rulesync 9.2.0 → 9.4.0

package/dist/{import-H0MKtu9x.cjs → import-DVGMvuhx.cjs}

@@ -114,22 +114,22 @@ function formatError(error) {
 }
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$248 } = node_path.posix;
+const { join: join$247 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "rules");
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "commands");
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "subagents");
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "rules");
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "commands");
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "subagents");
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "skills");
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$248(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "skills");
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$247(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_MCP_FILE_NAME = "mcp.json";
 const RULESYNC_HOOKS_FILE_NAME = "hooks.json";
@@ -3029,8 +3029,8 @@ const DEVIN_SKILLS_DIR_PATH = (0, node_path.join)(DEVIN_DIR, "skills");
 const DEVIN_AGENTS_DIR_PATH = (0, node_path.join)(DEVIN_DIR, "agents");
 const DEVIN_GLOBAL_CONFIG_DIR_PATH = (0, node_path.join)(".config", "devin");
 const DEVIN_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(DEVIN_GLOBAL_CONFIG_DIR_PATH, "agents");
+const DEVIN_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(DEVIN_GLOBAL_CONFIG_DIR_PATH, "skills");
 const CODEIUM_WINDSURF_GLOBAL_WORKFLOWS_DIR_PATH = (0, node_path.join)(CODEIUM_WINDSURF_DIR, "global_workflows");
-const CODEIUM_WINDSURF_SKILLS_DIR_PATH = (0, node_path.join)(CODEIUM_WINDSURF_DIR, "skills");
 const DEVIN_CONFIG_FILE_NAME = "config.json";
 const DEVIN_HOOKS_V1_FILE_NAME = "hooks.v1.json";
 const DEVIN_GLOBAL_AGENTS_FILE_NAME = "AGENTS.md";
@@ -3919,6 +3919,297 @@ const OPENCODE_JSON_FILE_NAME = "opencode.json";
 const OPENCODE_RULE_FILE_NAME = "AGENTS.md";
 const OPENCODE_HOOKS_FILE_NAME = "rulesync-hooks.js";
 //#endregion
+//#region src/constants/takt-paths.ts
+const TAKT_DIR = ".takt";
+const TAKT_FACETS_SUBDIR = "facets";
+const TAKT_FACETS_DIR_PATH = (0, node_path.join)(TAKT_DIR, TAKT_FACETS_SUBDIR);
+const TAKT_RULES_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "policies");
+const TAKT_COMMANDS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "instructions");
+const TAKT_SKILLS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "knowledge");
+const TAKT_SUBAGENTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "personas");
+const TAKT_OUTPUT_CONTRACTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "output-contracts");
+const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
+/**
+* Takt's shared config file. Lives at `.takt/config.yaml` (project) and
+* `~/.takt/config.yaml` (global); it holds the active provider, provider
+* profiles (including permission modes), and other Takt settings.
+* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+const TAKT_CONFIG_FILE_NAME = "config.yaml";
+/**
+* Top-level key in Takt's `config.yaml` holding the workflow MCP transport
+* allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
+* transport must be explicitly enabled here before any workflow-defined MCP
+* server using it is permitted to run.
+* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+const TAKT_WORKFLOW_MCP_SERVERS_KEY = "workflow_mcp_servers";
+//#endregion
+//#region src/utils/prototype-pollution.ts
+/**
+* Keys that, if walked into when constructing or merging objects from
+* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
+* chain) and propagate state to every other object in the runtime. Any code
+* that copies arbitrary user-supplied keys into a fresh object — frontmatter
+* parsing, MCP config conversion, settings round-trip — should skip these.
+*/
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPrototypePollutionKey(key) {
+	return PROTOTYPE_POLLUTION_KEYS.has(key);
+}
+/**
+* Returns a shallow copy of a record's own entries with every
+* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
+*
+* Use when copying a nested, user-supplied string map — an MCP server's `env`
+* or `headers` table — into freshly generated config. Carrying such a map by
+* reference, or re-assigning its keys via bracket notation, would let a literal
+* `__proto__` key ride along (and re-assigning it would mutate the target's
+* prototype). Walking the entries through this helper severs that path while
+* preserving every legitimate key.
+*/
+function omitPrototypePollutionKeys(record) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+//#endregion
+//#region src/features/shared/shared-config-gateway.ts
+function sanitizeSharedConfigValue(value) {
+	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
+	if (!isPlainObject(value)) return value;
+	const result = {};
+	for (const [key, nested] of Object.entries(omitPrototypePollutionKeys(value))) result[key] = sanitizeSharedConfigValue(nested);
+	return result;
+}
+/**
+* Parse a shared config file into a plain document: an empty/whitespace file
+* is `{}`, prototype-pollution keys are dropped recursively, and a non-mapping
+* root follows `invalidRootPolicy`. Syntax errors are wrapped with the file
+* path when one is given.
+*/
+function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy = "coerce-empty" }) {
+	if (fileContent.trim() === "") return {};
+	const at = filePath === void 0 ? "" : ` at ${filePath}`;
+	let parsed;
+	try {
+		if (format === "yaml") parsed = (0, js_yaml.load)(fileContent);
+		else if (format === "json") parsed = JSON.parse(fileContent);
+		else parsed = (0, jsonc_parser.parse)(fileContent);
+	} catch (error) {
+		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
+	}
+	if (parsed === void 0 || parsed === null) return {};
+	if (!isPlainObject(parsed)) {
+		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
+		return {};
+	}
+	return sanitizeSharedConfigValue(parsed);
+}
+/**
+* Serialize a shared config document. YAML output always ends with exactly one
+* newline; JSON output matches the 2-space `JSON.stringify` shape the JSON
+* writers have always emitted (no trailing newline).
+*/
+function stringifySharedConfig({ format, document }) {
+	if (format === "yaml") return (0, js_yaml.dump)(document, {
+		noRefs: true,
+		sortKeys: false
+	}).trimEnd() + "\n";
+	return JSON.stringify(document, null, 2);
+}
+/**
+* Shallow merge: every top-level key in `patch` replaces the base key
+* wholesale; all other base keys are preserved. The policy for a feature that
+* owns a fixed set of top-level keys.
+*/
+function mergeSharedConfigShallow({ base, patch }) {
+	return {
+		...base,
+		...sanitizeSharedConfigValue(patch)
+	};
+}
+/**
+* Deep merge (`patch` wins): nested plain objects are merged key-by-key; every
+* other value (arrays, scalars) is replaced wholesale. The policy for a
+* feature whose contribution interleaves with user-authored siblings at any
+* depth (e.g. permissions overlays onto `approvals`/`security` structures, or
+* per-provider option tables) — nested sibling keys are preserved by
+* construction instead of by per-tool re-implementation. Prototype-pollution
+* keys are dropped.
+*/
+function mergeSharedConfigDeep({ base, patch }) {
+	const result = { ...base };
+	for (const [key, patchValue] of Object.entries(patch)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const baseValue = result[key];
+		if (isPlainObject(baseValue) && isPlainObject(patchValue)) result[key] = mergeSharedConfigDeep({
+			base: baseValue,
+			patch: patchValue
+		});
+		else result[key] = sanitizeSharedConfigValue(patchValue);
+	}
+	return result;
+}
+const CLAUDE_SETTINGS_SHARED_FILE_KEY = ".claude/settings.json";
+const HERMES_CONFIG_SHARED_FILE_KEY = ".hermes/config.yaml";
+const TAKT_CONFIG_SHARED_FILE_KEY = ".takt/config.yaml";
+/**
+* Who owns what in each gateway-managed shared config file, and which policy
+* resolves conflicts. Keys are `dir/file` tokens matching
+* `deriveSharedFileWriters()`; a test keeps each entry's feature set in
+* lock-step with the writers derived from the processor registry, so an
+* undeclared writer fails CI instead of merging by accident.
+*/
+const SHARED_CONFIG_OWNERSHIP = {
+	[CLAUDE_SETTINGS_SHARED_FILE_KEY]: {
+		format: "json",
+		features: {
+			ignore: {
+				kind: "custom",
+				policyFunction: "applyIgnoreReadDenies"
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "custom",
+				policyFunction: "applyPermissions"
+			}
+		}
+	},
+	[HERMES_CONFIG_SHARED_FILE_KEY]: {
+		format: "yaml",
+		features: {
+			subagents: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["plugins"]
+			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp_servers"]
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "deep-merge",
+				replaceKeys: ["permissions"]
+			}
+		}
+	},
+	[TAKT_CONFIG_SHARED_FILE_KEY]: {
+		format: "yaml",
+		invalidRootPolicy: "error",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: [TAKT_WORKFLOW_MCP_SERVERS_KEY]
+			},
+			permissions: { kind: "deep-merge" }
+		}
+	}
+};
+/**
+* Execute a feature's declared write to a gateway-managed shared file: parse
+* the existing content, merge the patch under the feature's declared policy,
+* and serialize. Throws when the file or feature is undeclared, when a
+* `replace-owned-keys` patch strays outside its owned keys, or when the
+* feature's policy is `custom` (those calls go to the named policy function
+* instead).
+*/
+function applySharedConfigPatch({ fileKey, feature, existingContent, patch, filePath }) {
+	const declaration = SHARED_CONFIG_OWNERSHIP[fileKey];
+	if (!declaration) throw new Error(`Shared config file '${fileKey}' has no SHARED_CONFIG_OWNERSHIP declaration; declare its writers and policies before writing it through the gateway.`);
+	const policy = declaration.features[feature];
+	if (!policy) throw new Error(`Feature '${feature}' declares no ownership of '${fileKey}'; add it to SHARED_CONFIG_OWNERSHIP before writing.`);
+	if (policy.kind === "custom") throw new Error(`Feature '${feature}' writes '${fileKey}' through its dedicated policy function '${policy.policyFunction}' in shared-config-gateway.ts, not applySharedConfigPatch.`);
+	const base = parseSharedConfig({
+		format: declaration.format,
+		fileContent: existingContent,
+		filePath,
+		...declaration.invalidRootPolicy !== void 0 && { invalidRootPolicy: declaration.invalidRootPolicy }
+	});
+	if (policy.kind === "replace-owned-keys") {
+		const unowned = Object.keys(patch).filter((key) => !policy.ownedKeys.includes(key));
+		if (unowned.length > 0) throw new Error(`Feature '${feature}' tried to write undeclared keys [${unowned.join(", ")}] to '${fileKey}'; extend its ownedKeys declaration if that ownership is intended.`);
+		return stringifySharedConfig({
+			format: declaration.format,
+			document: mergeSharedConfigShallow({
+				base,
+				patch
+			})
+		});
+	}
+	const merged = mergeSharedConfigDeep({
+		base,
+		patch
+	});
+	for (const key of policy.replaceKeys ?? []) if (patch[key] !== void 0) merged[key] = sanitizeSharedConfigValue(patch[key]);
+	return stringifySharedConfig({
+		format: declaration.format,
+		document: merged
+	});
+}
+const READ_TOOL_NAME = "Read";
+const isReadDenyEntry = (entry) => entry.startsWith(`${READ_TOOL_NAME}(`) && entry.endsWith(")");
+const buildReadDenyEntry = (pattern) => `${READ_TOOL_NAME}(${pattern})`;
+const parsePermissionsBlock = (settings) => {
+	const permissions = settings.permissions ?? {};
+	return {
+		allow: permissions.allow ?? [],
+		ask: permissions.ask ?? [],
+		deny: permissions.deny ?? []
+	};
+};
+const withPermissions = (settings, next) => {
+	const permissions = { ...settings.permissions };
+	const assign = (key, values) => {
+		if (values.length > 0) permissions[key] = values;
+		else delete permissions[key];
+	};
+	assign("allow", next.allow);
+	assign("ask", next.ask);
+	assign("deny", next.deny);
+	return {
+		...settings,
+		permissions
+	};
+};
+const applyIgnoreReadDenies = (params) => {
+	const { settings, readDenies } = params;
+	const current = parsePermissionsBlock(settings);
+	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry) || readDenies.includes(entry));
+	return withPermissions(settings, {
+		allow: current.allow,
+		ask: current.ask,
+		deny: (0, es_toolkit.uniq)([...preservedDeny, ...readDenies].toSorted())
+	});
+};
+const applyPermissions = (params) => {
+	const { settings, managedToolNames, toolNameOf, allow, ask, deny, logger } = params;
+	const current = parsePermissionsBlock(settings);
+	const keepUnmanaged = (entries) => entries.filter((entry) => !managedToolNames.has(toolNameOf(entry)));
+	if (logger && managedToolNames.has(READ_TOOL_NAME)) {
+		const overwrittenReadDenies = current.deny.filter((entry) => toolNameOf(entry) === READ_TOOL_NAME);
+		if (overwrittenReadDenies.length > 0) logger.warn(`Permissions feature manages '${READ_TOOL_NAME}' tool and will overwrite ${overwrittenReadDenies.length} existing ${READ_TOOL_NAME} deny entries. Permissions take precedence.`);
+	}
+	return withPermissions(settings, {
+		allow: (0, es_toolkit.uniq)([...keepUnmanaged(current.allow), ...allow].toSorted()),
+		ask: (0, es_toolkit.uniq)([...keepUnmanaged(current.ask), ...ask].toSorted()),
+		deny: (0, es_toolkit.uniq)([...keepUnmanaged(current.deny), ...deny].toSorted())
+	});
+};
+//#endregion
 //#region src/features/opencode-config.ts
 /**
 * Reads and parses the OpenCode config (`opencode.jsonc` preferred, then
@@ -3943,9 +4234,10 @@ async function readOpencodeConfig({ outputRoot, global = false }) {
 	});
 	const fileContent = await readFileContentOrNull((0, node_path.join)(configDir, "opencode.jsonc")) ?? await readFileContentOrNull((0, node_path.join)(configDir, "opencode.json"));
 	if (!fileContent) return {};
-	const parsed = (0, jsonc_parser.parse)(fileContent);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-	return parsed;
+	return parseSharedConfig({
+		format: "jsonc",
+		fileContent
+	});
 }
 /**
 * Narrows an unknown value to a plain record of entries keyed by name, as used
@@ -4854,32 +5146,6 @@ var RovodevPromptsManifest = class extends ToolFile {
 	}
 };
 //#endregion
-//#region src/constants/takt-paths.ts
-const TAKT_DIR = ".takt";
-const TAKT_FACETS_SUBDIR = "facets";
-const TAKT_FACETS_DIR_PATH = (0, node_path.join)(TAKT_DIR, TAKT_FACETS_SUBDIR);
-const TAKT_RULES_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "policies");
-const TAKT_COMMANDS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "instructions");
-const TAKT_SKILLS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "knowledge");
-const TAKT_SUBAGENTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "personas");
-const TAKT_OUTPUT_CONTRACTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "output-contracts");
-const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
-/**
-* Takt's shared config file. Lives at `.takt/config.yaml` (project) and
-* `~/.takt/config.yaml` (global); it holds the active provider, provider
-* profiles (including permission modes), and other Takt settings.
-* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
-*/
-const TAKT_CONFIG_FILE_NAME = "config.yaml";
-/**
-* Top-level key in Takt's `config.yaml` holding the workflow MCP transport
-* allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
-* transport must be explicitly enabled here before any workflow-defined MCP
-* server using it is permitted to run.
-* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
-*/
-const TAKT_WORKFLOW_MCP_SERVERS_KEY = "workflow_mcp_servers";
-//#endregion
 //#region src/features/takt-shared.ts
 /**
 * Shared utilities for all TAKT-* tool file classes.
