
+			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const factorydroidOverride = {};
+		for (const key of FACTORYDROID_OVERRIDE_KEYS) if (settings[key] !== void 0) factorydroidOverride[key] = settings[key];
+		const result = { ...config };
+		if (Object.keys(factorydroidOverride).length > 0) result.factorydroid = factorydroidOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18468,18 +19116,18 @@ function convertRulesyncToFactorydroidPermissions({ config, logger }) {
 	};
 }
 /**
-* Convert Factory Droid allow/deny/block command lists back to rulesync config
-* under the `bash` category.
+* Convert Factory Droid allow/deny command lists back to rulesync config under
+* the `bash` category.
 *
-* `commandBlocklist` (hard block) has no canonical equivalent, so it collapses
-* onto `deny` — lossy (a deny can still be approved), but preferable to dropping
-* the rule entirely.
+* `commandBlocklist` (the hard-block tier) is no longer collapsed here — it has
+* no canonical equivalent and now round-trips through the `factorydroid`
+* override so the never-runs guarantee is preserved instead of being weakened to
+* an approvable `deny`.
 */
-function convertFactorydroidToRulesyncPermissions({ allow, deny, block }) {
+function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 	const bash = {};
 	for (const pattern of allow) bash[pattern] = "allow";
 	for (const pattern of deny) bash[pattern] = "deny";
-	for (const pattern of block) bash[pattern] = "deny";
 	return { permission: Object.keys(bash).length > 0 ? { bash } : {} };
 }
 //#endregion
@@ -18673,30 +19321,114 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 const GROKCLI_GLOBAL_ONLY_MESSAGE = "Grok CLI permissions are global-only; use --global to sync ~/.grok/config.toml";
 const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
+const GROKCLI_PERMISSION_KEY = "permission";
 const CATCH_ALL_PATTERN$2 = "*";
+const MCP_CANONICAL_PREFIX = "mcp__";
+const CATEGORY_TO_GROK_TOOL = {
+	bash: "Bash",
+	read: "Read",
+	edit: "Edit",
+	write: "Edit",
+	grep: "Grep",
+	webfetch: "WebFetch"
+};
+const GROK_TOOL_TO_CATEGORY = {
+	Bash: "bash",
+	Read: "read",
+	Edit: "edit",
+	Grep: "grep",
+	WebFetch: "webfetch"
+};
+const GROK_MCP_TOOL = "MCPTool";
+/**
+* Build a Grok Claude-style permission entry (e.g. `Bash(git *)`, `Read`,
+* `MCPTool(server__tool)`) from a canonical category + pattern. Returns `null`
+* for categories Grok cannot express so callers can skip them.
+*
+* Scoped MCP categories (`mcp__<remainder>`) fold their address into the
+* parentheses (`MCPTool(<remainder>)`); the bare `mcp` category becomes
+* `MCPTool`. For every other tool, a `*` pattern emits the bare tool name and a
+* concrete pattern emits `Tool(pattern)`.
+*/
+function buildGrokEntry(category, pattern) {
+	if (category.startsWith(MCP_CANONICAL_PREFIX)) {
+		const remainder = category.slice(5);
+		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
+	}
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	const tool = CATEGORY_TO_GROK_TOOL[category];
+	if (tool === void 0) return null;
+	return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? tool : `${tool}(${pattern})`;
+}
+/**
+* Parse a Grok Claude-style permission entry back into a canonical category +
+* pattern. Entries without parentheses are treated as catch-all (`*`). Returns
+* `null` for tool prefixes with no canonical equivalent (e.g. `any`).
+*/
+function parseGrokEntry(entry) {
+	const trimmed = entry.trim();
+	const parenIndex = trimmed.indexOf("(");
+	let tool;
+	let inner;
+	if (parenIndex === -1 || !trimmed.endsWith(")")) {
+		tool = trimmed;
+		inner = "";
+	} else {
+		tool = trimmed.slice(0, parenIndex);
+		inner = trimmed.slice(parenIndex + 1, -1).trim();
+	}
+	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
+		category: `${MCP_CANONICAL_PREFIX}${inner}`,
+		pattern: CATCH_ALL_PATTERN$2
+	} : {
+		category: "mcp",
+		pattern: CATCH_ALL_PATTERN$2
+	};
+	const category = GROK_TOOL_TO_CATEGORY[tool];
+	if (category === void 0) return null;
+	return {
+		category,
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$2
+	};
+}
 /**
 * Permissions adapter for the xAI Grok Build CLI (`grokcli`).
 *
-* Grok has no per-tool / per-pattern permission rules. Tool gating is a single
-* coarse toggle, `[ui] permission_mode`, in `~/.grok/config.toml`:
-*   - `ask` — prompt before each tool call (Grok's default).
-*   - `always-approve` — skip prompts.
-*
-* rulesync's permission model is per-category, per-pattern `allow`/`ask`/`deny`,
-* so the mapping is **lossy** (a single mode cannot express per-pattern rules):
-*   - Generate: any `deny` or `ask` rule anywhere ⇒ `ask` (conservative — keep
-*     prompting whenever the user expressed any restriction); otherwise, if at
-*     least one `allow` rule exists and nothing is denied/asked ⇒
-*     `always-approve`; an empty config falls back to the safe default `ask`.
-*   - Import: `always-approve` ⇒ `bash: { "*": "allow" }`; `ask` (or unset) ⇒
-*     `bash: { "*": "ask" }`. `bash` is used as the representative catch-all
-*     because it is the primary permission-gated surface, and this round-trips
-*     the generate mapping.
-*
-* This surface is **global only** — `permission_mode` lives in the user-level
-* `~/.grok/config.toml`; Grok has no project-scoped permission file. The shared
-* config is merged in place: the `[ui] permission_mode` value is set and every
-* other key (e.g. `[mcp_servers]`, legacy `approval_mode`) is preserved. The
+* Grok Build CLI ships a Claude-style rule system under `[permission]` in
+* `~/.grok/config.toml`: `allow` / `deny` / `ask` arrays of entries such as
+* `Bash(git *)`, `Read(src/**)`, `Edit`, `Grep`, `MCPTool(server__tool)`, and
+* `WebFetch`, evaluated with precedence `deny > ask > allow`
+* (https://docs.x.ai/build/settings/reference). rulesync's canonical
+* per-category, per-pattern model maps almost 1:1:
+*   - Generate: each `permission.<category>.<pattern> = allow|ask|deny` becomes
+*     the matching Grok entry and is bucketed into the `[permission]` array for
+*     that action. `bash|read|edit|grep|webfetch` map to their Grok tool;
+*     `write` collapses onto `Edit` (Grok has no `Write` tool); `mcp__*` maps to
+*     `MCPTool(...)` (a scoped MCP category folds its address into the
+*     parentheses, so a non-`*` argument pattern on it is not represented).
+*     Categories with no Grok tool (`websearch`, `glob`, `notebookedit`,
+*     `agent`) are skipped (with a warning when they carry a `deny` rule, to
+*     surface the gap). When two canonical rules collapse onto the same Grok
+*     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
+*     the strictest wins (`deny > ask > allow`) and a warning is logged, so the
+*     entry never lands contradictorily in two arrays.
+*   - Import: the `[permission]` arrays are parsed back into canonical
+*     categories. When no `[permission]` section is present (older configs), the
+*     coarse `[ui] permission_mode` is used as a fallback.
+*
+* The coarse `[ui] permission_mode` toggle is still written for backward
+* compatibility with older Grok versions: `always-approve` when the config is
+* pure-`allow`, otherwise `ask` (conservative — it is never `always-approve`
+* while any `deny`/`ask` rule exists, so it never contradicts the fine-grained
+* arrays).
+*
+* This surface is **global only** — the adapter syncs the user-level
+* `~/.grok/config.toml`. (Grok also supports a project-scoped `[permission]`
+* file; project scope is not modeled here.) The shared config is merged in
+* place: rulesync owns the `[permission]` `allow`/`deny`/`ask` entries for the
+* tools it models and the `[ui] permission_mode` value, while every other key
+* (e.g. `[mcp_servers]`, `[permission] rules`, `[sandbox]`) and any user-authored
+* entries for tools rulesync cannot model (e.g. `WebSearch`) are preserved. The
 * file is never deleted.
 */
 var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
@@ -18728,7 +19460,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			global: true
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
 		if (!global) throw new Error(GROKCLI_GLOBAL_ONLY_MESSAGE);
 		const paths = GrokcliPermissions.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -18739,7 +19471,16 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Grok config.toml at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const mode = deriveGrokPermissionMode(rulesyncPermissions.getJson());
+		const config = rulesyncPermissions.getJson();
+		const existingPermission = isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {};
+		const buckets = buildGrokPermissionArrays(config, existingPermission, logger);
+		parsed[GROKCLI_PERMISSION_KEY] = {
+			...existingPermission,
+			allow: buckets.allow,
+			deny: buckets.deny,
+			ask: buckets.ask
+		};
+		const mode = deriveGrokPermissionMode(config);
 		const existingUi = isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {};
 		parsed[GROKCLI_UI_KEY] = {
 			...existingUi,
@@ -18762,8 +19503,8 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Grok config.toml content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const action = (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
-		const rulesyncConfig = { permission: { bash: { [CATCH_ALL_PATTERN$2]: action } } };
+		const fineGrained = parseGrokPermissionArrays(isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$2]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -18783,6 +19524,84 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		});
 	}
 };
+const ACTION_RANK = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Collect user-authored entries from an existing `[permission]` array whose
+* tool prefix rulesync cannot model (e.g. `WebSearch`, `any`). Such entries are
+* preserved verbatim so replacing the arrays does not silently drop them
+* (mirrors the Cursor adapter's preservation of unmanaged types).