@@ -5715,6 +5981,8 @@ const DEEPAGENTS_HOOK_EVENTS = [
 	"sessionEnd",
 	"beforeSubmitPrompt",
 	"permissionRequest",
+	"preToolUse",
+	"postToolUse",
 	"postToolUseFailure",
 	"stop",
 	"preCompact",
@@ -5740,7 +6008,13 @@ const CODEXCLI_HOOK_EVENTS = [
 * Goose adopts the Open Plugins hooks spec: each plugin's `hooks/hooks.json`
 * maps PascalCase event names to matcher/handler arrays. Every Goose event has a
 * 1:1 canonical equivalent, so no new canonical events are required.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+*
+* Goose's `HookEvent` enum defines exactly these 11 events (v1.41.0). Notably it
+* has NO `SubagentStart`/`SubagentStop` arms — emitting them would write keys
+* Goose silently ignores, so `subagentStart`/`subagentStop` are intentionally
+* excluded here and from `CANONICAL_TO_GOOSE_EVENT_NAMES`.
+* @see https://github.com/block/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 const GOOSE_HOOK_EVENTS = [
 	"sessionStart",
@@ -5753,9 +6027,7 @@ const GOOSE_HOOK_EVENTS = [
 	"beforeReadFile",
 	"afterFileEdit",
 	"beforeShellExecution",
-	"afterShellExecution",
-	"subagentStart",
-	"subagentStop"
+	"afterShellExecution"
 ];
 /** Hook events supported by Kiro CLI. */
 const KIRO_HOOK_EVENTS = [
@@ -6208,9 +6480,7 @@ const CANONICAL_TO_GOOSE_EVENT_NAMES = {
 	beforeReadFile: "BeforeReadFile",
 	afterFileEdit: "AfterFileEdit",
 	beforeShellExecution: "BeforeShellExecution",
-	afterShellExecution: "AfterShellExecution",
-	subagentStart: "SubagentStart",
-	subagentStop: "SubagentStop"
+	afterShellExecution: "AfterShellExecution"
 };
 /**
 * Map Goose PascalCase event names to canonical camelCase.
@@ -6224,6 +6494,8 @@ const CANONICAL_TO_DEEPAGENTS_EVENT_NAMES = {
 	sessionEnd: "session.end",
 	beforeSubmitPrompt: "user.prompt",
 	permissionRequest: "permission.request",
+	preToolUse: "tool.use",
+	postToolUse: "tool.result",
 	postToolUseFailure: "tool.error",
 	stop: "task.complete",
 	preCompact: "context.compact",
@@ -6351,42 +6623,6 @@ const CANONICAL_TO_REASONIX_EVENT_NAMES = {
 */
 const REASONIX_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_REASONIX_EVENT_NAMES).map(([k, v]) => [v, k]));
 //#endregion
-//#region src/utils/prototype-pollution.ts
-/**
-* Keys that, if walked into when constructing or merging objects from
-* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
-* chain) and propagate state to every other object in the runtime. Any code
-* that copies arbitrary user-supplied keys into a fresh object — frontmatter
-* parsing, MCP config conversion, settings round-trip — should skip these.
-*/
-const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isPrototypePollutionKey(key) {
-	return PROTOTYPE_POLLUTION_KEYS.has(key);
-}
-/**
-* Returns a shallow copy of a record's own entries with every
-* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
-*
-* Use when copying a nested, user-supplied string map — an MCP server's `env`
-* or `headers` table — into freshly generated config. Carrying such a map by
-* reference, or re-assigning its keys via bracket notation, would let a literal
-* `__proto__` key ride along (and re-assigning it would mutate the target's
-* prototype). Walking the entries through this helper severs that path while
-* preserving every legitimate key.
-*/
-function omitPrototypePollutionKeys(record) {
-	const sanitized = {};
-	for (const [key, value] of Object.entries(record)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = value;
-	}
-	return sanitized;
-}
-//#endregion
 //#region src/features/hooks/tool-hooks-converter.ts
 function isToolMatcherEntry(x) {
 	if (x === null || typeof x !== "object") return false;
@@ -7045,24 +7281,19 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		const paths = ClaudecodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
-		let settings;
-		try {
-			settings = JSON.parse(existingContent);
-		} catch (error) {
-			throw new Error(`Failed to parse existing Claude settings at ${filePath}: ${formatError(error)}`, { cause: error });
-		}
 		const config = rulesyncHooks.getJson();
-		const claudeHooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.claudecode?.hooks,
-			converterConfig: CLAUDE_CONVERTER_CONFIG,
-			logger
+		const fileContent = applySharedConfigPatch({
+			fileKey: CLAUDE_SETTINGS_SHARED_FILE_KEY,
+			feature: "hooks",
+			existingContent,
+			patch: { hooks: canonicalToToolHooks({
+				config,
+				toolOverrideHooks: config.claudecode?.hooks,
+				converterConfig: CLAUDE_CONVERTER_CONFIG,
+				logger
+			}) },
+			filePath
 		});
-		const merged = {
-			...settings,
-			hooks: claudeHooks
-		};
-		const fileContent = JSON.stringify(merged, null, 2);
 		return new ClaudecodeHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -8218,7 +8449,7 @@ const GOOSE_CONVERTER_CONFIG = {
 *
 * The JSON shape matches Claude Code's: each PascalCase event maps to an array of
 * `{ matcher, hooks: [{ type: "command", command }] }` entries.
-* @see https://goose-docs.ai/blog/2026/05/14/goose-hooks/
+* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
 */
 var GooseHooks = class GooseHooks extends ToolHooks {
 	constructor(params) {
@@ -8269,7 +8500,7 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 			throw new Error(`Failed to parse Goose hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: parsed.hooks,
+			hooks: parsed.hooks && typeof parsed.hooks === "object" && !Array.isArray(parsed.hooks) ? Object.fromEntries(Object.entries(parsed.hooks).filter(([eventName]) => Object.hasOwn(GOOSE_TO_CANONICAL_EVENT_NAMES, eventName))) : parsed.hooks,
 			converterConfig: GOOSE_CONVERTER_CONFIG
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify({
@@ -8294,37 +8525,6 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hermes-config.ts
-function sanitizeHermesConfigValue(value) {
-	if (Array.isArray(value)) return value.map(sanitizeHermesConfigValue);
-	if (!isPlainObject(value)) return value;
-	const sanitized = omitPrototypePollutionKeys(value);
-	const result = {};
-	for (const [key, nestedValue] of Object.entries(sanitized)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		result[key] = sanitizeHermesConfigValue(nestedValue);
-	}
-	return result;
-}
-function parseHermesConfig(fileContent) {
-	if (!fileContent.trim()) return {};
-	const parsed = (0, js_yaml.load)(fileContent);
-	if (isPlainObject(parsed)) return sanitizeHermesConfigValue(parsed);
-	return {};
-}
-function stringifyHermesConfig(config) {
-	return (0, js_yaml.dump)(config, {
-		noRefs: true,
-		sortKeys: false
-	}).trimEnd() + "\n";
-}
-function mergeHermesConfig(fileContent, patch) {
-	return stringifyHermesConfig({
-		...parseHermesConfig(fileContent),
-		...patch
-	});
-}
-//#endregion
 //#region src/features/hooks/hermesagent-hooks.ts
 /**
 * Canonical events that map to a Hermes tool-call event (`pre_tool_call` /
@@ -8452,10 +8652,21 @@ var HermesagentHooks = class HermesagentHooks extends ToolHooks {
 		return true;
 	}
 	setFileContent(fileContent) {
-		this.fileContent = mergeHermesConfig(fileContent, parseHermesConfig(this.fileContent));
+		this.fileContent = applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "hooks",
+			existingContent: fileContent,
+			patch: parseSharedConfig({
+				format: "yaml",
+				fileContent: this.fileContent
+			})
+		});
 	}
 	toRulesyncHooks() {
-		const hooks = hermesHooksToCanonical(parseHermesConfig(this.getFileContent()).hooks);
+		const hooks = hermesHooksToCanonical(parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent()
+		}).hooks);
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify({
 			version: 1,
 			hooks
@@ -8465,11 +8676,14 @@ var HermesagentHooks = class HermesagentHooks extends ToolHooks {
 		const config = rulesyncHooks.getJson();
 		return new HermesagentHooks({
 			outputRoot,
-			fileContent: stringifyHermesConfig({ hooks: canonicalToHermesHooks({
-				config,
-				toolOverrideHooks: config.hermesagent?.hooks,
-				logger
-			}) })
+			fileContent: stringifySharedConfig({
+				format: "yaml",
+				document: { hooks: canonicalToHermesHooks({
+					config,
+					toolOverrideHooks: config.hermesagent?.hooks,
+					logger
+				}) }
+			})
 		});
 	}
 };
@@ -10489,66 +10703,6 @@ var AugmentcodeIgnore = class AugmentcodeIgnore extends ToolIgnore {
 	}
 };
 //#endregion
-//#region src/features/claudecode-settings-gateway.ts
-/**
-* Single owner of the `.claude/settings.json` `permissions` block, which both
-* `ignore` (writes `Read(...)` into `permissions.deny`) and `permissions`
-* (writes the whole `allow`/`ask`/`deny`) read-modify-write. The entry format,
-* the merge, and the cross-feature ownership rule (permissions' explicit `Read`
-* rules win over ignore-derived `Read` denies) used to be duplicated across both
-* feature files; they live here once so each feature just states its intent and
-* never reasons about the other's existence.
-*/
-const READ_TOOL_NAME = "Read";
-const isReadDenyEntry = (entry) => entry.startsWith(`${READ_TOOL_NAME}(`) && entry.endsWith(")");
-const buildReadDenyEntry = (pattern) => `${READ_TOOL_NAME}(${pattern})`;
-const parsePermissionsBlock = (settings) => {
-	const permissions = settings.permissions ?? {};
-	return {
-		allow: permissions.allow ?? [],
-		ask: permissions.ask ?? [],
-		deny: permissions.deny ?? []
-	};
-};
-const withPermissions = (settings, next) => {
-	const permissions = { ...settings.permissions };
-	const assign = (key, values) => {
-		if (values.length > 0) permissions[key] = values;
-		else delete permissions[key];
-	};
-	assign("allow", next.allow);
-	assign("ask", next.ask);
-	assign("deny", next.deny);
-	return {
-		...settings,
-		permissions
-	};
-};
-const applyIgnoreReadDenies = (params) => {
-	const { settings, readDenies } = params;
-	const current = parsePermissionsBlock(settings);
-	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry) || readDenies.includes(entry));
-	return withPermissions(settings, {
-		allow: current.allow,
-		ask: current.ask,
-		deny: (0, es_toolkit.uniq)([...preservedDeny, ...readDenies].toSorted())
-	});
-};
-const applyPermissions = (params) => {
-	const { settings, managedToolNames, toolNameOf, allow, ask, deny, logger } = params;
-	const current = parsePermissionsBlock(settings);
-	const keepUnmanaged = (entries) => entries.filter((entry) => !managedToolNames.has(toolNameOf(entry)));
-	if (logger && managedToolNames.has(READ_TOOL_NAME)) {
-		const overwrittenReadDenies = current.deny.filter((entry) => toolNameOf(entry) === READ_TOOL_NAME);
-		if (overwrittenReadDenies.length > 0) logger.warn(`Permissions feature manages '${READ_TOOL_NAME}' tool and will overwrite ${overwrittenReadDenies.length} existing ${READ_TOOL_NAME} deny entries. Permissions take precedence.`);
-	}
-	return withPermissions(settings, {
-		allow: (0, es_toolkit.uniq)([...keepUnmanaged(current.allow), ...allow].toSorted()),
-		ask: (0, es_toolkit.uniq)([...keepUnmanaged(current.ask), ...ask].toSorted()),
-		deny: (0, es_toolkit.uniq)([...keepUnmanaged(current.deny), ...deny].toSorted())
-	});
-};
-//#endregion
 //#region src/features/ignore/claudecode-ignore.ts
 const DEFAULT_FILE_MODE = "shared";
 /**
@@ -11971,7 +12125,6 @@ var AntigravityIdeMcp = class extends AntigravityMcp {
 };
 //#endregion
 //#region src/features/mcp/augmentcode-mcp.ts
-const AUGMENTCODE_GLOBAL_ONLY_MESSAGE = "AugmentCode MCP is global-only; use --global to sync ~/.augment/settings.json";
 function parseAugmentcodeSettings(fileContent, relativeDirPath, relativeFilePath) {
 	const configPath = (0, node_path.join)(relativeDirPath, relativeFilePath);
 	let parsed;
@@ -11986,13 +12139,15 @@ function parseAugmentcodeSettings(fileContent, relativeDirPath, relativeFilePath
 /**
 * AugmentCode (Auggie CLI) MCP servers.
 *
-* MCP servers are persisted in the shared user settings file
-* `~/.augment/settings.json` (global only — the docs do not document a
-* project-level MCP location). That same file also holds `hooks` and
+* MCP servers are persisted in the shared settings file `.augment/settings.json`
+* at either scope: the committed workspace file for team-shared servers (project)
+* or `~/.augment/settings.json` (global). That same file also holds `hooks` and
 * `toolPermissions`, so generation merges the `mcpServers` block into the
-* existing settings instead of overwriting it, and the file is never deleted.
+* existing settings instead of overwriting it, and the file is never deleted. On
+* project-scope import the gitignored `.augment/settings.local.json` overrides
+* file is overlaid on top (the same layering the hooks/permissions adapters use).
 *
-* @see https://docs.augmentcode.com/cli/integrations
+* @see https://docs.augmentcode.com/cli/config
 */
 var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 	json;
@@ -12014,9 +12169,14 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 		};
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		if (!global) throw new Error(AUGMENTCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const json = parseAugmentcodeSettings(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}", paths.relativeDirPath, paths.relativeFilePath);
+		const json = parseAugmentcodeSettings(await readAugmentcodeSettingsWithLocalOverlay({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			baseFileName: paths.relativeFilePath,
+			baseFallbackContent: "{}",
+			includeLocalOverlay: !global
+		}), paths.relativeDirPath, paths.relativeFilePath);
 		const newJson = {
 			...json,
 			mcpServers: json.mcpServers ?? {}
@@ -12031,7 +12191,6 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
-		if (!global) throw new Error(AUGMENTCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const merged = {
 			...parseAugmentcodeSettings(await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), JSON.stringify({}, null, 2)), paths.relativeDirPath, paths.relativeFilePath),
@@ -12306,6 +12465,38 @@ const RULESYNC_TO_CODEX_FIELD_MAP = {
 	envVars: "env_vars"
 };
 const MAX_REMOVE_EMPTY_ENTRIES_DEPTH$1 = 32;
+/**
+* Translate a server's `oauth` table from the canonical rulesync shape (Claude
+* Code style camelCase) into the shape Codex CLI understands. Codex expects the
+* OAuth client id under snake_case `client_id`; without it `codex mcp login`
+* falls back to dynamic client registration and fails for providers that do not
+* support it (e.g. Slack, see #2158). The canonical `clientId` is kept alongside
+* the added `client_id` so tools that read the camelCase shape keep working and
+* the round-trip stays stable.
+*/
+function mapOauthToCodex(oauth) {
+	const result = omitPrototypePollutionKeys(oauth);
+	if (typeof oauth["clientId"] === "string" && !("client_id" in result)) result["client_id"] = oauth["clientId"];
+	return result;
+}
+/**
+* Reverse of {@link mapOauthToCodex}: collapse Codex's `oauth.client_id` back to
+* the canonical `clientId` on import. When both keys are present (the shape
+* rulesync itself emits) the canonical `clientId` wins and `client_id` is
+* dropped so a subsequent generate does not accumulate duplicates.