+*/
+function unmanagedEntries(existingPermission, key) {
+	return (isStringArray(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+}
+/**
+* Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
+* Claude-style entries, resolving collapse collisions via `deny > ask > allow`.
+* Categories Grok cannot express are skipped (with a warning when they carry a
+* `deny` rule); entries the user authored for tools rulesync cannot model are
+* preserved from `existingPermission`.
+*/
+function buildGrokPermissionArrays(config, existingPermission, logger) {
+	const ranked = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+		const entry = buildGrokEntry(category, pattern);
+		if (entry === null) {
+			if (action === "deny" && logger) logger.warn(`Grok CLI has no permission tool for the '${category}' category; its 'deny' rule could not be represented and was skipped.`);
+			continue;
+		}
+		const existing = ranked.get(entry);
+		if (existing !== void 0 && existing !== action) logger?.warn(`Grok permission entry '${entry}' received conflicting actions ('${existing}' and '${action}'); keeping the stricter one (deny > ask > allow).`);
+		if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) ranked.set(entry, action);
+	}
+	const allow = unmanagedEntries(existingPermission, "allow");
+	const deny = unmanagedEntries(existingPermission, "deny");
+	const ask = unmanagedEntries(existingPermission, "ask");
+	for (const [entry, action] of ranked) if (action === "allow") allow.push(entry);
+	else if (action === "deny") deny.push(entry);
+	else ask.push(entry);
+	return {
+		allow: uniq(allow.toSorted()),
+		deny: uniq(deny.toSorted()),
+		ask: uniq(ask.toSorted())
+	};
+}
+/**
+* Parse Grok's `[permission]` allow/deny/ask arrays back into a canonical
+* permission map. Returns `null` when the section defines none of the three
+* arrays, so the caller can fall back to the coarse `permission_mode`.
+* Precedence `deny > ask > allow` is applied so a tool listed in multiple
+* arrays resolves to the strictest action.
+*/
+function parseGrokPermissionArrays(permission) {
+	const allow = isStringArray(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray(permission.ask) ? permission.ask : void 0;
+	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) === 0) return null;
+	const result = {};
+	const apply = (entries, action) => {
+		for (const entry of entries ?? []) {
+			const parsed = parseGrokEntry(entry);
+			if (parsed === null) continue;
+			const bucket = result[parsed.category] ??= {};
+			bucket[parsed.pattern] = action;
+		}
+	};
+	apply(allow, "allow");
+	apply(ask, "ask");
+	apply(deny, "deny");
+	return result;
+}
+/**
+* Legacy coarse fallback: map `[ui] permission_mode` to a canonical action.
+* `always-approve` ⇒ `allow`; anything else (including a missing mode) ⇒ `ask`.
+*/
+function legacyModeAction(parsed) {
+	return (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
+}
 /**
 * Collapse a rulesync permissions config into Grok's single coarse mode.
 * Any `deny`/`ask` rule anywhere keeps prompting (`ask`); otherwise an existing
@@ -18798,6 +19617,10 @@ function deriveGrokPermissionMode(config) {
 }
 //#endregion
 //#region src/features/permissions/hermesagent-permissions.ts
+/** Collect the glob patterns in a canonical category that carry a given action. */
+function patternsByAction(category, action) {
+	return Object.entries(category ?? {}).filter(([, value]) => value === action).map(([pattern]) => pattern);
+}
 var HermesagentPermissions = class HermesagentPermissions extends ToolPermissions {
 	static getSettablePaths() {
 		return {
@@ -18821,10 +19644,21 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		return true;
 	}
 	setFileContent(fileContent) {
-		this.fileContent = mergeHermesConfig(fileContent, parseHermesConfig(this.fileContent));
+		this.fileContent = applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "permissions",
+			existingContent: fileContent,
+			patch: parseSharedConfig({
+				format: "yaml",
+				fileContent: this.fileContent
+			})
+		});
 	}
 	toRulesyncPermissions() {
-		const config = parseHermesConfig(this.getFileContent());
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent()
+		});
 		const permissions = config.permissions && typeof config.permissions === "object" ? config.permissions.rulesync : {};
 		return new RulesyncPermissions({
 			relativeDirPath: "",
@@ -18834,11 +19668,27 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 	}
 	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions }) {
 		const permissions = rulesyncPermissions.getJson();
+		const permissionBlock = permissions.permission ?? {};
+		const commandAllowlist = Object.entries(permissionBlock).flatMap(([, patterns]) => patternsByAction(patterns, "allow"));
+		const bashDeny = patternsByAction(permissionBlock.bash, "deny");
+		const webfetchDeny = patternsByAction(permissionBlock.webfetch, "deny");
+		let config = {};
+		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
+		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
+		if (webfetchDeny.length > 0) config.security = { website_blocklist: {
+			enabled: true,
+			domains: webfetchDeny
+		} };
+		if (permissions.hermes && typeof permissions.hermes === "object") config = mergeSharedConfigDeep({
+			base: config,
+			patch: permissions.hermes
+		});
+		config.permissions = { rulesync: permissions };
 		return new HermesagentPermissions({
 			outputRoot,
-			fileContent: stringifyHermesConfig({
-				command_allowlist: Object.entries(permissions.permission ?? {}).flatMap(([, patterns]) => Object.entries(patterns).filter(([, action]) => action === "allow").map(([command]) => command)),
-				permissions: { rulesync: permissions }
+			fileContent: stringifySharedConfig({
+				format: "yaml",
+				document: config
 			})
 		});
 	}
@@ -18860,14 +19710,18 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *     "executables":       [ { "prefix": "git ", "action": "allow" } ],
 *     "fileEditing":       [ { "pattern": "src/**", "action": "allow" } ],
 *     "mcpTools":          [ { "prefix": "search", "action": "allow" } ],
-*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "deny" } ]
+*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "ask" } ]
 *   }
 * }
 * ```
 *
 * Each rule carries a literal `prefix` (matches commands that start with it) or
-* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`
-* (`allow` | `ask` | `deny`). rulesync's canonical actions map 1:1 onto Junie's.
+* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`. Junie
+* documents only `allow` and `ask` as valid actions — there is **no `deny`**
+* (https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html). rulesync's
+* canonical `allow`/`ask` map 1:1; a canonical `deny` has no Junie equivalent
+* and is mapped to the nearest valid action, `ask` (still withholds
+* auto-approval), with a warning so the downgrade is surfaced.
 *
 * Category mapping (rulesync canonical <-> Junie rule group):
 * - `bash`         <-> `executables`
@@ -18877,8 +19731,11 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *
 * Categories Junie cannot represent (e.g. `webfetch`) are skipped on export
 * (with a warning when they carry rules). The top-level `defaultBehavior` and
-* `allowReadonlyCommands` settings have no canonical equivalent: they are
-* preserved verbatim on export but not imported into the rulesync model.
+* `allowReadonlyCommands` settings have no canonical per-glob slot: they are
+* authored and round-tripped through the `junie` override namespace (see
+* `JuniePermissionsOverrideSchema`) — lifted into the override on import and
+* merged back onto the top level on export — and any other unmodeled top-level
+* key is preserved verbatim.
 *
 * @see https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html
 */
@@ -18901,7 +19758,6 @@ const JUNIE_GROUP_TO_CANONICAL = {
 	mcpTools: "mcp",
 	readOutsideProject: "read"
 };
-const JUNIE_DEFAULT_BEHAVIOR = "ask";
 function isPermissionAction$1(value) {
 	return PermissionActionSchema.safeParse(value).success;
 }
@@ -18951,13 +19807,16 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Junie allowlist at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const rules = convertRulesyncToJunieRules({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
+		const override = config.junie;
+		const overrideObj = override !== void 0 && typeof override === "object" ? override : {};
 		const merged = {
 			...existing,
-			defaultBehavior: existing.defaultBehavior ?? JUNIE_DEFAULT_BEHAVIOR,
+			...overrideObj,
 			rules
 		};
 		return new JuniePermissions({
@@ -18977,7 +19836,12 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Junie permissions content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const config = convertJunieToRulesyncPermissions({ allowlist });
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const junieOverride = {};
+		if (typeof allowlist.allowReadonlyCommands === "boolean") junieOverride.allowReadonlyCommands = allowlist.allowReadonlyCommands;
+		if (typeof allowlist.defaultBehavior === "string") junieOverride.defaultBehavior = allowlist.defaultBehavior;
+		const result = { ...config };
+		if (Object.keys(junieOverride).length > 0) result.junie = junieOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -19009,12 +19873,13 @@ function convertRulesyncToJunieRules({ config, logger }) {
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(patterns)) {
+			const junieAction = toJunieAction(action, category, pattern, logger);
 			const rule = isGlobPattern(pattern) ? {
 				pattern,
-				action
+				action: junieAction
 			} : {
 				prefix: pattern,
-				action
+				action: junieAction
 			};
 			(rules[group] ??= []).push(rule);
 		}
@@ -19022,6 +19887,19 @@ function convertRulesyncToJunieRules({ config, logger }) {
 	return rules;
 }
 /**
+* Map a canonical action onto a valid Junie allowlist action. Junie supports
+* only `allow` and `ask`; a canonical `deny` is downgraded to `ask` (the
+* nearest valid action — both withhold auto-approval) with a warning, so
+* rulesync never emits a `deny` that Junie would silently ignore.
+*/
+function toJunieAction(action, category, pattern, logger) {
+	if (action === "deny") {
+		logger?.warn(`Junie's allowlist supports only 'allow'/'ask' actions; the '${category}' deny rule for '${pattern}' was downgraded to 'ask' (Junie has no 'deny').`);
+		return "ask";
+	}
+	return action;
+}
+/**
 * Convert a Junie allowlist back into rulesync permissions config. The
 * top-level `defaultBehavior` / `allowReadonlyCommands` settings have no
 * canonical equivalent and are not imported.
@@ -19055,6 +19933,31 @@ const KiloPermissionSchema = z.union([z.enum([
 ]))]);
 const KiloPermissionsConfigSchema = z.looseObject({ permission: z.optional(z.record(z.string(), KiloPermissionSchema)) });
 /**
+* Kilo permission keys that share a name with a canonical rulesync category and
+* therefore stay in the shared `permission` block. Everything else (Kilo-only
+* keys such as `external_directory`, `doom_loop`, `notebook_edit`, ...) is
+* routed into the `kilo` override on import so it does not leak into other
+* tools' configs. Kilo folds `write` into `edit`, uses `notebook_edit`/`task`
+* rather than the canonical `notebookedit`/`agent`, and has no `mcp` key (MCP is
+* addressed via `mcp__*` tool-name keys), so those canonical names are not Kilo
+* keys in practice — they simply never appear on the shared side.
+*/
+const KILO_SHARED_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedKiloCategory(key) {
+	return key === "*" || KILO_SHARED_CATEGORIES.has(key) || key.startsWith("mcp__");
+}
+/**
 * Parse a JSONC string and throw on syntax errors. The `jsonc-parser` `parse()` function is
 * non-throwing best-effort: invalid input silently yields a partial value (often `undefined`,
 * coerced to `{}` by callers). That behavior would silently drop a user's existing `deny` rules
@@ -19166,12 +20069,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		const parsed = parseKiloJsoncStrict(await readFileContentOrNull(filePath) ?? "{}", filePath);
 		const parsedPermission = parsed.permission;
 		const existingPermission = parsedPermission && typeof parsedPermission === "object" && !Array.isArray(parsedPermission) ? { ...parsedPermission } : {};
-		const rulesyncPermission = rulesyncPermissions.getJson().permission;
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const kiloOverride = rulesyncJson.kilo;
+		const incomingPermission = {
+			...rulesyncJson.permission,
+			...kiloOverride?.permission
+		};
 		const droppedDenyByKey = {};
-		for (const key of Object.keys(rulesyncPermission)) {
-			const previous = existingPermission[key];
-			const previousDenyPatterns = collectKiloDenyPatterns(previous);
-			const nextDenyPatterns = new Set(collectKiloDenyPatterns(rulesyncPermission[key]));
+		for (const [key, value] of Object.entries(incomingPermission)) {
+			const previousDenyPatterns = collectKiloDenyPatterns(existingPermission[key]);
+			const nextDenyPatterns = new Set(collectKiloDenyPatterns(value));
 			const dropped = previousDenyPatterns.filter((p) => !nextDenyPatterns.has(p));
 			if (dropped.length > 0) droppedDenyByKey[key] = dropped;
 		}
@@ -19179,8 +20086,10 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			const summary = Object.entries(droppedDenyByKey).map(([key, patterns]) => `${key}: [${patterns.join(", ")}]`).join("; ");
 			logger?.warn(`WARNING: Kilo permissions regeneration drops existing 'deny' rule(s) because rulesync output owns these tool keys. Dropped — ${summary}. To preserve these denies, add them to '.rulesync/permissions.json'.`);
 		}
-		const mergedPermission = { ...existingPermission };
-		for (const [key, value] of Object.entries(rulesyncPermission)) mergedPermission[key] = value;
+		const mergedPermission = {
+			...existingPermission,
+			...incomingPermission
+		};
 		const nextJson = {
 			...parsed,
 			permission: mergedPermission
@@ -19194,8 +20103,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission ?? {};
+		const shared = {};
+		const overrideOnly = {};
+		for (const [key, value] of Object.entries(rawPermission)) if (isSharedKiloCategory(key)) shared[key] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[key] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			kilo: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19225,10 +20142,6 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			validate: false
 		});
 	}
-	normalizePermission(permission) {
-		if (!permission) return {};
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
-	}
 };
 //#endregion
 //#region src/features/permissions/kiro-permissions.ts
@@ -19286,29 +20199,16 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 		}
 		const permission = {};
 		const toolsSettings = parsed.toolsSettings ?? {};
-		const shellSettings = asRecord$1(toolsSettings.shell);
-		const shellAllow = asStringArray(shellSettings.allowedCommands);
-		const shellDeny = asStringArray(shellSettings.deniedCommands);
-		if (shellAllow.length > 0 || shellDeny.length > 0) {
-			permission.bash = {};
-			for (const pattern of shellAllow) permission.bash[pattern] = "allow";
-			for (const pattern of shellDeny) permission.bash[pattern] = "deny";
-		}
-		const readSettings = asRecord$1(toolsSettings.read);
-		const readAllow = asStringArray(readSettings.allowedPaths);
-		const readDeny = asStringArray(readSettings.deniedPaths);
-		if (readAllow.length > 0 || readDeny.length > 0) {
-			permission.read = {};
-			for (const pattern of readAllow) permission.read[pattern] = "allow";
-			for (const pattern of readDeny) permission.read[pattern] = "deny";
-		}
-		const writeSettings = asRecord$1(toolsSettings.write);
-		const writeAllow = asStringArray(writeSettings.allowedPaths);
-		const writeDeny = asStringArray(writeSettings.deniedPaths);
-		if (writeAllow.length > 0 || writeDeny.length > 0) {
-			permission.write = {};
-			for (const pattern of writeAllow) permission.write[pattern] = "allow";
-			for (const pattern of writeDeny) permission.write[pattern] = "deny";
+		const shellRules = rulesFromArrays(asRecord$1(toolsSettings.shell), "allowedCommands", "deniedCommands");
+		if (Object.keys(shellRules).length > 0) permission.bash = shellRules;
+		for (const category of [
+			"read",
+			"write",
+			"grep",
+			"glob"
+		]) {
+			const rules = rulesFromArrays(asRecord$1(toolsSettings[category]), "allowedPaths", "deniedPaths");
+			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const allowedTools = new Set(parsed.allowedTools ?? []);
 		if (allowedTools.has("web_fetch")) permission.webfetch = { "*": "allow" };
@@ -19334,45 +20234,63 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 function buildKiroPermissionsFromRulesync({ config, logger, existing }) {
 	const nextAllowedTools = new Set(existing.allowedTools ?? []);
 	const nextToolsSettings = { ...asRecord$1(existing.toolsSettings) };
+	const pathBuckets = {};
+	const pushPath = (key, action, pattern) => {
+		const bucket = pathBuckets[key] ??= {
+			allow: [],
+			deny: []
+		};
+		(action === "allow" ? bucket.allow : bucket.deny).push(pattern);
+	};
 	const shell = {
 		allowedCommands: [],
 		deniedCommands: []
 	};
-	const read = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
-	const write = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
 	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
 		if (action === "ask") {
 			logger?.warn(`Kiro permissions do not support "ask". Skipping ${category}:${pattern}`);
 			continue;
 		}
 		if (category === "bash") (action === "allow" ? shell.allowedCommands : shell.deniedCommands).push(pattern);
-		else if (category === "read") (action === "allow" ? read.allowedPaths : read.deniedPaths).push(pattern);
-		else if (category === "edit" || category === "write") (action === "allow" ? write.allowedPaths : write.deniedPaths).push(pattern);
-		else if (category === "webfetch" || category === "websearch") {
-			if (pattern !== "*") {
-				logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
-				continue;
-			}
-			const toolName = category === "webfetch" ? "web_fetch" : "web_search";
-			if (action === "allow") nextAllowedTools.add(toolName);
-			else nextAllowedTools.delete(toolName);
-		} else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
+		else if (category === "read" || category === "grep" || category === "glob") pushPath(category, action, pattern);
+		else if (category === "edit" || category === "write") pushPath("write", action, pattern);
+		else if (category === "webfetch" || category === "websearch") applyKiroWebPermission({
+			category,
+			pattern,
+			action,
+			nextAllowedTools,
+			logger
+		});
+		else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
 	}
 	nextToolsSettings.shell = shell;
-	nextToolsSettings.read = read;
-	nextToolsSettings.write = write;
+	nextToolsSettings.read = pathTable(pathBuckets.read);
+	nextToolsSettings.write = pathTable(pathBuckets.write);
+	for (const key of ["grep", "glob"]) {
+		const bucket = pathBuckets[key];
+		if (bucket && (bucket.allow.length > 0 || bucket.deny.length > 0)) nextToolsSettings[key] = pathTable(bucket);
+	}
 	return {
 		...existing,
 		allowedTools: [...nextAllowedTools].toSorted(),
 		toolsSettings: nextToolsSettings
 	};
 }
+function pathTable(bucket) {
+	return {
+		allowedPaths: bucket?.allow ?? [],
+		deniedPaths: bucket?.deny ?? []
+	};
+}
+function applyKiroWebPermission({ category, pattern, action, nextAllowedTools, logger }) {
+	if (pattern !== "*") {
+		logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
+		return;
+	}
+	const toolName = category === "webfetch" ? "web_fetch" : "web_search";
+	if (action === "allow") nextAllowedTools.add(toolName);
+	else nextAllowedTools.delete(toolName);
+}
 function asRecord$1(value) {
 	const result = UnknownRecordSchema.safeParse(value);
 	return result.success ? result.data : {};
@@ -19380,6 +20298,17 @@ function asRecord$1(value) {
 function asStringArray(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
+/**
+* Build a canonical `{ pattern: action }` map from a Kiro tool settings record's
+* allow/deny string arrays (e.g. `allowedPaths`/`deniedPaths` or
+* `allowedCommands`/`deniedCommands`).