+*/
+function mapOauthFromCodex(oauth) {
+	const result = {};
+	for (const [key, value] of Object.entries(oauth)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (key === "client_id") {
+			if (!("clientId" in oauth)) result["clientId"] = value;
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
 function convertFromCodexFormat(codexMcp) {
 	const result = {};
 	for (const [name, config] of Object.entries(codexMcp)) {
@@ -12315,7 +12506,8 @@ function convertFromCodexFormat(codexMcp) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "enabled") {
 				if (value === false) converted["disabled"] = true;
-			} else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthFromCodex(value);
+			else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
 				const mappedKey = CODEX_TO_RULESYNC_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `Ignored malformed array for ${key} in MCP server ${name}`);
@@ -12335,7 +12527,8 @@ function convertToCodexFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "disabled") {
 				if (value === true) converted["enabled"] = false;
-			} else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
+			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthToCodex(value);
+			else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
 				const mappedKey = RULESYNC_TO_CODEX_FIELD_MAP[key];
 				if (mappedKey) if (isStringArray(value)) converted[mappedKey] = value;
 				else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string array, got ${typeof value}`);
@@ -13551,10 +13744,12 @@ function resolveHermesTimeout(config) {
 *
 * Hermes is close to the MCP spec but not identical: `command` must be a single
 * executable string (an array's tail folds into `args`), a server is disabled
-* via `enabled: false` (not the canonical `disabled: true`), and remote servers
-* use `url`/`headers`. Only fields Hermes understands are emitted, so the shared
-* `config.yaml` is not polluted with canonical-only aliases (`type`, `transport`,
-* `httpUrl`, `networkTimeout`, tool-filter keys, ...).
+* via `enabled: false` (not the canonical `disabled: true`), remote servers use
+* `url`/`headers`, and per-server tool scoping lives under a `tools: { include,
+* exclude }` block (from the canonical `enabledTools`/`disabledTools`). Only
+* fields Hermes understands are emitted, so the shared `config.yaml` is not
+* polluted with canonical-only aliases (`type`, `transport`, `httpUrl`,
+* `networkTimeout`, ...).
 */
 function convertServerToHermes(config) {
 	const out = {};
@@ -13578,6 +13773,10 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
+	const tools = {};
+	if (isStringArray(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
 }
 /**
@@ -13619,6 +13818,10 @@ function convertFromHermesFormat(mcpServers) {
 		if (isPlainObject(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
 		if (config.enabled === false) server.disabled = true;
 		if (typeof config.timeout === "number") server.networkTimeout = config.timeout;
+		if (isRecord(config.tools)) {
+			if (isStringArray(config.tools.include)) server.enabledTools = config.tools.include;
+			if (isStringArray(config.tools.exclude)) server.disabledTools = config.tools.exclude;
+		}
 		result[name] = server;
 	}
 	return result;
@@ -13637,7 +13840,10 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	config;
 	constructor(params) {
 		super(params);
-		this.config = this.fileContent !== void 0 ? parseHermesConfig(this.fileContent) : {};
+		this.config = this.fileContent !== void 0 ? parseSharedConfig({
+			format: "yaml",
+			fileContent: this.fileContent
+		}) : {};
 	}
 	getConfig() {
 		return this.config;
@@ -13646,9 +13852,17 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 		return true;
 	}
 	setFileContent(fileContent) {
-		const merged = mergeHermesMcpServers(parseHermesConfig(fileContent), isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const merged = mergeHermesMcpServers(parseSharedConfig({
+			format: "yaml",
+			fileContent
+		}), isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
 		this.config = merged;
-		super.setFileContent(stringifyHermesConfig(merged));
+		super.setFileContent(applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "mcp",
+			existingContent: fileContent,
+			patch: { mcp_servers: merged.mcp_servers }
+		}));
 	}
 	isDeletable() {
 		return false;
@@ -13675,12 +13889,21 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const merged = mergeHermesMcpServers(parseHermesConfig(await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), "")), convertToHermesFormat(rulesyncMcp.getMcpServers()));
+		const fileContent = await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), "");
+		const merged = mergeHermesMcpServers(parseSharedConfig({
+			format: "yaml",
+			fileContent
+		}), convertToHermesFormat(rulesyncMcp.getMcpServers()));
 		return new HermesagentMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: stringifyHermesConfig(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+				feature: "mcp",
+				existingContent: fileContent,
+				patch: { mcp_servers: merged.mcp_servers }
+			}),
 			validate,
 			global
 		});
@@ -14845,28 +15068,6 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 	}
 };
 //#endregion
-//#region src/features/shared/takt-config.ts
-/**
-* Parse a Takt `config.yaml` into a plain object, treating an empty file as `{}`.
-*
-* Shared by the Takt adapters that read-modify-write the same `config.yaml`
-* (mcp, permissions, ...). Uses `isPlainObject` (not `isRecord`) so class
-* instances are rejected for prototype-pollution hardening; a YAML mapping
-* always parses to a plain object.
-*/
-function parseTaktConfig(fileContent, relativeDirPath, relativeFilePath) {
-	const configPath = (0, node_path.join)(relativeDirPath, relativeFilePath);
-	let parsed;
-	try {
-		parsed = fileContent.trim() === "" ? {} : (0, js_yaml.load)(fileContent);
-	} catch (error) {
-		throw new Error(`Failed to parse Takt config at ${configPath}: ${formatError(error)}`, { cause: error });
-	}
-	if (parsed === void 0 || parsed === null) return {};
-	if (!isPlainObject(parsed)) throw new Error(`Failed to parse Takt config at ${configPath}: expected a YAML mapping`);
-	return parsed;
-}
-//#endregion
 //#region src/features/mcp/takt-mcp.ts
 /**
 * MCP adapter for Takt (`.takt/config.yaml` project / `~/.takt/config.yaml`
@@ -14932,17 +15133,20 @@ var TaktMcp = class TaktMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = TaktMcp.getSettablePaths({ global });
-		const config = parseTaktConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath);
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const allowlist = deriveTransportAllowlist(rulesyncMcp.getMcpServers());
-		const merged = {
-			...config,
-			[TAKT_WORKFLOW_MCP_SERVERS_KEY]: allowlist
-		};
 		return new TaktMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: (0, js_yaml.dump)(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: TAKT_CONFIG_SHARED_FILE_KEY,
+				feature: "mcp",
+				existingContent,
+				patch: { [TAKT_WORKFLOW_MCP_SERVERS_KEY]: allowlist },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -15387,7 +15591,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 	["augmentcode", {
 		class: AugmentcodeMcp,
 		meta: {
-			supportsProject: false,
+			supportsProject: true,
 			supportsGlobal: true,
 			supportsEnabledTools: false,
 			supportsDisabledTools: false
@@ -15774,17 +15978,317 @@ const PermissionActionSchema = zod_mini.z.enum([
 */
 const PermissionRulesSchema = zod_mini.z.record(zod_mini.z.string(), PermissionActionSchema);
 /**
+* OpenCode-specific permission value. Unlike the shared canonical block, which
+* only accepts a pattern-to-action map, OpenCode also allows a bare action
+* string that applies to the whole category (e.g. `"external_directory": "deny"`).
+* This mirrors OpenCode's own permission schema in `opencode-permissions.ts`.
+*/
+const OpencodeOverridePermissionValueSchema = zod_mini.z.union([PermissionActionSchema, PermissionRulesSchema]);
+/**
+* Tool-scoped override block for OpenCode. Permission categories placed here
+* (e.g. OpenCode-only categories such as `external_directory`) are emitted only
+* into OpenCode's config and never leak into other tools' permission files. It
+* also lets a shared category be overridden with an OpenCode-specific value.
+* Kept `looseObject` so future OpenCode categories are accepted.
+*
+* @example
+* { "permission": { "external_directory": "deny", "webfetch": "allow" } }
+*/
+const OpencodePermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Hermes Agent. Keys placed here are deep-merged
+* into Hermes's `~/.hermes/config.yaml` and never leak into other tools' configs.
+* It carries Hermes-specific approval/security controls that have no canonical
+* permission category — e.g. `approvals` (`mode`, `cron_mode`, ...),
+* `security` (`allow_private_urls`, ...), `skills.write_approval`,
+* `memory.write_approval`. Kept `looseObject` (a verbatim passthrough) so any
+* current or future Hermes config key can be authored without modeling each one.
+*
+* @example
+* { "approvals": { "mode": "smart" }, "security": { "allow_private_urls": false } }
+*/
+const HermesPermissionsOverrideSchema = zod_mini.z.looseObject({});
+/**
+* Tool-scoped override block for Cline. Cline's `command-permissions.json`
+* carries a single global `allowRedirects` boolean (gates shell redirection
+* operators `>`/`>>`/`<`) that has no per-command dimension and therefore no
+* canonical permission category. Placing it here lets users author it
+* declaratively; it is emitted only into Cline's config. Kept `looseObject` so
+* future Cline-only knobs can be added.
+*
+* @example
+* { "allowRedirects": true }
+*/
+const ClinePermissionsOverrideSchema = zod_mini.z.looseObject({ allowRedirects: zod_mini.z.optional(zod_mini.z.boolean()) });
+/**
+* Tool-scoped override block for Kilo Code (an OpenCode fork). Kilo's permission
+* object is a free-form record with tool-specific keys that have no canonical
+* category — OpenCode-inherited ones (`external_directory`, `doom_loop`, `lsp`,
+* `question`, `todowrite`, `skill`, `task`, `list`) and Kilo-unique ones
+* (`agent_manager`, `notebook_read`, `notebook_edit`, `notebook_execute`,
+* `repo_clone`, `repo_overview`). Placing them here makes them authorable and
+* portable and keeps them out of other tools' configs. Mirrors the OpenCode
+* override; each value may be a bare action string or a pattern map.
+*
+* @example
+* { "permission": { "external_directory": "deny", "doom_loop": "ask" } }
+*/
+const KiloPermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), OpencodeOverridePermissionValueSchema)) });
+/**
+* Tool-scoped override block for Claude Code. Claude Code's `permissions` object
+* (in `.claude/settings.json`) carries non-list fields that have no canonical
+* permission category — `defaultMode` (the session-start permission mode) and
+* `additionalDirectories` (extra working directories) being the primary ones.
+* Fields placed under `claudecode.permissions` are merged into the settings
+* `permissions` object and emitted only for Claude Code, while the shared
+* `permission` block continues to drive the `allow`/`ask`/`deny` arrays. Kept a
+* `looseObject` passthrough so any current or future `permissions` field can be
+* authored without modeling each one; the managed `allow`/`ask`/`deny` arrays are
+* ignored here (rulesync owns them).
+*
+* @example
+* { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
+*/
+const ClaudecodePermissionsOverrideSchema = zod_mini.z.looseObject({ permissions: zod_mini.z.optional(zod_mini.z.looseObject({})) });
+/**
+* Tool-scoped override block for Mistral Vibe. Vibe's per-tool `BaseToolConfig`
+* carries a `sensitive_patterns` list — patterns that escalate to ASK even when
+* the tool's base permission is ALWAYS (allow). The canonical model can only set
+* a pattern to a single `allow`/`ask`/`deny`, so an "allow by default but ask on
+* these patterns" escalation cannot be expressed. Entries under
+* `vibe.permission.<category>.sensitive_patterns` carry that list per canonical
+* category; the shared `permission` block still drives the base permission and
+* allow/deny lists. Keyed by canonical category (e.g. `bash`, `edit`).
+*
+* @example
+* { "permission": { "bash": { "sensitive_patterns": ["rm *", "sudo *"] } } }
+*/
+const VibePermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.looseObject({ sensitive_patterns: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) }))) });
+/**
+* Tool-scoped override block for Cursor CLI. Cursor's `cli.json` carries scalar
+* autonomy settings with no canonical permission category — `approvalMode`
+* (`allowlist` | `auto-review` | `unrestricted`) and a `sandbox` object
+* (`mode`/`networkAccess`). Fields placed here are merged into the top-level of
+* `.cursor/cli.json` (project) / `~/.cursor/cli-config.json` (global) and emitted
+* only for Cursor, while the shared `permission` block continues to drive the
+* `permissions.allow`/`permissions.deny` arrays. Kept a `looseObject` so extra
+* `cli.json` keys can be authored (they are merged verbatim on generate);
+* `sandbox`'s accepted values are not documented so it passes through verbatim.
+* Note: only `approvalMode` and `sandbox` round-trip back on import — other keys
+* authored here reach `cli.json` on generate but are not re-extracted.
+*
+* @example
+* { "approvalMode": "auto-review" }
+*/
+const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
+	approvalMode: zod_mini.z.optional(zod_mini.z.string()),
+	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Qwen Code. Qwen's `settings.json` exposes
+* autonomy/sandbox controls with no canonical permission category — under
+* `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
+* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`). Fields
+* placed here are merged into the matching `settings.json` group and emitted
+* only for Qwen, while the shared `permission` block continues to drive the
+* `permissions.allow`/`ask`/`deny` arrays. Kept `looseObject` (verbatim
+* passthrough) so any current or future `tools`/`security` key can be authored.
+*
+* @example
+* { "tools": { "approvalMode": "auto-edit" }, "security": { "folderTrust": { "enabled": true } } }
+*/
+const QwencodePermissionsOverrideSchema = zod_mini.z.looseObject({
+	tools: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	security: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Reasonix. Reasonix has security axes orthogonal
+* to per-tool allow/ask/deny with no canonical category — the `[sandbox]`
+* enforcement table (`workspace_root`, `allow_write`, `forbid_read`, `bash`,
+* `network`) and plan-mode read-only trust lists under `[agent]`
+* (`plan_mode_allowed_tools`, `plan_mode_read_only_commands`). Fields placed here
+* are merged into the matching `reasonix.toml` table and emitted only for
+* Reasonix, while the shared `permission` block continues to drive
+* `[permissions].allow`/`ask`/`deny`. Kept `looseObject` (verbatim passthrough).
+* Note: the whole `[sandbox]` table round-trips, but only the plan-mode keys are
+* re-extracted from `[agent]` on import — other `agent` keys authored here reach
+* `reasonix.toml` on generate but are not re-extracted back into the override.
+*
+* @example
+* { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
+*/
+const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
+	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	agent: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
+* exposes security controls with no canonical per-command allow/ask/deny slot —
+* `commandBlocklist` (a hard-block tier that can never be approved, distinct from
+* an approvable `deny`), `networkPolicy` (`allowedIps`), `sandbox`
+* (`enabled`/`mode`/`filesystem`/`network`), `mcpPolicy`, `enableDroidShield`,
+* and autonomy settings (`sessionDefaultSettings`, `maxAutonomyLevel`,
+* `interactionMode`). Fields placed here are merged into `settings.json` and
+* emitted only for Factory Droid, while the shared `permission` block continues
+* to drive `commandAllowlist`/`commandDenylist`. Kept `looseObject` passthrough.
+*
+* @example
+* { "commandBlocklist": ["rm -rf /*"], "sandbox": { "enabled": true } }
+*/
+const FactorydroidPermissionsOverrideSchema = zod_mini.z.looseObject({ commandBlocklist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) });
+/**
+* Tool-scoped override block for Warp. Warp's `[agents.profiles]` table exposes
+* file-read/read-only autonomy keys with no canonical per-command allow/ask/deny
+* slot — `agent_mode_coding_permissions`
+* (`always_ask_before_reading` | `always_allow_reading` | `allow_reading_specific_files`),
+* `agent_mode_coding_file_read_allowlist` (a path array), and
+* `agent_mode_execute_readonly_commands` (a read-only auto-execution boolean).