+*/
+function rulesFromArrays(settings, allowKey, denyKey) {
+	const rules = {};
+	for (const pattern of asStringArray(settings[allowKey])) rules[pattern] = "allow";
+	for (const pattern of asStringArray(settings[denyKey])) rules[pattern] = "deny";
+	return rules;
+}
 //#endregion
 //#region src/features/permissions/opencode-permissions.ts
 const OpencodePermissionSchema = z.union([z.enum([
@@ -19391,6 +20320,28 @@ const OpencodePermissionSchema = z.union([z.enum([
 	"ask",
 	"deny"
 ]))]);
+/**
+* Canonical rulesync permission categories that carry a cross-tool meaning (see
+* the "Supported tool categories" list in `docs/reference/file-formats.md`).
+* On import, any OpenCode category outside this set — plus MCP tool names — is
+* treated as OpenCode-only and routed into the `opencode` override block so a
+* subsequent `rulesync generate` does not leak it into other tools' configs.
+*/
+const CANONICAL_PERMISSION_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedPermissionCategory(category) {
+	return category === "*" || CANONICAL_PERMISSION_CATEGORIES.has(category) || category.startsWith("mcp__");
+}
 const OpencodePermissionsConfigSchema = z.looseObject({ permission: z.optional(z.union([z.enum([
 	"allow",
 	"ask",
@@ -19452,9 +20403,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
+		const parsed = parse(fileContent ?? "{}");
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const overridePermission = rulesyncJson.opencode?.permission ?? {};
 		const nextJson = {
-			...parse(fileContent ?? "{}"),
-			permission: rulesyncPermissions.getJson().permission
+			...parsed,
+			permission: {
+				...rulesyncJson.permission,
+				...overridePermission
+			}
 		};
 		return new OpencodePermissions({
 			outputRoot,
@@ -19465,8 +20422,20 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission;
+		if (rawPermission === void 0 || typeof rawPermission === "string") {
+			const permission = this.normalizePermission(rawPermission);
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		}
+		const shared = {};
+		const overrideOnly = {};
+		for (const [category, value] of Object.entries(rawPermission)) if (isSharedPermissionCategory(category)) shared[category] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[category] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			opencode: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19496,10 +20465,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			validate: false
 		});
 	}
+	/**
+	* Normalize the uniform/undefined forms of OpenCode's `permission` field into
+	* the canonical rulesync shape. The object form is handled directly in
+	* `toRulesyncPermissions` (it needs to split shared vs OpenCode-only
+	* categories), so this only covers the two remaining cases.
+	*/
 	normalizePermission(permission) {
 		if (!permission) return {};
-		if (typeof permission === "string") return { "*": { "*": permission } };
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
+		return { "*": { "*": permission } };
 	}
 };
 //#endregion
@@ -19573,6 +20547,24 @@ function buildQwenPermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
 	return `${toolName}(${pattern})`;
 }
+const QWEN_OVERRIDE_TOOLS_KEYS = [
+	"approvalMode",
+	"autoAccept",
+	"sandbox",
+	"sandboxImage",
+	"disabled"
+];
+const QWEN_OVERRIDE_SECURITY_KEYS = ["folderTrust"];
+function asPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+/** Pick the override-managed keys out of a settings group into a fresh record. */
+function pickQwenOverrideKeys(group, keys) {
+	const source = asPlainRecord(group);
+	const picked = {};
+	for (const key of keys) if (source[key] !== void 0) picked[key] = source[key];
+	return picked;
+}
 var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -19638,6 +20630,15 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			...settings,
 			permissions: mergedPermissions
 		};
+		const override = config.qwencode;
+		if (override?.tools !== void 0) merged.tools = {
+			...asPlainRecord(settings.tools),
+			...asPlainRecord(override.tools)
+		};
+		if (override?.security !== void 0) merged.security = {
+			...asPlainRecord(settings.security),
+			...asPlainRecord(override.security)
+		};
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new QwencodePermissions({
 			outputRoot,
@@ -19663,7 +20664,14 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const overrideTools = pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS);
+		const overrideSecurity = pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS);
+		const qwencodeOverride = {};
+		if (Object.keys(overrideTools).length > 0) qwencodeOverride.tools = overrideTools;
+		if (Object.keys(overrideSecurity).length > 0) qwencodeOverride.security = overrideSecurity;
+		const result = { ...config };
+		if (Object.keys(qwencodeOverride).length > 0) result.qwencode = qwencodeOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -19824,6 +20832,16 @@ function toPermissionsTable(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return { ...value };
 }
+const REASONIX_OVERRIDE_AGENT_KEYS = ["plan_mode_allowed_tools", "plan_mode_read_only_commands"];
+function asReasonixRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function pickReasonixKeys(source, keys) {
+	const record = asReasonixRecord(source);
+	const picked = {};
+	for (const key of keys) if (record[key] !== void 0) picked[key] = record[key];
+	return picked;
+}
 var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	toml;
 	constructor(params) {
@@ -19885,6 +20903,15 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			...parsed,
 			permissions: mergedPermissions
 		};
+		const override = config.reasonix;
+		if (override?.sandbox !== void 0) merged.sandbox = {
+			...asReasonixRecord(parsed.sandbox),
+			...asReasonixRecord(override.sandbox)
+		};
+		if (override?.agent !== void 0) merged.agent = {
+			...asReasonixRecord(parsed.agent),
+			...asReasonixRecord(override.agent)
+		};
 		const fileContent = smolToml.stringify(merged);
 		return new ReasonixPermissions({
 			outputRoot,
@@ -19901,7 +20928,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			ask: toStringArray$1(permissions.ask),
 			deny: toStringArray$1(permissions.deny)
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const sandbox = asReasonixRecord(this.toml.sandbox);
+		const agentPlanMode = pickReasonixKeys(this.toml.agent, REASONIX_OVERRIDE_AGENT_KEYS);
+		const reasonixOverride = {};
+		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
+		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
+		const result = { ...config };
+		if (Object.keys(reasonixOverride).length > 0) result.reasonix = reasonixOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -20211,6 +21245,8 @@ function isPermissionAction(value) {
 const TAKT_PROVIDER_KEY = "provider";
 const TAKT_PROVIDER_PROFILES_KEY = "provider_profiles";
 const TAKT_DEFAULT_PERMISSION_MODE_KEY = "default_permission_mode";
+const TAKT_STEP_PERMISSION_OVERRIDES_KEY = "step_permission_overrides";
+const TAKT_PROVIDER_OPTIONS_KEY = "provider_options";
 const TAKT_DEFAULT_PROVIDER = "claude";
 const CATCH_ALL_PATTERN = "*";
 /**
@@ -20240,10 +21276,16 @@ const CATCH_ALL_PATTERN = "*";
 *     `bash: { "*": "deny" }`. These round-trip the generate mapping.
 *
 * Both project and global scope are supported. The shared config is merged in
-* place: only `provider_profiles.<provider>.default_permission_mode` is set;
-* the active provider's other keys (e.g. `step_permission_overrides`), every
-* other provider profile, and all other top-level keys are preserved. The file
-* is never deleted.
+* place: `provider_profiles.<provider>.default_permission_mode` is set from the
+* derived mode; every other provider profile and all other top-level keys are
+* preserved. The file is never deleted.
+*
+* Two Takt-specific surfaces with no canonical category round-trip through the
+* `takt` override (see `TaktPermissionsOverrideSchema`):
+* `step_permission_overrides` (a per-step mode map inside the active provider
+* profile, layered on top of `default_permission_mode`) and `provider_options`
+* (a top-level per-provider sandbox/network table). Both are authored on
+* generate and re-extracted on import.
 */
 var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	constructor(params) {
@@ -20275,37 +21317,62 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
 		const paths = TaktPermissions.getSettablePaths({ global });
-		const config = parseTaktConfig(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath);
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: existingContent,
+			filePath,
+			invalidRootPolicy: "error"
+		});
+		const rulesyncJson = rulesyncPermissions.getJson();
 		const provider = resolveActiveProvider(config);
-		const mode = deriveTaktPermissionMode(rulesyncPermissions.getJson());
-		const existingProfiles = isPlainObject(config[TAKT_PROVIDER_PROFILES_KEY]) ? config[TAKT_PROVIDER_PROFILES_KEY] : {};
-		const existingProfile = isPlainObject(existingProfiles[provider]) ? existingProfiles[provider] : {};
-		const merged = {
-			...config,
-			[TAKT_PROVIDER_PROFILES_KEY]: {
-				...existingProfiles,
-				[provider]: {
-					...existingProfile,
-					[TAKT_DEFAULT_PERMISSION_MODE_KEY]: mode
-				}
-			}
+		const mode = deriveTaktPermissionMode(rulesyncJson);
+		const override = isPlainObject(rulesyncJson.takt) ? rulesyncJson.takt : void 0;
+		const stepOverrides = isPlainObject(override?.[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? override[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
+		const overrideProviderOptions = isPlainObject(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const patch = {
+			[TAKT_PROVIDER_PROFILES_KEY]: { [provider]: {
+				[TAKT_DEFAULT_PERMISSION_MODE_KEY]: mode,
+				...stepOverrides !== void 0 && { [TAKT_STEP_PERMISSION_OVERRIDES_KEY]: stepOverrides }
+			} },
+			...overrideProviderOptions !== void 0 && { [TAKT_PROVIDER_OPTIONS_KEY]: overrideProviderOptions }
 		};
 		return new TaktPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: dump(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: TAKT_CONFIG_SHARED_FILE_KEY,
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath
+			}),
 			validate: true,
 			global
 		});
 	}
 	toRulesyncPermissions() {
-		const config = parseTaktConfig(this.getFileContent(), this.getRelativeDirPath(), this.getRelativeFilePath());
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent(),
+			filePath: join(this.getRelativeDirPath(), this.getRelativeFilePath()),
+			invalidRootPolicy: "error"
+		});
 		const provider = resolveActiveProvider(config);
 		const profiles = isPlainObject(config[TAKT_PROVIDER_PROFILES_KEY]) ? config[TAKT_PROVIDER_PROFILES_KEY] : {};
-		const mode = (isPlainObject(profiles[provider]) ? profiles[provider] : {})[TAKT_DEFAULT_PERMISSION_MODE_KEY];
+		const profile = isPlainObject(profiles[provider]) ? profiles[provider] : {};
+		const mode = profile[TAKT_DEFAULT_PERMISSION_MODE_KEY];
 		const rulesyncConfig = taktModeToRulesyncConfig(mode);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+		const stepOverrides = isPlainObject(profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
+		const providerOptions = isPlainObject(config[TAKT_PROVIDER_OPTIONS_KEY]) ? config[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const taktOverride = {};
+		if (stepOverrides && Object.keys(stepOverrides).length > 0) taktOverride[TAKT_STEP_PERMISSION_OVERRIDES_KEY] = stepOverrides;
+		if (providerOptions && Object.keys(providerOptions).length > 0) taktOverride[TAKT_PROVIDER_OPTIONS_KEY] = providerOptions;
+		const result = { ...rulesyncConfig };
+		if (Object.keys(taktOverride).length > 0) result.takt = taktOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -20465,6 +21532,7 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			if (deny.size > 0) nextTool.denylist = [...deny].toSorted();
 			tools[vibeToolName] = nextTool;
 		}
+		applyVibeSensitivePatterns(tools, rulesyncPermissions.getJson().vibe);
 		config.tools = tools;
 		if (enabledTools.size > 0) config.enabled_tools = [...enabledTools].toSorted();
 		else delete config.enabled_tools;
@@ -20481,16 +21549,25 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 	}
 	toRulesyncPermissions() {
 		const permission = {};
+		const vibeOverridePermission = {};
 		for (const tool of toStringArray(this.toml.enabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "allow";
 		for (const tool of toStringArray(this.toml.disabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "deny";
 		for (const [vibeToolName, toolConfig] of Object.entries(toVibeToolsRecord(this.toml.tools))) {
-			const rules = ensurePermission(permission, toCanonicalToolName$1(vibeToolName));
+			const category = toCanonicalToolName$1(vibeToolName);
+			const rules = ensurePermission(permission, category);
 			const action = fromVibePermission(toolConfig.permission);
 			if (action !== void 0) rules["*"] = action;
 			for (const pattern of toStringArray(toolConfig.allow ?? toolConfig.allowlist)) rules[pattern] = "allow";
 			for (const pattern of toStringArray(toolConfig.deny ?? toolConfig.denylist)) rules[pattern] = "deny";
+			const sensitivePatterns = toStringArray(toolConfig.sensitive_patterns);
+			if (sensitivePatterns.length > 0) vibeOverridePermission[category] = { sensitive_patterns: sensitivePatterns };
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
+		const json = Object.keys(vibeOverridePermission).length > 0 ? {
+			permission,
+			vibe: { permission: vibeOverridePermission }
+		} : { permission };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -20517,6 +21594,22 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		});
 	}
 };
+/**
+* Apply the Vibe-scoped override's per-tool `sensitive_patterns` (patterns that
+* escalate to ASK even when the base permission is ALWAYS). rulesync owns this
+* list for any category the override names: a present list is set, an empty
+* one clears it. Categories not named keep whatever the existing file had.
+*/
+function applyVibeSensitivePatterns(tools, vibeOverride) {
+	for (const [category, toolOverride] of Object.entries(vibeOverride?.permission ?? {})) {
+		const vibeToolName = toVibeToolName(category);
+		const nextTool = toVibeToolConfig(tools[vibeToolName]);
+		const patterns = toStringArray(toolOverride.sensitive_patterns);
+		if (patterns.length > 0) nextTool.sensitive_patterns = [...patterns].toSorted();
+		else delete nextTool.sensitive_patterns;
+		tools[vibeToolName] = nextTool;
+	}
+}
 function parseVibeConfig(fileContent) {
 	const parsed = smolToml.parse(fileContent || smolToml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -20561,6 +21654,11 @@ function ensurePermission(permission, category) {
 const WARP_GLOBAL_ONLY_MESSAGE = "Warp permissions are global-only; use --global to sync Warp's settings.toml";
 const ALLOWLIST_KEY = "agent_mode_command_execution_allowlist";
 const DENYLIST_KEY = "agent_mode_command_execution_denylist";
+const WARP_OVERRIDE_KEYS = [
+	"agent_mode_coding_permissions",
+	"agent_mode_coding_file_read_allowlist",
+	"agent_mode_execute_readonly_commands"
+];
 /**
 * Warp's `settings.toml` lives in a different directory per platform (Stable
 * channel). The home directory is resolved by the processor through
@@ -20596,8 +21694,16 @@ function warpSettingsDir() {
 * patterns as regexes when targeting Warp (mirrors the Zed permissions
 * adapter). Warp has no per-command "ask" list, so `ask` rules are dropped; and
 * the command lists only model shell commands, so non-`bash` categories are
-* skipped (with a warning when they carry `deny` rules). MCP allow/deny and the
-* file-read permissions are separate surfaces not modeled here.
+* skipped (with a warning when they carry `deny` rules).
+*
+* Warp's `[agents.profiles]` table also exposes file-read/read-only autonomy
+* knobs that do not fit the canonical `allow | ask | deny` per-command model:
+* `agent_mode_coding_permissions`, `agent_mode_coding_file_read_allowlist`, and
+* `agent_mode_execute_readonly_commands`. These are authored and round-tripped
+* through the `warp` override namespace (see `WarpPermissionsOverrideSchema`):
+* on **import** they are lifted from `settings.toml` into the override, and on
+* **export** they are merged back into `[agents.profiles]` (the override wins).
+* MCP allow/deny is a separate surface not modeled here.