+* Fields placed here are merged into `[agents.profiles]` of Warp's global
+* `settings.toml`, while the shared `permission` block continues to drive the
+* `agent_mode_command_execution_allowlist`/`_denylist` command regex arrays.
+* Warp permissions are global-only.
+*
+* @example
+* { "agent_mode_coding_permissions": "always_allow_reading", "agent_mode_execute_readonly_commands": true }
+*/
+const WarpPermissionsOverrideSchema = zod_mini.z.looseObject({
+	agent_mode_coding_permissions: zod_mini.z.optional(zod_mini.z.string()),
+	agent_mode_coding_file_read_allowlist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	agent_mode_execute_readonly_commands: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* Tool-scoped override block for JetBrains Junie. Junie's `allowlist.json` has
+* two top-level autonomy knobs with no canonical per-glob slot:
+* `allowReadonlyCommands` (a boolean auto-allowing read-only commands) and
+* `defaultBehavior` (the fallback action applied when no rule matches — Junie
+* documents only `allow`/`ask`). Fields placed here are merged onto the
+* top level of `allowlist.json`, while the shared `permission` block continues
+* to drive the per-category `rules` groups.
+*
+* @example
+* { "allowReadonlyCommands": true, "defaultBehavior": "ask" }
+*/
+const JuniePermissionsOverrideSchema = zod_mini.z.looseObject({
+	allowReadonlyCommands: zod_mini.z.optional(zod_mini.z.boolean()),
+	defaultBehavior: zod_mini.z.optional(zod_mini.z.string())
+});
+/**
+* Tool-scoped override block for Takt. Takt's `config.yaml` carries two
+* permission surfaces the canonical coarse-mode mapping can't express:
+* `step_permission_overrides` — a per-workflow-step map (`<step>` →
+* `readonly`/`edit`/`full`) that lives inside the active provider profile
+* alongside `default_permission_mode` and layers on top of it at that step; and
+* `provider_options` — a top-level, per-provider table of sandbox/network knobs
+* orthogonal to the permission mode (e.g. `codex.network_access`,
+* `claude.sandbox.allow_unsandboxed_commands`, `opencode.allowed_tools`). Fields
+* placed here are merged into `config.yaml` and emitted only for Takt, while the
+* shared `permission` block continues to drive `default_permission_mode`. Kept
+* `looseObject` (verbatim passthrough); Takt validates its own value sets (e.g.
+* `provider_options.<p>.base_url` must be loopback). Both project and global
+* scope are supported.
+*
+* Note: Takt's config loader hard-rejects unknown top-level keys, so only keys
+* Takt actually recognizes belong here. `required_permission_mode` is NOT one —
+* it is a per-step field of the workflow YAML (not `config.yaml`), so it is out
+* of scope for this override.
+*
+* @example
+* { "step_permission_overrides": { "ai_review": "readonly" }, "provider_options": { "codex": { "network_access": true } } }
+*/
+const TaktPermissionsOverrideSchema = zod_mini.z.looseObject({
+	step_permission_overrides: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
+	provider_options: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Amp. Amp's `amp.permissions` array and sibling
+* settings carry shapes the canonical per-command allow/ask/deny model can't
+* express, so they are authored here and merged into the shared Amp settings
+* file, while the shared `permission` block continues to drive the canonical
+* `amp.permissions` (allow/ask/reject) + `amp.tools.disable` entries:
+* - `permissions` — extra `amp.permissions` entries with non-`cmd` matchers
+*   (`path`/`url`/`query`/…), regex/array match values, `context`
+*   (`thread`/`subagent`), `delegate` (+`to`), or `reject` (+`message`). These
+*   are appended AFTER the canonical-generated entries (Amp is first-match-wins,
+*   so generated allow/ask/reject rules take precedence; authored entries act as
+*   later fallbacks), preserving author order.
+* - `mcpPermissions` — Amp's `amp.mcpPermissions` array (`{ matches, action }`).
+* - `guardedFiles` — `amp.guardedFiles.allowlist` (globs allowed without
+*   confirmation).
+* - `dangerouslyAllowAll` — `amp.dangerouslyAllowAll` (disable all confirmation).
+* Kept `looseObject` (verbatim passthrough). Both project and global scope are
+* supported.
+*
+* @example
+* { "dangerouslyAllowAll": false, "guardedFiles": { "allowlist": ["docs/**"] },
+*   "permissions": [{ "tool": "Bash", "action": "delegate", "to": "approve.sh" }] }
+*/
+const AmpPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permissions: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.looseObject({
+		tool: zod_mini.z.string(),
+		action: zod_mini.z.string()
+	}))),
+	mcpPermissions: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.looseObject({}))),
+	guardedFiles: zod_mini.z.optional(zod_mini.z.looseObject({ allowlist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) })),
+	dangerouslyAllowAll: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* Tool-scoped override block for the Google Antigravity CLI. Antigravity's CLI
+* `settings.json` carries two global autonomy/sandbox knobs outside the
+* `permissions.allow/ask/deny` arrays rulesync manages: `toolPermission` (the
+* global autonomy preset — `request-review` (default) / `proceed-in-sandbox` /
+* `always-proceed` / `strict`) and `enableTerminalSandbox` (a boolean confining
+* agent-run commands to OS containment). Antigravity applies the allow/deny
+* lists as per-rule exceptions to the preset at runtime, so rulesync only
+* authors these keys verbatim — no precedence modeling is needed on our side.
+* Fields placed here are merged onto the top level of
+* `~/.gemini/antigravity-cli/settings.json` (global-only) and emitted only for
+* the CLI. The Antigravity IDE exposes the same concepts through a GUI (no
+* documented JSON schema), so this override does NOT apply to `antigravity-ide`.
+* Verified against https://antigravity.google/docs/cli/reference and
+* https://antigravity.google/docs/cli/sandbox.
+*
+* @example
+* { "toolPermission": "strict", "enableTerminalSandbox": true }
+*/
+const AntigravityCliPermissionsOverrideSchema = zod_mini.z.looseObject({
+	toolPermission: zod_mini.z.optional(zod_mini.z.string()),
+	enableTerminalSandbox: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
+* The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
+* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie`/`takt`/`amp`/
+* `antigravity-cli` keys are tool-scoped overrides consumed only by their
+* respective translator (see the matching `*PermissionsOverrideSchema`); every
+* other tool reads the shared `permission` block and ignores them.
+*
 * @example
 * {
 *   "bash": { "*": "ask", "git *": "allow", "rm *": "deny" },
 *   "edit": { "*": "deny", "src/**": "allow" }
 * }
 */
-const PermissionsConfigSchema = zod_mini.z.looseObject({ permission: zod_mini.z.record(zod_mini.z.string(), PermissionRulesSchema) });
+const PermissionsConfigSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.record(zod_mini.z.string(), PermissionRulesSchema),
+	opencode: zod_mini.z.optional(OpencodePermissionsOverrideSchema),
+	hermes: zod_mini.z.optional(HermesPermissionsOverrideSchema),
+	cline: zod_mini.z.optional(ClinePermissionsOverrideSchema),
+	kilo: zod_mini.z.optional(KiloPermissionsOverrideSchema),
+	claudecode: zod_mini.z.optional(ClaudecodePermissionsOverrideSchema),
+	vibe: zod_mini.z.optional(VibePermissionsOverrideSchema),
+	cursor: zod_mini.z.optional(CursorPermissionsOverrideSchema),
+	qwencode: zod_mini.z.optional(QwencodePermissionsOverrideSchema),
+	reasonix: zod_mini.z.optional(ReasonixPermissionsOverrideSchema),
+	factorydroid: zod_mini.z.optional(FactorydroidPermissionsOverrideSchema),
+	warp: zod_mini.z.optional(WarpPermissionsOverrideSchema),
+	junie: zod_mini.z.optional(JuniePermissionsOverrideSchema),
+	takt: zod_mini.z.optional(TaktPermissionsOverrideSchema),
+	amp: zod_mini.z.optional(AmpPermissionsOverrideSchema),
+	"antigravity-cli": zod_mini.z.optional(AntigravityCliPermissionsOverrideSchema)
+});
 /**
 * Full permissions file schema including optional $schema field.
 */
@@ -15895,6 +16399,39 @@ const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 * Reference: https://ampcode.com/manual ("amp.permissions").
 */
 const AMP_PERMISSIONS_KEY = "amp.permissions";
+/**
+* The `amp.guardedFiles.allowlist` array (file globs allowed without
+* confirmation), `amp.dangerouslyAllowAll` boolean (disable all confirmation),
+* and `amp.mcpPermissions` array — sibling settings authored through the `amp`
+* permissions override. Reference: https://ampcode.com/manual.
+*/
+const AMP_GUARDED_FILES_ALLOWLIST_KEY = "amp.guardedFiles.allowlist";
+const AMP_DANGEROUSLY_ALLOW_ALL_KEY = "amp.dangerouslyAllowAll";
+const AMP_MCP_PERMISSIONS_KEY = "amp.mcpPermissions";
+/**
+* The read-only `cmd` string of an entry's `matches`, or `undefined` when the
+* matcher is absent or uses a non-`cmd` key / non-string value.
+*/
+function ampMatchesCmd(entry) {
+	const cmd = entry.matches?.cmd;
+	return typeof cmd === "string" ? cmd : void 0;
+}
+/**
+* Whether an `amp.permissions` entry is fully expressible in the canonical
+* per-command allow/ask/deny model: a plain `allow`/`ask`/`reject` action with
+* no `context`/`message`/`to` and a matcher that is either absent or exactly a
+* single string `cmd`. Everything else (non-`cmd` matchers, regex/array match
+* values, `delegate`, `reject`+`message`, `context`) is routed to the `amp`
+* override verbatim instead of being flattened with loss or dropped.
+*/
+function isCanonicalAmpEntry(entry) {
+	if (entry.action === "delegate") return false;
+	if (entry.context !== void 0 || entry.message !== void 0 || entry.to !== void 0) return false;
+	const matches = entry.matches;
+	if (matches === void 0) return true;
+	const keys = Object.keys(matches);
+	return keys.length === 0 || keys.length === 1 && typeof matches.cmd === "string";
+}
 function parseAmpSettings(fileContent) {
 	const errors = [];
 	const parsed = (0, jsonc_parser.parse)(fileContent || "{}", errors, { allowTrailingComma: true });
@@ -15910,10 +16447,20 @@ function toDisableList(value) {
 	return value.filter((entry) => typeof entry === "string");
 }
 /**
+* Read `amp.guardedFiles.allowlist` (an array of file glob strings) from parsed
+* settings, returning `undefined` when the key is absent or not an array so the
+* override omits it.
+*/
+function extractAmpGuardedAllowlist(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter((entry) => typeof entry === "string");
+}
+/**
 * Read an `amp.permissions` array from untrusted parsed settings. Only entries
-* whose shape rulesync understands are retained; the original objects are kept
-* by reference (with a normalized `action`) so unknown sibling keys survive a
-* round-trip when the entry is preserved.
+* whose `tool`/`action` rulesync understands are retained; every other key —
+* including the full `matches` object (so non-`cmd` matchers, regex/array
+* values, `context`, `to`, `message`) — is kept verbatim so it survives a
+* round-trip.
 */
 function toPermissionsList(value) {
 	if (!Array.isArray(value)) return [];
@@ -15923,14 +16470,11 @@ function toPermissionsList(value) {
 		const { tool, action } = raw;
 		if (typeof tool !== "string" || typeof action !== "string") continue;
 		if (action !== "allow" && action !== "reject" && action !== "ask" && action !== "delegate") continue;
-		const matches = raw.matches;
-		let normalizedMatches;
-		if (isPlainObject(matches) && typeof matches.cmd === "string") normalizedMatches = { cmd: matches.cmd };
 		entries.push({
 			...raw,
 			tool,
 			action,
-			...normalizedMatches ? { matches: normalizedMatches } : {}
+			...isPlainObject(raw.matches) ? { matches: raw.matches } : {}
 		});
 	}
 	return entries;
@@ -15955,6 +16499,13 @@ function toPermissionsList(value) {
 * The settings file is shared with the MCP feature (`amp.mcpServers`), so reads
 * and writes merge into the existing JSON rather than overwriting it, and the
 * file is never deleted.
+*
+* Amp shapes with no canonical category are authored and round-tripped through
+* the `amp` permissions override (see `AmpPermissionsOverrideSchema`): extra
+* `amp.permissions` entries with non-`cmd` matchers / `context` / `delegate` /
+* `reject`+`message` (appended after the generated canonical entries), plus the
+* sibling `amp.mcpPermissions`, `amp.guardedFiles.allowlist`, and
+* `amp.dangerouslyAllowAll` settings.
 */
 var AmpPermissions = class AmpPermissions extends ToolPermissions {
 	constructor(params) {
@@ -16024,15 +16575,25 @@ var AmpPermissions = class AmpPermissions extends ToolPermissions {
 		const jsonDir = (0, node_path.join)(outputRoot, basePaths.relativeDirPath);
 		const { fileContent, relativeFilePath } = await this.resolveSettingsFile(jsonDir);
 		const json = fileContent ? parseAmpSettings(fileContent) : {};
-		const { disable, permissions } = convertRulesyncToAmp(rulesyncPermissions.getJson());
-		const preservedDelegates = toPermissionsList(json[AMP_PERMISSIONS_KEY]).filter((entry) => entry.action === "delegate");
+		const config = rulesyncPermissions.getJson();
+		const { disable, permissions } = convertRulesyncToAmp(config);
+		const override = config.amp;
+		const authoredExtras = override?.permissions ? toPermissionsList(override.permissions) : [];
+		const preservedDelegates = override?.permissions ? [] : toPermissionsList(json[AMP_PERMISSIONS_KEY]).filter((entry) => entry.action === "delegate");
 		const newJson = {
 			...json,
 			[AMP_TOOLS_DISABLE_KEY]: disable
 		};
-		const mergedPermissions = [...permissions, ...preservedDelegates];
+		const mergedPermissions = mergeAmpPermissions([
+			...permissions,
+			...authoredExtras,
+			...preservedDelegates
+		]);
 		if (mergedPermissions.length > 0) newJson[AMP_PERMISSIONS_KEY] = mergedPermissions;
 		else delete newJson[AMP_PERMISSIONS_KEY];
+		if (override?.guardedFiles?.allowlist !== void 0) newJson[AMP_GUARDED_FILES_ALLOWLIST_KEY] = override.guardedFiles.allowlist;
+		if (override?.dangerouslyAllowAll !== void 0) newJson[AMP_DANGEROUSLY_ALLOW_ALL_KEY] = override.dangerouslyAllowAll;
+		if (override?.mcpPermissions !== void 0) newJson[AMP_MCP_PERMISSIONS_KEY] = override.mcpPermissions;
 		return new AmpPermissions({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
@@ -16043,11 +16604,22 @@ var AmpPermissions = class AmpPermissions extends ToolPermissions {
 	}
 	toRulesyncPermissions() {
 		const json = parseAmpSettings(this.getFileContent());
+		const allPermissions = toPermissionsList(json[AMP_PERMISSIONS_KEY]);
+		const canonicalEntries = allPermissions.filter(isCanonicalAmpEntry);
+		const overrideEntries = allPermissions.filter((entry) => !isCanonicalAmpEntry(entry));
 		const config = convertAmpToRulesync({
 			disable: toDisableList(json[AMP_TOOLS_DISABLE_KEY]),
-			permissions: toPermissionsList(json[AMP_PERMISSIONS_KEY])
-		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+			permissions: canonicalEntries
+		});
+		const ampOverride = {};
+		if (overrideEntries.length > 0) ampOverride.permissions = overrideEntries;
+		if (Array.isArray(json[AMP_MCP_PERMISSIONS_KEY])) ampOverride.mcpPermissions = json[AMP_MCP_PERMISSIONS_KEY];
+		const allowlist = extractAmpGuardedAllowlist(json[AMP_GUARDED_FILES_ALLOWLIST_KEY]);
+		if (allowlist !== void 0) ampOverride.guardedFiles = { allowlist };
+		if (typeof json[AMP_DANGEROUSLY_ALLOW_ALL_KEY] === "boolean") ampOverride.dangerouslyAllowAll = json[AMP_DANGEROUSLY_ALLOW_ALL_KEY];
+		const result = { ...config };
+		if (Object.keys(ampOverride).length > 0) result.amp = ampOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -16094,6 +16666,37 @@ const ACTION_PRIORITY = {
 	allow: 2
 };
 /**
+* Fail-closed action priority for merging the full `amp.permissions` list
+* (generated + authored/preserved). `reject` leads so no `allow` can shadow it
+* under first-match-wins; `delegate` (which defers to an external approver, so
+* it never auto-allows) trails as the final fallback.