 *
 * The `settings.toml` file holds all of Warp's settings, so the
 * `[agents.profiles]` block is merged in place and the file is never deleted.
@@ -20642,12 +21748,15 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Warp settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToWarpPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
 		const agents = isRecord(settings.agents) ? { ...settings.agents } : {};
 		const profiles = isRecord(agents.profiles) ? { ...agents.profiles } : {};
+		const override = config.warp;
+		if (isRecord(override)) Object.assign(profiles, override);
 		const mergedAllow = uniq(allow.toSorted());
 		const mergedDeny = uniq(deny.toSorted());
 		if (mergedAllow.length > 0) profiles[ALLOWLIST_KEY] = mergedAllow;
@@ -20678,7 +21787,11 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 			allow: isStringArray(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
 			deny: isStringArray(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const warpOverride = {};
+		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
+		const result = { ...config };
+		if (Object.keys(warpOverride).length > 0) result.warp = warpOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -24044,8 +25157,9 @@ const DevinSkillFrontmatterSchema = z.looseObject({
 * Represents a Devin (now Devin Desktop) skill directory.
 * Devin supports skills in both project mode under .devin/skills/
 * (preferred since the Devin Desktop rebrand; .devin/skills/ is the legacy
-* fallback the tool still reads) and global mode under ~/.codeium/windsurf/skills/
-* (unchanged by the rebrand).
+* fallback the tool still reads) and global mode under the Devin-native
+* ~/.config/devin/skills/ (consistent with Devin's global agents/rules paths;
+* the legacy channel-dependent ~/.codeium/<channel>/skills/ is no longer emitted).
 */
 var DevinSkill = class DevinSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = DevinSkill.getSettablePaths().relativeDirPath, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -24067,7 +25181,7 @@ var DevinSkill = class DevinSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global = false } = {}) {
-		if (global) return { relativeDirPath: CODEIUM_WINDSURF_SKILLS_DIR_PATH };
+		if (global) return { relativeDirPath: DEVIN_GLOBAL_SKILLS_DIR_PATH };
 		return { relativeDirPath: DEVIN_SKILLS_DIR_PATH };
 	}
 	getFrontmatter() {
@@ -27126,7 +28240,7 @@ const QwencodeSubagentFrontmatterSchema = z.looseObject({
 	disallowedTools: z.optional(z.array(z.string())),
 	maxTurns: z.optional(z.number()),
 	color: z.optional(z.string()),
-	mcpServers: z.optional(z.array(z.string())),
+	mcpServers: z.optional(z.union([z.array(z.string()), z.record(z.string(), z.looseObject({}))])),
 	hooks: z.optional(z.unknown())
 });
 var QwencodeSubagent = class QwencodeSubagent extends ToolSubagent {
@@ -29153,14 +30267,21 @@ def register(ctx):
 `;
 }
 function getEnabledPluginConfigContent(currentContent) {
-	const config = parseHermesConfig(currentContent);
+	const config = parseSharedConfig({
+		format: "yaml",
+		fileContent: currentContent
+	});
 	const plugins = config.plugins && typeof config.plugins === "object" ? config.plugins : {};
 	const enabled = Array.isArray(plugins.enabled) ? plugins.enabled : [];
-	config.plugins = {
-		...plugins,
-		enabled: Array.from(/* @__PURE__ */ new Set([...enabled, "rulesync-subagents"]))
-	};
-	return stringifyHermesConfig(config);
+	return applySharedConfigPatch({
+		fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+		feature: "subagents",
+		existingContent: currentContent,
+		patch: { plugins: {
+			...plugins,
+			enabled: Array.from(/* @__PURE__ */ new Set([...enabled, "rulesync-subagents"]))
+		} }
+	});
 }
 function getSubagentSpec(rulesyncSubagent) {
 	const json = rulesyncSubagent.getFrontmatter();
@@ -29246,6 +30367,17 @@ var HermesagentSubagent = class HermesagentSubagent extends ToolSubagent {
 	static getSettablePaths() {
 		return { relativeDirPath: HERMESAGENT_RULESYNC_SUBAGENTS_DIR_PATH };
 	}
+	/**
+	* Beyond the subagent spec files, generation also read-modify-writes the
+	* shared `~/.hermes/config.yaml` (enabling the `rulesync-subagents` plugin),
+	* so the write must be declared for the shared-file order derivation.
+	*/
+	static getExtraSharedWritePaths() {
+		return [{
+			relativeDirPath: HERMESAGENT_GLOBAL_DIR,
+			relativeFilePath: basename(HERMESAGENT_CONFIG_FILE_PATH)
+		}];
+	}
 	static getSettablePathsForRulesyncSubagent(rulesyncSubagent) {
 		return [join(HERMESAGENT_RULESYNC_SUBAGENTS_DIR_PATH, `${subagentSlug(rulesyncSubagent.getRelativePathFromCwd())}.json`)];
 	}
@@ -30984,7 +32116,9 @@ const RulesyncRuleFrontmatterSchema = z.object({
 	})),
 	kiro: z.optional(z.looseObject({
 		inclusion: z.optional(z.string()),
-		fileMatchPattern: z.optional(z.union([z.string(), z.array(z.string())]))
+		fileMatchPattern: z.optional(z.union([z.string(), z.array(z.string())])),
+		name: z.optional(z.string()),
+		description: z.optional(z.string())
 	})),
 	takt: z.optional(z.looseObject({
 		name: z.optional(z.string()),
@@ -33900,7 +35034,8 @@ function toFileMatchPattern(globs) {
 *
 * Precedence:
 * 1. An explicit `kiro.inclusion` block round-trips as-is (with `fileMatchPattern`
-*    taken from the block, or derived from `globs` when omitted for `fileMatch`).
+*    taken from the block, or derived from `globs` when omitted for `fileMatch`;
+*    and with the companion `name`/`description` carried through for `auto`).
 * 2. Otherwise specific (non-wildcard) globs map to `fileMatch`, scoping the rule
 *    to matching files instead of leaving it implicitly always-on.
 * 3. Otherwise the rule stays `always` — represented by omitting the block so the
@@ -33918,6 +35053,11 @@ function deriveKiroInclusion({ kiro, globs }) {
 				fileMatchPattern
 			} : { inclusion: "fileMatch" };
 		}
+		if (kiro.inclusion === "auto") return {
+			inclusion: "auto",
+			...kiro.name !== void 0 ? { name: kiro.name } : {},
+			...kiro.description !== void 0 ? { description: kiro.description } : {}
+		};
 		return { inclusion: kiro.inclusion };
 	}
 	const fileMatchPattern = toFileMatchPattern(specificGlobs);
@@ -33989,6 +35129,8 @@ var KiroRule = class KiroRule extends ToolRule {
 		const rawPattern = frontmatter.fileMatchPattern;
 		const fileMatchPattern = Array.isArray(rawPattern) ? rawPattern.filter((p) => typeof p === "string") : typeof rawPattern === "string" ? rawPattern : void 0;
 		const globs = inclusion === "fileMatch" ? fileMatchPattern === void 0 ? [] : Array.isArray(fileMatchPattern) ? fileMatchPattern : [fileMatchPattern] : [];
+		const name = typeof frontmatter.name === "string" ? frontmatter.name : void 0;
+		const description = typeof frontmatter.description === "string" ? frontmatter.description : void 0;
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RulesyncRule.getSettablePaths().recommended.relativeDirPath,
@@ -33999,7 +35141,9 @@ var KiroRule = class KiroRule extends ToolRule {
 				globs,
 				kiro: {
 					inclusion,
-					...fileMatchPattern !== void 0 ? { fileMatchPattern } : {}
+					...fileMatchPattern !== void 0 ? { fileMatchPattern } : {},
+					...inclusion === "auto" && name !== void 0 ? { name } : {},
+					...inclusion === "auto" && description !== void 0 ? { description } : {}
 				}
 			},
 			body
@@ -36173,6 +37317,197 @@ function buildPermissionsStrategy(ctx) {
 	};
 }
 //#endregion
+//#region src/types/processor-registry.ts
+const PROCESSOR_REGISTRY = [
+	{
+		feature: "rules",
+		processor: RulesProcessor,
+		schema: RulesProcessorToolTargetSchema,
+		factory: toolRuleFactories
+	},
+	{
+		feature: "ignore",
+		processor: IgnoreProcessor,
+		schema: IgnoreProcessorToolTargetSchema,
+		factory: toolIgnoreFactories
+	},
+	{
+		feature: "mcp",
+		processor: McpProcessor,
+		schema: McpProcessorToolTargetSchema,
+		factory: toolMcpFactories
+	},
+	{
+		feature: "commands",
+		processor: CommandsProcessor,
+		schema: CommandsProcessorToolTargetSchema,
+		factory: toolCommandFactories
+	},
+	{
+		feature: "subagents",
+		processor: SubagentsProcessor,
+		schema: SubagentsProcessorToolTargetSchema,
+		factory: toolSubagentFactories
+	},
+	{
+		feature: "skills",
+		processor: SkillsProcessor,
+		schema: SkillsProcessorToolTargetSchema,
+		factory: toolSkillFactories
+	},
+	{
+		feature: "hooks",
+		processor: HooksProcessor,
+		schema: HooksProcessorToolTargetSchema,
+		factory: toolHooksFactories
+	},
+	{
+		feature: "permissions",
+		processor: PermissionsProcessor,
+		schema: PermissionsProcessorToolTargetSchema,
+		factory: toolPermissionsFactories
+	}
+];
+const getProcessorRegistryEntry = (feature) => {
+	const entry = PROCESSOR_REGISTRY.find((e) => e.feature === feature);
+	if (!entry) throw new Error(`No processor registered for feature: ${feature}`);
+	return entry;
+};
+//#endregion
+//#region src/lib/shared-file-derive.ts
+/**
+* The single declaration of the cross-feature write order for shared
+* (read-modify-write) config files: when two features write the same on-disk
+* file, the earlier one writes first and the later one merges on top, so the
+* later feature's conflict policy decides what survives (e.g. `permissions`
+* overriding `ignore`-derived `Read(...)` denies in `.claude/settings.json`).
+* The generation step graph's `dependsOn` edges are derived from this list
+* plus the registry's `getSettablePaths` declarations — adding a tool or a
+* shared path never requires touching the graph by hand.
+*/
+const SHARED_WRITE_FEATURE_ORDER = [
+	"ignore",
+	"subagents",
+	"mcp",
+	"hooks",
+	"permissions",
+	"rules"
+];
+const SHARED_WRITE_FEATURES = new Set(SHARED_WRITE_FEATURE_ORDER);
+const TARGETS_NOT_DERIVED = /* @__PURE__ */ new Set(["augmentcode-legacy", "claudecode-legacy"]);
+const sharedFileKey = (path) => {
+	const dir = path.relativeDirPath.replace(/\\/g, "/").replace(/\/$/, "");
+	const file = path.relativeFilePath.replace(/\\/g, "/");
+	return dir === "" || dir === "." ? file : `${dir}/${file}`;
+};
+const settablePathsForScope = (cls, global) => {
+	const paths = [];
+	let settable;
+	try {
+		settable = cls.getSettablePaths?.({ global });
+	} catch {
+		return paths;
+	}
+	if (settable?.relativeFilePath) paths.push({
+		relativeDirPath: settable.relativeDirPath ?? ".",
+		relativeFilePath: settable.relativeFilePath
+	});
+	if (settable?.root) {
+		paths.push(settable.root);
+		for (const alt of settable.alternativeRoots ?? []) paths.push(alt);
+	}
+	for (const path of cls.getExtraSharedWritePaths?.({ global }) ?? []) if (path.relativeFilePath) paths.push(path);
+	return paths;
+};
+const collectFactoryPaths = (factory) => [...settablePathsForScope(factory.class, false), ...settablePathsForScope(factory.class, true)];
+/**
+* Derive, from the processor registry, every on-disk file that two or more
+* features read-modify-write. Source of truth the generation step graph's
+* `writesSharedFile` declarations must match.
+*/
+const deriveSharedFileWriters = () => {
+	const byKey = /* @__PURE__ */ new Map();
+	const pathByKey = /* @__PURE__ */ new Map();
+	for (const entry of PROCESSOR_REGISTRY) {
+		if (!SHARED_WRITE_FEATURES.has(entry.feature)) continue;
+		const factories = entry.factory;
+		for (const [tool, factory] of factories) {
+			if (TARGETS_NOT_DERIVED.has(tool)) continue;
+			for (const path of collectFactoryPaths(factory)) {
+				const key = sharedFileKey(path);
+				if (!pathByKey.has(key)) pathByKey.set(key, path);
+				let features = byKey.get(key);
+				if (!features) {
+					features = /* @__PURE__ */ new Map();
+					byKey.set(key, features);
+				}
+				let tools = features.get(entry.feature);
+				if (!tools) {
+					tools = /* @__PURE__ */ new Set();
+					features.set(entry.feature, tools);
+				}
+				tools.add(tool);
+			}
+		}
+	}
+	const writers = [];
+	for (const [key, features] of byKey) {
+		if (features.size < 2) continue;
+		const path = pathByKey.get(key);
+		const toolsByFeature = /* @__PURE__ */ new Map();
+		for (const [feature, tools] of features) toolsByFeature.set(feature, [...tools].toSorted());
+		writers.push({
+			key,
+			relativeDirPath: path.relativeDirPath,
+			relativeFilePath: path.relativeFilePath,
+			features: [...features.keys()].toSorted(),
+			toolsByFeature
+		});
+	}
+	return writers.toSorted((a, b) => a.key.localeCompare(b.key));
+};
+/**
+* Derive, per shared-write feature, the shared files it writes and the
+* `dependsOn` edges that fix a safe write order: for every shared file, each
+* writer depends on all writers that precede it in
+* {@link SHARED_WRITE_FEATURE_ORDER}. This is the source the generation step
+* graph consumes, so registry changes (a new tool, a new settable path)
+* propagate into the execution order without a hand-maintained declaration.
+*
+* @throws Error if a feature writes a shared file but has no position in
+*   `SHARED_WRITE_FEATURE_ORDER` — ordering it is a deliberate decision about
+*   whose merge policy wins, so it must be made explicitly there.
+*/
+const deriveSharedWriteSteps = () => {
+	const orderIndex = new Map(SHARED_WRITE_FEATURE_ORDER.map((feature, index) => [feature, index]));
+	const filesByFeature = /* @__PURE__ */ new Map();
+	const depsByFeature = /* @__PURE__ */ new Map();
+	for (const writer of deriveSharedFileWriters()) {
+		for (const feature of writer.features) if (!orderIndex.has(feature)) throw new Error(`Feature '${feature}' writes the shared file '${writer.key}' but has no position in SHARED_WRITE_FEATURE_ORDER. Decide where its writes merge relative to the other features and add it to the order.`);
+		const ordered = [...writer.features].toSorted((a, b) => orderIndex.get(a) - orderIndex.get(b));
+		for (const [position, feature] of ordered.entries()) {
+			let files = filesByFeature.get(feature);
+			if (!files) {
+				files = /* @__PURE__ */ new Set();
+				filesByFeature.set(feature, files);
+			}
+			files.add(writer.key);
+			let deps = depsByFeature.get(feature);
+			if (!deps) {
+				deps = /* @__PURE__ */ new Set();
+				depsByFeature.set(feature, deps);
+			}
+			for (const earlier of ordered.slice(0, position)) deps.add(earlier);
+		}
+	}
+	const steps = /* @__PURE__ */ new Map();
+	for (const [feature, files] of filesByFeature) steps.set(feature, {
+		writesSharedFile: [...files].toSorted(),
+		dependsOn: [...depsByFeature.get(feature) ?? []].toSorted((a, b) => orderIndex.get(a) - orderIndex.get(b))
+	});
+	return steps;
+};
+//#endregion
 //#region src/lib/generate.ts
 async function processFeatureGeneration(params) {
 	const { config, processor, toolFiles, skipFilePaths } = params;
@@ -36322,98 +37657,53 @@ function resolveExecutionOrder(steps) {
 	if (ordered.length !== steps.length) throw new Error("Generation steps contain a cyclic 'dependsOn' dependency.");
 	return ordered;
 }
+const SHARED_WRITE_STEPS = deriveSharedWriteSteps();
+const sharedWriteMeta = (id) => {
+	const step = SHARED_WRITE_STEPS.get(id);
+	return step ? {
+		writesSharedFile: step.writesSharedFile,
+		dependsOn: step.dependsOn
+	} : {};
+};
 /**
 * The static shape of the generation step graph: which steps write which shared
 * (read-modify-write) config files, and the `dependsOn` edges that fix a safe order
-* for those writers. Exported (separately from the `run` closures, which need a
-* live `config`/`logger`) so `resolveExecutionOrder`'s ordering guarantee can be
-* tested directly against the real graph rather than a hand-copied one. Readonly
-* so a consumer can't mutate this module-level singleton and affect every
-* subsequent `generate()` call in the process.
+* for those writers. Both are derived from the processor registry's settable
+* paths and `SHARED_WRITE_FEATURE_ORDER` (see `shared-file-derive.ts`), so a new
+* tool or shared path never requires editing this graph. Exported (separately
+* from the `run` closures, which need a live `config`/`logger`) so
+* `resolveExecutionOrder`'s ordering guarantee can be tested directly against
+* the real graph rather than a hand-copied one. Readonly so a consumer can't
+* mutate this module-level singleton and affect every subsequent `generate()`
+* call in the process.