+*/
+const MERGE_ACTION_PRIORITY = {
+	reject: 0,
+	ask: 1,
+	allow: 2,
+	delegate: 3
+};
+/**
+* Stable fail-closed merge of generated and authored `amp.permissions` entries:
+* order by {@link MERGE_ACTION_PRIORITY} only, preserving each source's relative
+* order within an action class. Guarantees an authored `reject` cannot be
+* shadowed by a generated catch-all `allow`.
+*/
+function mergeAmpPermissions(entries) {
+	const decorated = entries.map((entry, index) => ({
+		entry,
+		index
+	}));
+	decorated.sort((a, b) => {
+		const ap = MERGE_ACTION_PRIORITY[a.entry.action] ?? MERGE_ACTION_PRIORITY.allow;
+		const bp = MERGE_ACTION_PRIORITY[b.entry.action] ?? MERGE_ACTION_PRIORITY.allow;
+		if (ap !== bp) return ap - bp;
+		return a.index - b.index;
+	});
+	return decorated.map((d) => d.entry);
+}
+/**
 * Convert a rulesync permissions config into Amp's two permission surfaces.
 *
 * For each `(category, pattern, action)` — where the category name IS the Amp
@@ -16158,14 +16761,14 @@ function sortAmpPermissions(entries) {
 		const ap = ACTION_PRIORITY[a.entry.action] ?? 0;
 		const bp = ACTION_PRIORITY[b.entry.action] ?? 0;
 		if (ap !== bp) return ap - bp;
-		const aHasCmd = a.entry.matches?.cmd !== void 0 ? 0 : 1;
-		const bHasCmd = b.entry.matches?.cmd !== void 0 ? 0 : 1;
+		const aHasCmd = ampMatchesCmd(a.entry) !== void 0 ? 0 : 1;
+		const bHasCmd = ampMatchesCmd(b.entry) !== void 0 ? 0 : 1;
 		if (aHasCmd !== bHasCmd) return aHasCmd - bHasCmd;
 		const at = a.entry.tool;
 		const bt = b.entry.tool;
 		if (at !== bt) return at < bt ? -1 : 1;
-		const ac = a.entry.matches?.cmd ?? "";
-		const bc = b.entry.matches?.cmd ?? "";
+		const ac = ampMatchesCmd(a.entry) ?? "";
+		const bc = ampMatchesCmd(b.entry) ?? "";
 		if (ac !== bc) return ac < bc ? -1 : 1;
 		return a.index - b.index;
 	});
@@ -16204,7 +16807,7 @@ function convertAmpToRulesync({ disable, permissions }) {
 	for (const tool of disable) assign(tool, "*", "deny");
 	for (const entry of permissions) {
 		if (entry.action === "delegate") continue;
-		const pattern = entry.matches?.cmd ?? "*";
+		const pattern = ampMatchesCmd(entry) ?? "*";
 		const action = entry.action === "reject" ? "deny" : entry.action === "ask" ? "ask" : "allow";
 		assign(entry.tool, pattern, action);
 	}
@@ -16286,6 +16889,11 @@ function buildPermissionEntry$1(toolName, pattern) {
 * Permissions are written to the global `~/.gemini/antigravity-cli/settings.json`
 * file (global scope only). The file holds other CLI settings besides
 * permissions, so it is never deleted.
+*
+* Two CLI-only autonomy/sandbox knobs outside the allow/ask/deny arrays —
+* `toolPermission` (the global autonomy preset) and `enableTerminalSandbox` — are
+* authored and round-tripped through the `antigravity-cli` permissions override
+* (see `AntigravityCliPermissionsOverrideSchema`).
 */
 var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPermissions {
 	constructor(params) {
@@ -16346,6 +16954,9 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			...settings,
 			permissions: mergedPermissions
 		};
+		const override = config["antigravity-cli"];
+		if (override?.toolPermission !== void 0) merged.toolPermission = override.toolPermission;
+		if (override?.enableTerminalSandbox !== void 0) merged.enableTerminalSandbox = override.enableTerminalSandbox;
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new AntigravityCliPermissions({
 			outputRoot,
@@ -16369,7 +16980,12 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const override = {};
+		if (typeof settings.toolPermission === "string") override.toolPermission = settings.toolPermission;
+		if (typeof settings.enableTerminalSandbox === "boolean") override.enableTerminalSandbox = settings.enableTerminalSandbox;
+		const result = { ...config };
+		if (Object.keys(override).length > 0) result["antigravity-cli"] = override;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -17155,6 +17771,14 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToClaudePermissions(config);
+		const overridePermissions = config.claudecode?.permissions;
+		if (overridePermissions && typeof overridePermissions === "object") {
+			const { allow: _a, ask: _k, deny: _d, ...nonListFields } = overridePermissions;
+			settings.permissions = {
+				...settings.permissions,
+				...nonListFields
+			};
+		}
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toClaudeToolName(category)));
 		const merged = applyPermissions({
 			settings,
@@ -17187,6 +17811,8 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
+		const { allow: _a, ask: _k, deny: _d, ...nonListFields } = permissions;
+		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17360,7 +17986,8 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Cline command-permissions at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(rulesyncPermissions.getJson().permission);
+		const config = rulesyncPermissions.getJson();
+		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(config.permission);
 		warnClineTranslationNotices({
 			droppedCategories,
 			translatedAskPatterns,
@@ -17376,7 +18003,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 			...existing,
 			allow: dedupedAllow,
 			deny: mergedDeny,
-			allowRedirects: existing.allowRedirects ?? false
+			allowRedirects: config.cline?.allowRedirects ?? existing.allowRedirects ?? false
 		};
 		return new ClinePermissions({
 			outputRoot,
@@ -17400,6 +18027,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		for (const pattern of parsed.allow ?? []) bashRules[pattern] = "allow";
 		for (const pattern of parsed.deny ?? []) bashRules[pattern] = "deny";
 		const config = Object.keys(bashRules).length > 0 ? { permission: { bash: bashRules } } : { permission: {} };
+		if (parsed.allowRedirects === true) config.cline = { allowRedirects: true };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
@@ -17836,13 +18464,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX = "mcp__";
+const MCP_CANONICAL_PREFIX$1 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$1) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -17873,7 +18501,7 @@ function toCursorPattern(canonical, pattern) {
 function toCanonicalCategory$1(cursorType, pattern) {
 	if (cursorType === "Mcp") {
 		const match = pattern.match(/^([^:()]+):([^:()]+)$/);
-		if (match) return `${MCP_CANONICAL_PREFIX}${match[1] ?? "*"}__${match[2] ?? "*"}`;
+		if (match) return `${MCP_CANONICAL_PREFIX$1}${match[1] ?? "*"}__${match[2] ?? "*"}`;
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
 	return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
@@ -18007,8 +18635,10 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		mergedPermissions.allow = mergedAllow;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
+		const cursorOverride = config.cursor;
 		const merged = {
 			...settings,
+			...cursorOverride,
 			version: settings.version ?? 1,
 			editor: {
 				...existingEditor,
@@ -18034,11 +18664,15 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		}
 		const permissionsRaw = settings.permissions;
 		const permissions = permissionsRaw !== null && typeof permissionsRaw === "object" && !Array.isArray(permissionsRaw) ? permissionsRaw : {};
-		const config = convertCursorToRulesyncPermissions({
+		const result = { ...convertCursorToRulesyncPermissions({
 			allow: asCursorPermissionEntryArray(permissions.allow),
 			deny: asCursorPermissionEntryArray(permissions.deny)
-		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		}) };
+		const cursorOverride = {};
+		if (settings.approvalMode !== void 0) cursorOverride.approvalMode = settings.approvalMode;
+		if (settings.sandbox !== null && typeof settings.sandbox === "object" && !Array.isArray(settings.sandbox)) cursorOverride.sandbox = settings.sandbox;
+		if (Object.keys(cursorOverride).length > 0) result.cursor = cursorOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18097,7 +18731,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { type, pattern } = parseCursorPermissionEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$1) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -18346,6 +18980,16 @@ function convertDevinToRulesyncPermissions(params) {
 }
 //#endregion
 //#region src/features/permissions/factorydroid-permissions.ts
+const FACTORYDROID_OVERRIDE_KEYS = [
+	"commandBlocklist",
+	"networkPolicy",
+	"sandbox",
+	"mcpPolicy",
+	"enableDroidShield",
+	"sessionDefaultSettings",
+	"maxAutonomyLevel",
+	"interactionMode"
+];
 /**
 * Permissions adapter for Factory Droid.
 *
@@ -18363,18 +19007,14 @@ function convertDevinToRulesyncPermissions(params) {
 * skipped (with a warning when they carry `deny` rules, to surface the gap).
 *
 * Factory Droid also has a stronger `commandBlocklist` tier — commands that can
-* never run, not even under full autonomy. rulesync's canonical action model
-* has only `allow | ask | deny`, with no equivalent of a hard block that can
-* never be approved. So on **import** a `commandBlocklist` entry is collapsed
-* onto canonical `deny` (lossy: the never-runs guarantee is weakened to a deny
-* the user can still approve), rather than being silently dropped. On **export**
-* there is no canonical `block` to emit one from, so rulesync never writes
-* `commandBlocklist`; an existing one on disk is preserved verbatim as an
-* unmanaged key. (A consequence of the lossy collapse: importing a
-* `commandBlocklist` and re-exporting it to a *fresh* config writes it back as
-* `commandDenylist`, not `commandBlocklist` — the hard-block tier is not
-* reconstructed. Re-running over the original file keeps it intact via the
-* verbatim preservation above.)
+* never run, not even under full autonomy — plus other security controls
+* (`networkPolicy`, `sandbox`, `mcpPolicy`, `enableDroidShield`, autonomy
+* settings) that do not fit the canonical `allow | ask | deny` per-command
+* model. These are authored and round-tripped through the `factorydroid`
+* override namespace (see `FactorydroidPermissionsOverrideSchema`): on **import**
+* they are lifted from `settings.json` into the override, and on **export** they
+* are merged back in — so `commandBlocklist`'s never-runs guarantee is preserved
+* faithfully rather than being collapsed onto an approvable `deny`.
 */
 var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissions {
 	constructor(params) {
@@ -18417,11 +19057,16 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		} catch (error) {
 			throw new Error(`Failed to parse existing Factory Droid settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToFactorydroidPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
-		const merged = { ...settings };
+		const override = config.factorydroid;
+		const merged = {
+			...settings,
+			...override !== void 0 && typeof override === "object" ? override : {}
+		};
 		const mergedAllow = (0, es_toolkit.uniq)(allow.toSorted());
 		const mergedDeny = (0, es_toolkit.uniq)(deny.toSorted());
 		if (mergedAllow.length > 0) merged.commandAllowlist = mergedAllow;
@@ -18445,10 +19090,13 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 		}
 		const config = convertFactorydroidToRulesyncPermissions({
 			allow: Array.isArray(settings.commandAllowlist) ? settings.commandAllowlist : [],
-			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : [],
-			block: Array.isArray(settings.commandBlocklist) ? settings.commandBlocklist : []
+			deny: Array.isArray(settings.commandDenylist) ? settings.commandDenylist : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const factorydroidOverride = {};
+		for (const key of FACTORYDROID_OVERRIDE_KEYS) if (settings[key] !== void 0) factorydroidOverride[key] = settings[key];
+		const result = { ...config };
+		if (Object.keys(factorydroidOverride).length > 0) result.factorydroid = factorydroidOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -18495,18 +19143,18 @@ function convertRulesyncToFactorydroidPermissions({ config, logger }) {
 	};
 }
 /**
-* Convert Factory Droid allow/deny/block command lists back to rulesync config
-* under the `bash` category.
+* Convert Factory Droid allow/deny command lists back to rulesync config under
+* the `bash` category.
 *
-* `commandBlocklist` (hard block) has no canonical equivalent, so it collapses
-* onto `deny` — lossy (a deny can still be approved), but preferable to dropping
-* the rule entirely.
+* `commandBlocklist` (the hard-block tier) is no longer collapsed here — it has
+* no canonical equivalent and now round-trips through the `factorydroid`
+* override so the never-runs guarantee is preserved instead of being weakened to
+* an approvable `deny`.
 */
-function convertFactorydroidToRulesyncPermissions({ allow, deny, block }) {
+function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 	const bash = {};
 	for (const pattern of allow) bash[pattern] = "allow";
 	for (const pattern of deny) bash[pattern] = "deny";
-	for (const pattern of block) bash[pattern] = "deny";
 	return { permission: Object.keys(bash).length > 0 ? { bash } : {} };
 }
 //#endregion
@@ -18700,30 +19348,114 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 const GROKCLI_GLOBAL_ONLY_MESSAGE = "Grok CLI permissions are global-only; use --global to sync ~/.grok/config.toml";
 const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
+const GROKCLI_PERMISSION_KEY = "permission";
 const CATCH_ALL_PATTERN$2 = "*";
+const MCP_CANONICAL_PREFIX = "mcp__";
+const CATEGORY_TO_GROK_TOOL = {
+	bash: "Bash",
+	read: "Read",
+	edit: "Edit",
+	write: "Edit",
+	grep: "Grep",
+	webfetch: "WebFetch"
+};
+const GROK_TOOL_TO_CATEGORY = {
+	Bash: "bash",
+	Read: "read",
+	Edit: "edit",
+	Grep: "grep",
+	WebFetch: "webfetch"
+};
+const GROK_MCP_TOOL = "MCPTool";
+/**
+* Build a Grok Claude-style permission entry (e.g. `Bash(git *)`, `Read`,
+* `MCPTool(server__tool)`) from a canonical category + pattern. Returns `null`
+* for categories Grok cannot express so callers can skip them.
+*
+* Scoped MCP categories (`mcp__<remainder>`) fold their address into the
+* parentheses (`MCPTool(<remainder>)`); the bare `mcp` category becomes
+* `MCPTool`. For every other tool, a `*` pattern emits the bare tool name and a
+* concrete pattern emits `Tool(pattern)`.
+*/
+function buildGrokEntry(category, pattern) {
+	if (category.startsWith(MCP_CANONICAL_PREFIX)) {
+		const remainder = category.slice(5);
+		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
+	}
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	const tool = CATEGORY_TO_GROK_TOOL[category];
+	if (tool === void 0) return null;
+	return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? tool : `${tool}(${pattern})`;
+}
+/**
+* Parse a Grok Claude-style permission entry back into a canonical category +
+* pattern. Entries without parentheses are treated as catch-all (`*`). Returns
+* `null` for tool prefixes with no canonical equivalent (e.g. `any`).
+*/
+function parseGrokEntry(entry) {
+	const trimmed = entry.trim();
+	const parenIndex = trimmed.indexOf("(");
+	let tool;
+	let inner;
+	if (parenIndex === -1 || !trimmed.endsWith(")")) {
+		tool = trimmed;
+		inner = "";
+	} else {
+		tool = trimmed.slice(0, parenIndex);
+		inner = trimmed.slice(parenIndex + 1, -1).trim();
+	}
+	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
+		category: `${MCP_CANONICAL_PREFIX}${inner}`,
+		pattern: CATCH_ALL_PATTERN$2
+	} : {
+		category: "mcp",
+		pattern: CATCH_ALL_PATTERN$2
+	};
+	const category = GROK_TOOL_TO_CATEGORY[tool];
+	if (category === void 0) return null;
+	return {
+		category,
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$2
+	};
+}
 /**
 * Permissions adapter for the xAI Grok Build CLI (`grokcli`).
 *
-* Grok has no per-tool / per-pattern permission rules. Tool gating is a single
-* coarse toggle, `[ui] permission_mode`, in `~/.grok/config.toml`:
-*   - `ask` — prompt before each tool call (Grok's default).
-*   - `always-approve` — skip prompts.
-*
-* rulesync's permission model is per-category, per-pattern `allow`/`ask`/`deny`,
-* so the mapping is **lossy** (a single mode cannot express per-pattern rules):
-*   - Generate: any `deny` or `ask` rule anywhere ⇒ `ask` (conservative — keep
-*     prompting whenever the user expressed any restriction); otherwise, if at
-*     least one `allow` rule exists and nothing is denied/asked ⇒
-*     `always-approve`; an empty config falls back to the safe default `ask`.
-*   - Import: `always-approve` ⇒ `bash: { "*": "allow" }`; `ask` (or unset) ⇒
-*     `bash: { "*": "ask" }`. `bash` is used as the representative catch-all
-*     because it is the primary permission-gated surface, and this round-trips
-*     the generate mapping.
-*
-* This surface is **global only** — `permission_mode` lives in the user-level
-* `~/.grok/config.toml`; Grok has no project-scoped permission file. The shared
-* config is merged in place: the `[ui] permission_mode` value is set and every
-* other key (e.g. `[mcp_servers]`, legacy `approval_mode`) is preserved. The
+* Grok Build CLI ships a Claude-style rule system under `[permission]` in
+* `~/.grok/config.toml`: `allow` / `deny` / `ask` arrays of entries such as
+* `Bash(git *)`, `Read(src/**)`, `Edit`, `Grep`, `MCPTool(server__tool)`, and
+* `WebFetch`, evaluated with precedence `deny > ask > allow`
+* (https://docs.x.ai/build/settings/reference). rulesync's canonical
+* per-category, per-pattern model maps almost 1:1:
+*   - Generate: each `permission.<category>.<pattern> = allow|ask|deny` becomes
+*     the matching Grok entry and is bucketed into the `[permission]` array for
+*     that action. `bash|read|edit|grep|webfetch` map to their Grok tool;
+*     `write` collapses onto `Edit` (Grok has no `Write` tool); `mcp__*` maps to
+*     `MCPTool(...)` (a scoped MCP category folds its address into the
+*     parentheses, so a non-`*` argument pattern on it is not represented).
+*     Categories with no Grok tool (`websearch`, `glob`, `notebookedit`,
+*     `agent`) are skipped (with a warning when they carry a `deny` rule, to
+*     surface the gap). When two canonical rules collapse onto the same Grok
+*     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
+*     the strictest wins (`deny > ask > allow`) and a warning is logged, so the
+*     entry never lands contradictorily in two arrays.
+*   - Import: the `[permission]` arrays are parsed back into canonical
+*     categories. When no `[permission]` section is present (older configs), the
+*     coarse `[ui] permission_mode` is used as a fallback.
+*
+* The coarse `[ui] permission_mode` toggle is still written for backward
+* compatibility with older Grok versions: `always-approve` when the config is
+* pure-`allow`, otherwise `ask` (conservative — it is never `always-approve`
+* while any `deny`/`ask` rule exists, so it never contradicts the fine-grained
+* arrays).
+*
+* This surface is **global only** — the adapter syncs the user-level
+* `~/.grok/config.toml`. (Grok also supports a project-scoped `[permission]`
+* file; project scope is not modeled here.) The shared config is merged in
+* place: rulesync owns the `[permission]` `allow`/`deny`/`ask` entries for the
+* tools it models and the `[ui] permission_mode` value, while every other key
+* (e.g. `[mcp_servers]`, `[permission] rules`, `[sandbox]`) and any user-authored
+* entries for tools rulesync cannot model (e.g. `WebSearch`) are preserved. The
 * file is never deleted.
 */
 var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
@@ -18755,7 +19487,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			global: true
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
 		if (!global) throw new Error(GROKCLI_GLOBAL_ONLY_MESSAGE);
 		const paths = GrokcliPermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -18766,7 +19498,16 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Grok config.toml at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const mode = deriveGrokPermissionMode(rulesyncPermissions.getJson());
+		const config = rulesyncPermissions.getJson();
+		const existingPermission = isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {};
+		const buckets = buildGrokPermissionArrays(config, existingPermission, logger);
+		parsed[GROKCLI_PERMISSION_KEY] = {
+			...existingPermission,
+			allow: buckets.allow,
+			deny: buckets.deny,
+			ask: buckets.ask
+		};
+		const mode = deriveGrokPermissionMode(config);
 		const existingUi = isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {};
 		parsed[GROKCLI_UI_KEY] = {
 			...existingUi,
@@ -18789,8 +19530,8 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const action = (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
-		const rulesyncConfig = { permission: { bash: { [CATCH_ALL_PATTERN$2]: action } } };
+		const fineGrained = parseGrokPermissionArrays(isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$2]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -18810,6 +19551,84 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		});
 	}
 };
+const ACTION_RANK = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Collect user-authored entries from an existing `[permission]` array whose
+* tool prefix rulesync cannot model (e.g. `WebSearch`, `any`). Such entries are
+* preserved verbatim so replacing the arrays does not silently drop them
+* (mirrors the Cursor adapter's preservation of unmanaged types).
+*/
+function unmanagedEntries(existingPermission, key) {
+	return (isStringArray(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+}
+/**
+* Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
+* Claude-style entries, resolving collapse collisions via `deny > ask > allow`.
+* Categories Grok cannot express are skipped (with a warning when they carry a
+* `deny` rule); entries the user authored for tools rulesync cannot model are
+* preserved from `existingPermission`.
+*/
+function buildGrokPermissionArrays(config, existingPermission, logger) {
+	const ranked = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+		const entry = buildGrokEntry(category, pattern);
+		if (entry === null) {
+			if (action === "deny" && logger) logger.warn(`Grok CLI has no permission tool for the '${category}' category; its 'deny' rule could not be represented and was skipped.`);
+			continue;
+		}
+		const existing = ranked.get(entry);
+		if (existing !== void 0 && existing !== action) logger?.warn(`Grok permission entry '${entry}' received conflicting actions ('${existing}' and '${action}'); keeping the stricter one (deny > ask > allow).`);
+		if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) ranked.set(entry, action);
+	}
+	const allow = unmanagedEntries(existingPermission, "allow");
+	const deny = unmanagedEntries(existingPermission, "deny");
+	const ask = unmanagedEntries(existingPermission, "ask");
+	for (const [entry, action] of ranked) if (action === "allow") allow.push(entry);
+	else if (action === "deny") deny.push(entry);
+	else ask.push(entry);
+	return {
+		allow: (0, es_toolkit.uniq)(allow.toSorted()),
+		deny: (0, es_toolkit.uniq)(deny.toSorted()),
+		ask: (0, es_toolkit.uniq)(ask.toSorted())
+	};
+}
+/**
+* Parse Grok's `[permission]` allow/deny/ask arrays back into a canonical
+* permission map. Returns `null` when the section defines none of the three
+* arrays, so the caller can fall back to the coarse `permission_mode`.
+* Precedence `deny > ask > allow` is applied so a tool listed in multiple
+* arrays resolves to the strictest action.
+*/
+function parseGrokPermissionArrays(permission) {
+	const allow = isStringArray(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray(permission.ask) ? permission.ask : void 0;
+	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) === 0) return null;
+	const result = {};
+	const apply = (entries, action) => {
+		for (const entry of entries ?? []) {
+			const parsed = parseGrokEntry(entry);
+			if (parsed === null) continue;
+			const bucket = result[parsed.category] ??= {};
+			bucket[parsed.pattern] = action;
+		}
+	};
+	apply(allow, "allow");
+	apply(ask, "ask");
+	apply(deny, "deny");
+	return result;
+}
+/**
+* Legacy coarse fallback: map `[ui] permission_mode` to a canonical action.
+* `always-approve` ⇒ `allow`; anything else (including a missing mode) ⇒ `ask`.
+*/
+function legacyModeAction(parsed) {
+	return (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
+}
 /**
 * Collapse a rulesync permissions config into Grok's single coarse mode.
 * Any `deny`/`ask` rule anywhere keeps prompting (`ask`); otherwise an existing
@@ -18825,6 +19644,10 @@ function deriveGrokPermissionMode(config) {
 }
 //#endregion
 //#region src/features/permissions/hermesagent-permissions.ts
+/** Collect the glob patterns in a canonical category that carry a given action. */
+function patternsByAction(category, action) {
+	return Object.entries(category ?? {}).filter(([, value]) => value === action).map(([pattern]) => pattern);
+}
 var HermesagentPermissions = class HermesagentPermissions extends ToolPermissions {
 	static getSettablePaths() {
 		return {
@@ -18848,10 +19671,21 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		return true;
 	}
 	setFileContent(fileContent) {
-		this.fileContent = mergeHermesConfig(fileContent, parseHermesConfig(this.fileContent));
+		this.fileContent = applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "permissions",
+			existingContent: fileContent,
+			patch: parseSharedConfig({
+				format: "yaml",
+				fileContent: this.fileContent
+			})
+		});
 	}
 	toRulesyncPermissions() {
-		const config = parseHermesConfig(this.getFileContent());
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent()
+		});
 		const permissions = config.permissions && typeof config.permissions === "object" ? config.permissions.rulesync : {};
 		return new RulesyncPermissions({
 			relativeDirPath: "",
@@ -18861,11 +19695,27 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 	}
 	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions }) {
 		const permissions = rulesyncPermissions.getJson();
+		const permissionBlock = permissions.permission ?? {};
+		const commandAllowlist = Object.entries(permissionBlock).flatMap(([, patterns]) => patternsByAction(patterns, "allow"));
+		const bashDeny = patternsByAction(permissionBlock.bash, "deny");
+		const webfetchDeny = patternsByAction(permissionBlock.webfetch, "deny");
+		let config = {};
+		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
+		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
+		if (webfetchDeny.length > 0) config.security = { website_blocklist: {
+			enabled: true,
+			domains: webfetchDeny
+		} };
+		if (permissions.hermes && typeof permissions.hermes === "object") config = mergeSharedConfigDeep({
+			base: config,
+			patch: permissions.hermes
+		});
+		config.permissions = { rulesync: permissions };
 		return new HermesagentPermissions({
 			outputRoot,
-			fileContent: stringifyHermesConfig({
-				command_allowlist: Object.entries(permissions.permission ?? {}).flatMap(([, patterns]) => Object.entries(patterns).filter(([, action]) => action === "allow").map(([command]) => command)),
-				permissions: { rulesync: permissions }
+			fileContent: stringifySharedConfig({
+				format: "yaml",
+				document: config
 			})
 		});
 	}
@@ -18887,14 +19737,18 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *     "executables":       [ { "prefix": "git ", "action": "allow" } ],
 *     "fileEditing":       [ { "pattern": "src/**", "action": "allow" } ],
 *     "mcpTools":          [ { "prefix": "search", "action": "allow" } ],
-*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "deny" } ]
+*     "readOutsideProject":[ { "pattern": "/etc/**", "action": "ask" } ]
 *   }
 * }
 * ```
 *
 * Each rule carries a literal `prefix` (matches commands that start with it) or
-* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`
-* (`allow` | `ask` | `deny`). rulesync's canonical actions map 1:1 onto Junie's.
+* a glob `pattern` (`*`, `**`, `?`, `[abc]`, `[!abc]`) plus an `action`. Junie
+* documents only `allow` and `ask` as valid actions — there is **no `deny`**
+* (https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html). rulesync's
+* canonical `allow`/`ask` map 1:1; a canonical `deny` has no Junie equivalent
+* and is mapped to the nearest valid action, `ask` (still withholds
+* auto-approval), with a warning so the downgrade is surfaced.
 *
 * Category mapping (rulesync canonical <-> Junie rule group):
 * - `bash`         <-> `executables`
@@ -18904,8 +19758,11 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 *
 * Categories Junie cannot represent (e.g. `webfetch`) are skipped on export
 * (with a warning when they carry rules). The top-level `defaultBehavior` and
-* `allowReadonlyCommands` settings have no canonical equivalent: they are
-* preserved verbatim on export but not imported into the rulesync model.
+* `allowReadonlyCommands` settings have no canonical per-glob slot: they are
+* authored and round-tripped through the `junie` override namespace (see
+* `JuniePermissionsOverrideSchema`) — lifted into the override on import and
+* merged back onto the top level on export — and any other unmodeled top-level
+* key is preserved verbatim.
 *
 * @see https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html
 */
@@ -18928,7 +19785,6 @@ const JUNIE_GROUP_TO_CANONICAL = {
 	mcpTools: "mcp",
 	readOutsideProject: "read"
 };
-const JUNIE_DEFAULT_BEHAVIOR = "ask";
 function isPermissionAction$1(value) {
 	return PermissionActionSchema.safeParse(value).success;
 }
@@ -18978,13 +19834,16 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Junie allowlist at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const rules = convertRulesyncToJunieRules({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
+		const override = config.junie;
+		const overrideObj = override !== void 0 && typeof override === "object" ? override : {};
 		const merged = {
 			...existing,
-			defaultBehavior: existing.defaultBehavior ?? JUNIE_DEFAULT_BEHAVIOR,
+			...overrideObj,
 			rules
 		};
 		return new JuniePermissions({
@@ -19004,7 +19863,12 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Junie permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const config = convertJunieToRulesyncPermissions({ allowlist });
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const junieOverride = {};
+		if (typeof allowlist.allowReadonlyCommands === "boolean") junieOverride.allowReadonlyCommands = allowlist.allowReadonlyCommands;
+		if (typeof allowlist.defaultBehavior === "string") junieOverride.defaultBehavior = allowlist.defaultBehavior;
+		const result = { ...config };
+		if (Object.keys(junieOverride).length > 0) result.junie = junieOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -19036,12 +19900,13 @@ function convertRulesyncToJunieRules({ config, logger }) {
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(patterns)) {
+			const junieAction = toJunieAction(action, category, pattern, logger);
 			const rule = isGlobPattern(pattern) ? {
 				pattern,
-				action
+				action: junieAction
 			} : {
 				prefix: pattern,
-				action
+				action: junieAction
 			};
 			(rules[group] ??= []).push(rule);
 		}
@@ -19049,6 +19914,19 @@ function convertRulesyncToJunieRules({ config, logger }) {
 	return rules;
 }
 /**
+* Map a canonical action onto a valid Junie allowlist action. Junie supports
+* only `allow` and `ask`; a canonical `deny` is downgraded to `ask` (the
+* nearest valid action — both withhold auto-approval) with a warning, so
+* rulesync never emits a `deny` that Junie would silently ignore.