 */
 const GENERATION_STEP_GRAPH = [
 	{
 		id: "ignore",
-		writesSharedFile: [".claude/settings.json", ".zed/settings.json"]
+		...sharedWriteMeta("ignore")
 	},
 	{
 		id: "mcp",
-		writesSharedFile: [
-			".amp/settings.json",
-			".augment/settings.json",
-			".codex/config.toml",
-			".config/amp/settings.json",
-			".config/devin/config.json",
-			".config/opencode/opencode.json",
-			".config/zed/settings.json",
-			".devin/config.json",
-			".grok/config.toml",
-			".hermes/config.yaml",
-			".qwen/settings.json",
-			".reasonix/config.toml",
-			".takt/config.yaml",
-			".vibe/config.toml",
-			".zed/settings.json",
-			"kilo.json",
-			"opencode.json",
-			"reasonix.toml"
-		],
-		dependsOn: ["ignore"]
+		...sharedWriteMeta("mcp")
 	},
 	{ id: "commands" },
-	{ id: "subagents" },
+	{
+		id: "subagents",
+		...sharedWriteMeta("subagents")
+	},
 	{ id: "skills" },
 	{
 		id: "hooks",
-		writesSharedFile: [
-			".augment/settings.json",
-			".claude/settings.json",
-			".codex/config.toml",
-			".config/devin/config.json",
-			".hermes/config.yaml",
-			".kiro/agents/default.json",
-			".qwen/settings.json",
-			".vibe/config.toml"
-		],
-		dependsOn: ["ignore", "mcp"]
+		...sharedWriteMeta("hooks")
 	},
 	{
 		id: "permissions",
-		writesSharedFile: [
-			".amp/settings.json",
-			".augment/settings.json",
-			".claude/settings.json",
-			".codex/config.toml",
-			".config/amp/settings.json",
-			".config/devin/config.json",
-			".config/opencode/opencode.json",
-			".config/zed/settings.json",
-			".devin/config.json",
-			".grok/config.toml",
-			".hermes/config.yaml",
-			".kiro/agents/default.json",
-			".qwen/settings.json",
-			".reasonix/config.toml",
-			".takt/config.yaml",
-			".vibe/config.toml",
-			".zed/settings.json",
-			"opencode.json",
-			"reasonix.toml"
-		],
-		dependsOn: [
-			"ignore",
-			"hooks",
-			"mcp"
-		]
+		...sharedWriteMeta("permissions")
 	},
 	{
 		id: "rules",
-		writesSharedFile: ["kilo.json", "opencode.json"],
-		dependsOn: [
-			"mcp",
-			"skills",
-			"permissions"
-		]
+		...sharedWriteMeta("rules"),
+		dependsOn: [...sharedWriteMeta("rules").dependsOn ?? [], "skills"]
 	}
 ];
 /**
@@ -37105,6 +38395,6 @@ async function importPermissionsCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { CLIError as $, IgnoreProcessor as A, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as At, toolCommandFactories as B, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Bt, PermissionsProcessorToolTargetSchema as C, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Ct, McpProcessorToolTargetSchema as D, RULESYNC_HOOKS_FILE_NAME as Dt, McpProcessor as E, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Et, HooksProcessorToolTargetSchema as F, RULESYNC_PERMISSIONS_FILE_NAME as Ft, CLAUDECODE_SKILLS_DIR_PATH as G, CLAUDECODE_LOCAL_RULE_FILE_NAME as H, formatError as Ht, toolHooksFactories as I, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as It, stringifyFrontmatter as J, RulesyncCommand as K, RulesyncHooks as L, RULESYNC_RELATIVE_DIR_PATH as Lt, toolIgnoreFactories as M, RULESYNC_MCP_RELATIVE_FILE_PATH as Mt, RulesyncIgnore as N, RULESYNC_MCP_SCHEMA_URL as Nt, toolMcpFactories as O, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Ot, HooksProcessor as P, RULESYNC_OVERVIEW_FILE_NAME as Pt, JsonLogger as Q, CommandsProcessor as R, RULESYNC_RULES_RELATIVE_DIR_PATH as Rt, PermissionsProcessor as S, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as St, RulesyncPermissions as T, RULESYNC_CONFIG_SCHEMA_URL as Tt, CLAUDECODE_MEMORIES_DIR_NAME as U, ALL_FEATURES as Ut, CLAUDECODE_DIR as V, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Vt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as W, ALL_FEATURES_WITH_WILDCARD as Wt, findControlCharacter as X, ConfigResolver as Y, ConsoleLogger as Z, toolSkillFactories as _, ALL_TOOL_TARGETS as _t, RulesProcessor as a, fileExists as at, RulesyncSkillFrontmatterSchema as b, MAX_FILE_SIZE as bt, RulesyncRule as c, getHomeDirectory as ct, SubagentsProcessorToolTargetSchema as d, readFileContent as dt, ErrorCodes as et, toolSubagentFactories as f, removeDirectory as ft, SkillsProcessorToolTargetSchema as g, writeFileContent as gt, SkillsProcessor as h, toPosixPath as ht, convertFromTool as i, ensureDir as it, IgnoreProcessorToolTargetSchema as j, RULESYNC_MCP_FILE_NAME as jt, RulesyncMcp as k, RULESYNC_IGNORE_RELATIVE_FILE_PATH as kt, RulesyncRuleFrontmatterSchema as l, isSymlink as lt, RulesyncSubagentFrontmatterSchema as m, removeTempDirectory as mt, checkRulesyncDirExists as n, createTempDirectory as nt, RulesProcessorToolTargetSchema as o, findFilesByGlobs as ot, RulesyncSubagent as p, removeFile as pt, RulesyncCommandFrontmatterSchema as q, generate as r, directoryExists as rt, toolRuleFactories as s, getFileSize as st, importFromTool as t, checkPathTraversal as tt, SubagentsProcessor as u, listDirectoryFiles as ut, getLocalSkillDirNames as v, ALL_TOOL_TARGETS_WITH_WILDCARD as vt, toolPermissionsFactories as w, RULESYNC_CONFIG_RELATIVE_FILE_PATH as wt, SKILL_FILE_NAME as x, RULESYNC_AIIGNORE_FILE_NAME as xt, RulesyncSkill as y, ToolTargetSchema as yt, CommandsProcessorToolTargetSchema as z, RULESYNC_SKILLS_RELATIVE_DIR_PATH as zt };
+export { toPosixPath as $, RulesyncCommand as A, createTempDirectory as B, RulesyncHooks as C, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Ct, CLAUDECODE_MEMORIES_DIR_NAME as D, ALL_FEATURES as Dt, CLAUDECODE_LOCAL_RULE_FILE_NAME as E, formatError as Et, ConsoleLogger as F, getFileSize as G, ensureDir as H, JsonLogger as I, listDirectoryFiles as J, getHomeDirectory as K, CLIError as L, stringifyFrontmatter as M, ConfigResolver as N, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as O, ALL_FEATURES_WITH_WILDCARD as Ot, findControlCharacter as P, removeTempDirectory as Q, ErrorCodes as R, HooksProcessor as S, RULESYNC_RULES_RELATIVE_DIR_PATH as St, CLAUDECODE_DIR as T, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Tt, fileExists as U, directoryExists as V, findFilesByGlobs as W, removeDirectory as X, readFileContent as Y, removeFile as Z, RulesyncPermissions as _, RULESYNC_MCP_SCHEMA_URL as _t, convertFromTool as a, RULESYNC_AIIGNORE_FILE_NAME as at, IgnoreProcessor as b, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as bt, RulesyncRuleFrontmatterSchema as c, RULESYNC_CONFIG_RELATIVE_FILE_PATH as ct, RulesyncSubagentFrontmatterSchema as d, RULESYNC_HOOKS_FILE_NAME as dt, writeFileContent as et, SkillsProcessor as f, RULESYNC_HOOKS_RELATIVE_FILE_PATH as ft, SKILL_FILE_NAME as g, RULESYNC_MCP_RELATIVE_FILE_PATH as gt, RulesyncSkillFrontmatterSchema as h, RULESYNC_MCP_FILE_NAME as ht, getProcessorRegistryEntry as i, MAX_FILE_SIZE as it, RulesyncCommandFrontmatterSchema as j, CLAUDECODE_SKILLS_DIR_PATH as k, SubagentsProcessor as l, RULESYNC_CONFIG_SCHEMA_URL as lt, RulesyncSkill as m, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as mt, checkRulesyncDirExists as n, ALL_TOOL_TARGETS_WITH_WILDCARD as nt, RulesProcessor as o, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ot, getLocalSkillDirNames as p, RULESYNC_IGNORE_RELATIVE_FILE_PATH as pt, isSymlink as q, generate as r, ToolTargetSchema as rt, RulesyncRule as s, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as st, importFromTool as t, ALL_TOOL_TARGETS as tt, RulesyncSubagent as u, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as ut, McpProcessor as v, RULESYNC_OVERVIEW_FILE_NAME as vt, CommandsProcessor as w, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as wt, RulesyncIgnore as x, RULESYNC_RELATIVE_DIR_PATH as xt, RulesyncMcp as y, RULESYNC_PERMISSIONS_FILE_NAME as yt, checkPathTraversal as z };
 
-//# sourceMappingURL=import-BkxwFCDM.js.map
+//# sourceMappingURL=import-BxqZVTKb.js.map