+*/
+function toJunieAction(action, category, pattern, logger) {
+	if (action === "deny") {
+		logger?.warn(`Junie's allowlist supports only 'allow'/'ask' actions; the '${category}' deny rule for '${pattern}' was downgraded to 'ask' (Junie has no 'deny').`);
+		return "ask";
+	}
+	return action;
+}
+/**
 * Convert a Junie allowlist back into rulesync permissions config. The
 * top-level `defaultBehavior` / `allowReadonlyCommands` settings have no
 * canonical equivalent and are not imported.
@@ -19082,6 +19960,31 @@ const KiloPermissionSchema = zod_mini.z.union([zod_mini.z.enum([
 ]))]);
 const KiloPermissionsConfigSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), KiloPermissionSchema)) });
 /**
+* Kilo permission keys that share a name with a canonical rulesync category and
+* therefore stay in the shared `permission` block. Everything else (Kilo-only
+* keys such as `external_directory`, `doom_loop`, `notebook_edit`, ...) is
+* routed into the `kilo` override on import so it does not leak into other
+* tools' configs. Kilo folds `write` into `edit`, uses `notebook_edit`/`task`
+* rather than the canonical `notebookedit`/`agent`, and has no `mcp` key (MCP is
+* addressed via `mcp__*` tool-name keys), so those canonical names are not Kilo
+* keys in practice — they simply never appear on the shared side.
+*/
+const KILO_SHARED_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedKiloCategory(key) {
+	return key === "*" || KILO_SHARED_CATEGORIES.has(key) || key.startsWith("mcp__");
+}
+/**
 * Parse a JSONC string and throw on syntax errors. The `jsonc-parser` `parse()` function is
 * non-throwing best-effort: invalid input silently yields a partial value (often `undefined`,
 * coerced to `{}` by callers). That behavior would silently drop a user's existing `deny` rules
@@ -19193,12 +20096,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		const parsed = parseKiloJsoncStrict(await readFileContentOrNull(filePath) ?? "{}", filePath);
 		const parsedPermission = parsed.permission;
 		const existingPermission = parsedPermission && typeof parsedPermission === "object" && !Array.isArray(parsedPermission) ? { ...parsedPermission } : {};
-		const rulesyncPermission = rulesyncPermissions.getJson().permission;
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const kiloOverride = rulesyncJson.kilo;
+		const incomingPermission = {
+			...rulesyncJson.permission,
+			...kiloOverride?.permission
+		};
 		const droppedDenyByKey = {};
-		for (const key of Object.keys(rulesyncPermission)) {
-			const previous = existingPermission[key];
-			const previousDenyPatterns = collectKiloDenyPatterns(previous);
-			const nextDenyPatterns = new Set(collectKiloDenyPatterns(rulesyncPermission[key]));
+		for (const [key, value] of Object.entries(incomingPermission)) {
+			const previousDenyPatterns = collectKiloDenyPatterns(existingPermission[key]);
+			const nextDenyPatterns = new Set(collectKiloDenyPatterns(value));
 			const dropped = previousDenyPatterns.filter((p) => !nextDenyPatterns.has(p));
 			if (dropped.length > 0) droppedDenyByKey[key] = dropped;
 		}
@@ -19206,8 +20113,10 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			const summary = Object.entries(droppedDenyByKey).map(([key, patterns]) => `${key}: [${patterns.join(", ")}]`).join("; ");
 			logger?.warn(`WARNING: Kilo permissions regeneration drops existing 'deny' rule(s) because rulesync output owns these tool keys. Dropped — ${summary}. To preserve these denies, add them to '.rulesync/permissions.json'.`);
 		}
-		const mergedPermission = { ...existingPermission };
-		for (const [key, value] of Object.entries(rulesyncPermission)) mergedPermission[key] = value;
+		const mergedPermission = {
+			...existingPermission,
+			...incomingPermission
+		};
 		const nextJson = {
 			...parsed,
 			permission: mergedPermission
@@ -19221,8 +20130,16 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission ?? {};
+		const shared = {};
+		const overrideOnly = {};
+		for (const [key, value] of Object.entries(rawPermission)) if (isSharedKiloCategory(key)) shared[key] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[key] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			kilo: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19252,10 +20169,6 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			validate: false
 		});
 	}
-	normalizePermission(permission) {
-		if (!permission) return {};
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
-	}
 };
 //#endregion
 //#region src/features/permissions/kiro-permissions.ts
@@ -19313,29 +20226,16 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 		}
 		const permission = {};
 		const toolsSettings = parsed.toolsSettings ?? {};
-		const shellSettings = asRecord$1(toolsSettings.shell);
-		const shellAllow = asStringArray(shellSettings.allowedCommands);
-		const shellDeny = asStringArray(shellSettings.deniedCommands);
-		if (shellAllow.length > 0 || shellDeny.length > 0) {
-			permission.bash = {};
-			for (const pattern of shellAllow) permission.bash[pattern] = "allow";
-			for (const pattern of shellDeny) permission.bash[pattern] = "deny";
-		}
-		const readSettings = asRecord$1(toolsSettings.read);
-		const readAllow = asStringArray(readSettings.allowedPaths);
-		const readDeny = asStringArray(readSettings.deniedPaths);
-		if (readAllow.length > 0 || readDeny.length > 0) {
-			permission.read = {};
-			for (const pattern of readAllow) permission.read[pattern] = "allow";
-			for (const pattern of readDeny) permission.read[pattern] = "deny";
-		}
-		const writeSettings = asRecord$1(toolsSettings.write);
-		const writeAllow = asStringArray(writeSettings.allowedPaths);
-		const writeDeny = asStringArray(writeSettings.deniedPaths);
-		if (writeAllow.length > 0 || writeDeny.length > 0) {
-			permission.write = {};
-			for (const pattern of writeAllow) permission.write[pattern] = "allow";
-			for (const pattern of writeDeny) permission.write[pattern] = "deny";
+		const shellRules = rulesFromArrays(asRecord$1(toolsSettings.shell), "allowedCommands", "deniedCommands");
+		if (Object.keys(shellRules).length > 0) permission.bash = shellRules;
+		for (const category of [
+			"read",
+			"write",
+			"grep",
+			"glob"
+		]) {
+			const rules = rulesFromArrays(asRecord$1(toolsSettings[category]), "allowedPaths", "deniedPaths");
+			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const allowedTools = new Set(parsed.allowedTools ?? []);
 		if (allowedTools.has("web_fetch")) permission.webfetch = { "*": "allow" };
@@ -19361,45 +20261,63 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 function buildKiroPermissionsFromRulesync({ config, logger, existing }) {
 	const nextAllowedTools = new Set(existing.allowedTools ?? []);
 	const nextToolsSettings = { ...asRecord$1(existing.toolsSettings) };
+	const pathBuckets = {};
+	const pushPath = (key, action, pattern) => {
+		const bucket = pathBuckets[key] ??= {
+			allow: [],
+			deny: []
+		};
+		(action === "allow" ? bucket.allow : bucket.deny).push(pattern);
+	};
 	const shell = {
 		allowedCommands: [],
 		deniedCommands: []
 	};
-	const read = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
-	const write = {
-		allowedPaths: [],
-		deniedPaths: []
-	};
 	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
 		if (action === "ask") {
 			logger?.warn(`Kiro permissions do not support "ask". Skipping ${category}:${pattern}`);
 			continue;
 		}
 		if (category === "bash") (action === "allow" ? shell.allowedCommands : shell.deniedCommands).push(pattern);
-		else if (category === "read") (action === "allow" ? read.allowedPaths : read.deniedPaths).push(pattern);
-		else if (category === "edit" || category === "write") (action === "allow" ? write.allowedPaths : write.deniedPaths).push(pattern);
-		else if (category === "webfetch" || category === "websearch") {
-			if (pattern !== "*") {
-				logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
-				continue;
-			}
-			const toolName = category === "webfetch" ? "web_fetch" : "web_search";
-			if (action === "allow") nextAllowedTools.add(toolName);
-			else nextAllowedTools.delete(toolName);
-		} else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
+		else if (category === "read" || category === "grep" || category === "glob") pushPath(category, action, pattern);
+		else if (category === "edit" || category === "write") pushPath("write", action, pattern);
+		else if (category === "webfetch" || category === "websearch") applyKiroWebPermission({
+			category,
+			pattern,
+			action,
+			nextAllowedTools,
+			logger
+		});
+		else logger?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
 	}
 	nextToolsSettings.shell = shell;
-	nextToolsSettings.read = read;
-	nextToolsSettings.write = write;
+	nextToolsSettings.read = pathTable(pathBuckets.read);
+	nextToolsSettings.write = pathTable(pathBuckets.write);
+	for (const key of ["grep", "glob"]) {
+		const bucket = pathBuckets[key];
+		if (bucket && (bucket.allow.length > 0 || bucket.deny.length > 0)) nextToolsSettings[key] = pathTable(bucket);
+	}
 	return {
 		...existing,
 		allowedTools: [...nextAllowedTools].toSorted(),
 		toolsSettings: nextToolsSettings
 	};
 }
+function pathTable(bucket) {
+	return {
+		allowedPaths: bucket?.allow ?? [],
+		deniedPaths: bucket?.deny ?? []
+	};
+}
+function applyKiroWebPermission({ category, pattern, action, nextAllowedTools, logger }) {
+	if (pattern !== "*") {
+		logger?.warn(`Kiro ${category} supports only wildcard (*) via allowedTools. Skipping rule: ${pattern}`);
+		return;
+	}
+	const toolName = category === "webfetch" ? "web_fetch" : "web_search";
+	if (action === "allow") nextAllowedTools.add(toolName);
+	else nextAllowedTools.delete(toolName);
+}
 function asRecord$1(value) {
 	const result = UnknownRecordSchema.safeParse(value);
 	return result.success ? result.data : {};
@@ -19407,6 +20325,17 @@ function asRecord$1(value) {
 function asStringArray(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
+/**
+* Build a canonical `{ pattern: action }` map from a Kiro tool settings record's
+* allow/deny string arrays (e.g. `allowedPaths`/`deniedPaths` or
+* `allowedCommands`/`deniedCommands`).
+*/
+function rulesFromArrays(settings, allowKey, denyKey) {
+	const rules = {};
+	for (const pattern of asStringArray(settings[allowKey])) rules[pattern] = "allow";
+	for (const pattern of asStringArray(settings[denyKey])) rules[pattern] = "deny";
+	return rules;
+}
 //#endregion
 //#region src/features/permissions/opencode-permissions.ts
 const OpencodePermissionSchema = zod_mini.z.union([zod_mini.z.enum([
@@ -19418,6 +20347,28 @@ const OpencodePermissionSchema = zod_mini.z.union([zod_mini.z.enum([
 	"ask",
 	"deny"
 ]))]);
+/**
+* Canonical rulesync permission categories that carry a cross-tool meaning (see
+* the "Supported tool categories" list in `docs/reference/file-formats.md`).
+* On import, any OpenCode category outside this set — plus MCP tool names — is
+* treated as OpenCode-only and routed into the `opencode` override block so a
+* subsequent `rulesync generate` does not leak it into other tools' configs.
+*/
+const CANONICAL_PERMISSION_CATEGORIES = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"webfetch",
+	"websearch",
+	"grep",
+	"glob",
+	"notebookedit",
+	"agent"
+]);
+function isSharedPermissionCategory(category) {
+	return category === "*" || CANONICAL_PERMISSION_CATEGORIES.has(category) || category.startsWith("mcp__");
+}
 const OpencodePermissionsConfigSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.enum([
 	"allow",
 	"ask",
@@ -19479,9 +20430,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
+		const parsed = (0, jsonc_parser.parse)(fileContent ?? "{}");
+		const rulesyncJson = rulesyncPermissions.getJson();
+		const overridePermission = rulesyncJson.opencode?.permission ?? {};
 		const nextJson = {
-			...(0, jsonc_parser.parse)(fileContent ?? "{}"),
-			permission: rulesyncPermissions.getJson().permission
+			...parsed,
+			permission: {
+				...rulesyncJson.permission,
+				...overridePermission
+			}
 		};
 		return new OpencodePermissions({
 			outputRoot,
@@ -19492,8 +20449,20 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 		});
 	}
 	toRulesyncPermissions() {
-		const permission = this.normalizePermission(this.json.permission);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const rawPermission = this.json.permission;
+		if (rawPermission === void 0 || typeof rawPermission === "string") {
+			const permission = this.normalizePermission(rawPermission);
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		}
+		const shared = {};
+		const overrideOnly = {};
+		for (const [category, value] of Object.entries(rawPermission)) if (isSharedPermissionCategory(category)) shared[category] = typeof value === "string" ? { "*": value } : value;
+		else overrideOnly[category] = value;
+		const json = Object.keys(overrideOnly).length > 0 ? {
+			permission: shared,
+			opencode: { permission: overrideOnly }
+		} : { permission: shared };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -19523,10 +20492,15 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			validate: false
 		});
 	}
+	/**
+	* Normalize the uniform/undefined forms of OpenCode's `permission` field into
+	* the canonical rulesync shape. The object form is handled directly in
+	* `toRulesyncPermissions` (it needs to split shared vs OpenCode-only
+	* categories), so this only covers the two remaining cases.
+	*/
 	normalizePermission(permission) {
 		if (!permission) return {};
-		if (typeof permission === "string") return { "*": { "*": permission } };
-		return Object.fromEntries(Object.entries(permission).map(([tool, value]) => [tool, typeof value === "string" ? { "*": value } : value]));
+		return { "*": { "*": permission } };
 	}
 };
 //#endregion
@@ -19600,6 +20574,24 @@ function buildQwenPermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
 	return `${toolName}(${pattern})`;
 }
+const QWEN_OVERRIDE_TOOLS_KEYS = [
+	"approvalMode",
+	"autoAccept",
+	"sandbox",
+	"sandboxImage",
+	"disabled"
+];
+const QWEN_OVERRIDE_SECURITY_KEYS = ["folderTrust"];
+function asPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+/** Pick the override-managed keys out of a settings group into a fresh record. */
+function pickQwenOverrideKeys(group, keys) {
+	const source = asPlainRecord(group);
+	const picked = {};
+	for (const key of keys) if (source[key] !== void 0) picked[key] = source[key];
+	return picked;
+}
 var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -19665,6 +20657,15 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			...settings,
 			permissions: mergedPermissions
 		};
+		const override = config.qwencode;
+		if (override?.tools !== void 0) merged.tools = {
+			...asPlainRecord(settings.tools),
+			...asPlainRecord(override.tools)
+		};
+		if (override?.security !== void 0) merged.security = {
+			...asPlainRecord(settings.security),
+			...asPlainRecord(override.security)
+		};
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new QwencodePermissions({
 			outputRoot,
@@ -19690,7 +20691,14 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const overrideTools = pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS);
+		const overrideSecurity = pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS);
+		const qwencodeOverride = {};
+		if (Object.keys(overrideTools).length > 0) qwencodeOverride.tools = overrideTools;
+		if (Object.keys(overrideSecurity).length > 0) qwencodeOverride.security = overrideSecurity;
+		const result = { ...config };
+		if (Object.keys(qwencodeOverride).length > 0) result.qwencode = qwencodeOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -19851,6 +20859,16 @@ function toPermissionsTable(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return { ...value };
 }
+const REASONIX_OVERRIDE_AGENT_KEYS = ["plan_mode_allowed_tools", "plan_mode_read_only_commands"];
+function asReasonixRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function pickReasonixKeys(source, keys) {
+	const record = asReasonixRecord(source);
+	const picked = {};
+	for (const key of keys) if (record[key] !== void 0) picked[key] = record[key];
+	return picked;
+}
 var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	toml;
 	constructor(params) {
@@ -19912,6 +20930,15 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			...parsed,
 			permissions: mergedPermissions
 		};
+		const override = config.reasonix;
+		if (override?.sandbox !== void 0) merged.sandbox = {
+			...asReasonixRecord(parsed.sandbox),
+			...asReasonixRecord(override.sandbox)
+		};
+		if (override?.agent !== void 0) merged.agent = {
+			...asReasonixRecord(parsed.agent),
+			...asReasonixRecord(override.agent)
+		};
 		const fileContent = smol_toml.stringify(merged);
 		return new ReasonixPermissions({
 			outputRoot,
@@ -19928,7 +20955,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			ask: toStringArray$1(permissions.ask),
 			deny: toStringArray$1(permissions.deny)
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const sandbox = asReasonixRecord(this.toml.sandbox);
+		const agentPlanMode = pickReasonixKeys(this.toml.agent, REASONIX_OVERRIDE_AGENT_KEYS);
+		const reasonixOverride = {};
+		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
+		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
+		const result = { ...config };
+		if (Object.keys(reasonixOverride).length > 0) result.reasonix = reasonixOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -20238,6 +21272,8 @@ function isPermissionAction(value) {
 const TAKT_PROVIDER_KEY = "provider";
 const TAKT_PROVIDER_PROFILES_KEY = "provider_profiles";
 const TAKT_DEFAULT_PERMISSION_MODE_KEY = "default_permission_mode";
+const TAKT_STEP_PERMISSION_OVERRIDES_KEY = "step_permission_overrides";
+const TAKT_PROVIDER_OPTIONS_KEY = "provider_options";
 const TAKT_DEFAULT_PROVIDER = "claude";
 const CATCH_ALL_PATTERN = "*";
 /**
@@ -20267,10 +21303,16 @@ const CATCH_ALL_PATTERN = "*";
 *     `bash: { "*": "deny" }`. These round-trip the generate mapping.
 *
 * Both project and global scope are supported. The shared config is merged in
-* place: only `provider_profiles.<provider>.default_permission_mode` is set;
-* the active provider's other keys (e.g. `step_permission_overrides`), every
-* other provider profile, and all other top-level keys are preserved. The file
-* is never deleted.
+* place: `provider_profiles.<provider>.default_permission_mode` is set from the
+* derived mode; every other provider profile and all other top-level keys are
+* preserved. The file is never deleted.
+*
+* Two Takt-specific surfaces with no canonical category round-trip through the
+* `takt` override (see `TaktPermissionsOverrideSchema`):
+* `step_permission_overrides` (a per-step mode map inside the active provider
+* profile, layered on top of `default_permission_mode`) and `provider_options`
+* (a top-level per-provider sandbox/network table). Both are authored on
+* generate and re-extracted on import.
 */
 var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	constructor(params) {
@@ -20302,37 +21344,62 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
 		const paths = TaktPermissions.getSettablePaths({ global });
-		const config = parseTaktConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath);
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: existingContent,
+			filePath,
+			invalidRootPolicy: "error"
+		});
+		const rulesyncJson = rulesyncPermissions.getJson();
 		const provider = resolveActiveProvider(config);
-		const mode = deriveTaktPermissionMode(rulesyncPermissions.getJson());
-		const existingProfiles = isPlainObject(config[TAKT_PROVIDER_PROFILES_KEY]) ? config[TAKT_PROVIDER_PROFILES_KEY] : {};
-		const existingProfile = isPlainObject(existingProfiles[provider]) ? existingProfiles[provider] : {};
-		const merged = {
-			...config,
-			[TAKT_PROVIDER_PROFILES_KEY]: {
-				...existingProfiles,
-				[provider]: {
-					...existingProfile,
-					[TAKT_DEFAULT_PERMISSION_MODE_KEY]: mode
-				}
-			}
+		const mode = deriveTaktPermissionMode(rulesyncJson);
+		const override = isPlainObject(rulesyncJson.takt) ? rulesyncJson.takt : void 0;
+		const stepOverrides = isPlainObject(override?.[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? override[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
+		const overrideProviderOptions = isPlainObject(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const patch = {
+			[TAKT_PROVIDER_PROFILES_KEY]: { [provider]: {
+				[TAKT_DEFAULT_PERMISSION_MODE_KEY]: mode,
+				...stepOverrides !== void 0 && { [TAKT_STEP_PERMISSION_OVERRIDES_KEY]: stepOverrides }
+			} },
+			...overrideProviderOptions !== void 0 && { [TAKT_PROVIDER_OPTIONS_KEY]: overrideProviderOptions }
 		};
 		return new TaktPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: (0, js_yaml.dump)(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: TAKT_CONFIG_SHARED_FILE_KEY,
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath
+			}),
 			validate: true,
 			global
 		});
 	}
 	toRulesyncPermissions() {
-		const config = parseTaktConfig(this.getFileContent(), this.getRelativeDirPath(), this.getRelativeFilePath());
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent(),
+			filePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath()),
+			invalidRootPolicy: "error"
+		});
 		const provider = resolveActiveProvider(config);
 		const profiles = isPlainObject(config[TAKT_PROVIDER_PROFILES_KEY]) ? config[TAKT_PROVIDER_PROFILES_KEY] : {};
-		const mode = (isPlainObject(profiles[provider]) ? profiles[provider] : {})[TAKT_DEFAULT_PERMISSION_MODE_KEY];
+		const profile = isPlainObject(profiles[provider]) ? profiles[provider] : {};
+		const mode = profile[TAKT_DEFAULT_PERMISSION_MODE_KEY];
 		const rulesyncConfig = taktModeToRulesyncConfig(mode);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+		const stepOverrides = isPlainObject(profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
+		const providerOptions = isPlainObject(config[TAKT_PROVIDER_OPTIONS_KEY]) ? config[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const taktOverride = {};
+		if (stepOverrides && Object.keys(stepOverrides).length > 0) taktOverride[TAKT_STEP_PERMISSION_OVERRIDES_KEY] = stepOverrides;
+		if (providerOptions && Object.keys(providerOptions).length > 0) taktOverride[TAKT_PROVIDER_OPTIONS_KEY] = providerOptions;
+		const result = { ...rulesyncConfig };
+		if (Object.keys(taktOverride).length > 0) result.takt = taktOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -20492,6 +21559,7 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			if (deny.size > 0) nextTool.denylist = [...deny].toSorted();
 			tools[vibeToolName] = nextTool;
 		}
+		applyVibeSensitivePatterns(tools, rulesyncPermissions.getJson().vibe);
 		config.tools = tools;
 		if (enabledTools.size > 0) config.enabled_tools = [...enabledTools].toSorted();
 		else delete config.enabled_tools;
@@ -20508,16 +21576,25 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 	}
 	toRulesyncPermissions() {
 		const permission = {};
+		const vibeOverridePermission = {};
 		for (const tool of toStringArray(this.toml.enabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "allow";
 		for (const tool of toStringArray(this.toml.disabled_tools)) ensurePermission(permission, toCanonicalToolName$1(tool))["*"] = "deny";
 		for (const [vibeToolName, toolConfig] of Object.entries(toVibeToolsRecord(this.toml.tools))) {
-			const rules = ensurePermission(permission, toCanonicalToolName$1(vibeToolName));
+			const category = toCanonicalToolName$1(vibeToolName);
+			const rules = ensurePermission(permission, category);
 			const action = fromVibePermission(toolConfig.permission);
 			if (action !== void 0) rules["*"] = action;
 			for (const pattern of toStringArray(toolConfig.allow ?? toolConfig.allowlist)) rules[pattern] = "allow";
 			for (const pattern of toStringArray(toolConfig.deny ?? toolConfig.denylist)) rules[pattern] = "deny";
+			const sensitivePatterns = toStringArray(toolConfig.sensitive_patterns);
+			if (sensitivePatterns.length > 0) vibeOverridePermission[category] = { sensitive_patterns: sensitivePatterns };
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
+		const json = Object.keys(vibeOverridePermission).length > 0 ? {
+			permission,
+			vibe: { permission: vibeOverridePermission }
+		} : { permission };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(json, null, 2) });
 	}
 	validate() {
 		try {
@@ -20544,6 +21621,22 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		});
 	}
 };
+/**
+* Apply the Vibe-scoped override's per-tool `sensitive_patterns` (patterns that
+* escalate to ASK even when the base permission is ALWAYS). rulesync owns this
+* list for any category the override names: a present list is set, an empty
+* one clears it. Categories not named keep whatever the existing file had.
+*/
+function applyVibeSensitivePatterns(tools, vibeOverride) {
+	for (const [category, toolOverride] of Object.entries(vibeOverride?.permission ?? {})) {
+		const vibeToolName = toVibeToolName(category);
+		const nextTool = toVibeToolConfig(tools[vibeToolName]);
+		const patterns = toStringArray(toolOverride.sensitive_patterns);
+		if (patterns.length > 0) nextTool.sensitive_patterns = [...patterns].toSorted();
+		else delete nextTool.sensitive_patterns;
+		tools[vibeToolName] = nextTool;
+	}
+}
 function parseVibeConfig(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -20588,6 +21681,11 @@ function ensurePermission(permission, category) {
 const WARP_GLOBAL_ONLY_MESSAGE = "Warp permissions are global-only; use --global to sync Warp's settings.toml";
 const ALLOWLIST_KEY = "agent_mode_command_execution_allowlist";
 const DENYLIST_KEY = "agent_mode_command_execution_denylist";
+const WARP_OVERRIDE_KEYS = [
+	"agent_mode_coding_permissions",
+	"agent_mode_coding_file_read_allowlist",
+	"agent_mode_execute_readonly_commands"
+];
 /**
 * Warp's `settings.toml` lives in a different directory per platform (Stable
 * channel). The home directory is resolved by the processor through
@@ -20623,8 +21721,16 @@ function warpSettingsDir() {
 * patterns as regexes when targeting Warp (mirrors the Zed permissions
 * adapter). Warp has no per-command "ask" list, so `ask` rules are dropped; and
 * the command lists only model shell commands, so non-`bash` categories are
-* skipped (with a warning when they carry `deny` rules). MCP allow/deny and the
-* file-read permissions are separate surfaces not modeled here.
+* skipped (with a warning when they carry `deny` rules).
+*
+* Warp's `[agents.profiles]` table also exposes file-read/read-only autonomy
+* knobs that do not fit the canonical `allow | ask | deny` per-command model:
+* `agent_mode_coding_permissions`, `agent_mode_coding_file_read_allowlist`, and
+* `agent_mode_execute_readonly_commands`. These are authored and round-tripped
+* through the `warp` override namespace (see `WarpPermissionsOverrideSchema`):
+* on **import** they are lifted from `settings.toml` into the override, and on
+* **export** they are merged back into `[agents.profiles]` (the override wins).
+* MCP allow/deny is a separate surface not modeled here.
 *
 * The `settings.toml` file holds all of Warp's settings, so the
 * `[agents.profiles]` block is merged in place and the file is never deleted.
@@ -20669,12 +21775,15 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Warp settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToWarpPermissions({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
 		const agents = isRecord(settings.agents) ? { ...settings.agents } : {};
 		const profiles = isRecord(agents.profiles) ? { ...agents.profiles } : {};
+		const override = config.warp;
+		if (isRecord(override)) Object.assign(profiles, override);
 		const mergedAllow = (0, es_toolkit.uniq)(allow.toSorted());
 		const mergedDeny = (0, es_toolkit.uniq)(deny.toSorted());
 		if (mergedAllow.length > 0) profiles[ALLOWLIST_KEY] = mergedAllow;
@@ -20705,7 +21814,11 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 			allow: isStringArray(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
 			deny: isStringArray(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const warpOverride = {};
+		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
+		const result = { ...config };
+		if (Object.keys(warpOverride).length > 0) result.warp = warpOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -24071,8 +25184,9 @@ const DevinSkillFrontmatterSchema = zod_mini.z.looseObject({
 * Represents a Devin (now Devin Desktop) skill directory.
 * Devin supports skills in both project mode under .devin/skills/
 * (preferred since the Devin Desktop rebrand; .devin/skills/ is the legacy
-* fallback the tool still reads) and global mode under ~/.codeium/windsurf/skills/
-* (unchanged by the rebrand).
+* fallback the tool still reads) and global mode under the Devin-native
+* ~/.config/devin/skills/ (consistent with Devin's global agents/rules paths;
+* the legacy channel-dependent ~/.codeium/<channel>/skills/ is no longer emitted).
 */
 var DevinSkill = class DevinSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = DevinSkill.getSettablePaths().relativeDirPath, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -24094,7 +25208,7 @@ var DevinSkill = class DevinSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global = false } = {}) {
-		if (global) return { relativeDirPath: CODEIUM_WINDSURF_SKILLS_DIR_PATH };
+		if (global) return { relativeDirPath: DEVIN_GLOBAL_SKILLS_DIR_PATH };
 		return { relativeDirPath: DEVIN_SKILLS_DIR_PATH };
 	}
 	getFrontmatter() {
@@ -27153,7 +28267,7 @@ const QwencodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	disallowedTools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	maxTurns: zod_mini.z.optional(zod_mini.z.number()),
 	color: zod_mini.z.optional(zod_mini.z.string()),
-	mcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	mcpServers: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.array(zod_mini.z.string()), zod_mini.z.record(zod_mini.z.string(), zod_mini.z.looseObject({}))])),
 	hooks: zod_mini.z.optional(zod_mini.z.unknown())
 });
 var QwencodeSubagent = class QwencodeSubagent extends ToolSubagent {
@@ -29180,14 +30294,21 @@ def register(ctx):
 `;
 }
 function getEnabledPluginConfigContent(currentContent) {
-	const config = parseHermesConfig(currentContent);
+	const config = parseSharedConfig({
+		format: "yaml",
+		fileContent: currentContent
+	});
 	const plugins = config.plugins && typeof config.plugins === "object" ? config.plugins : {};
 	const enabled = Array.isArray(plugins.enabled) ? plugins.enabled : [];
-	config.plugins = {
-		...plugins,
-		enabled: Array.from(/* @__PURE__ */ new Set([...enabled, "rulesync-subagents"]))
-	};
-	return stringifyHermesConfig(config);
+	return applySharedConfigPatch({
+		fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+		feature: "subagents",
+		existingContent: currentContent,
+		patch: { plugins: {
+			...plugins,
+			enabled: Array.from(/* @__PURE__ */ new Set([...enabled, "rulesync-subagents"]))
+		} }
+	});
 }
 function getSubagentSpec(rulesyncSubagent) {
 	const json = rulesyncSubagent.getFrontmatter();
@@ -29273,6 +30394,17 @@ var HermesagentSubagent = class HermesagentSubagent extends ToolSubagent {
 	static getSettablePaths() {
 		return { relativeDirPath: HERMESAGENT_RULESYNC_SUBAGENTS_DIR_PATH };
 	}
+	/**
+	* Beyond the subagent spec files, generation also read-modify-writes the
+	* shared `~/.hermes/config.yaml` (enabling the `rulesync-subagents` plugin),
+	* so the write must be declared for the shared-file order derivation.
+	*/
+	static getExtraSharedWritePaths() {
+		return [{
+			relativeDirPath: HERMESAGENT_GLOBAL_DIR,
+			relativeFilePath: (0, node_path.basename)(HERMESAGENT_CONFIG_FILE_PATH)
+		}];
+	}
 	static getSettablePathsForRulesyncSubagent(rulesyncSubagent) {
 		return [(0, node_path.join)(HERMESAGENT_RULESYNC_SUBAGENTS_DIR_PATH, `${subagentSlug(rulesyncSubagent.getRelativePathFromCwd())}.json`)];
 	}
@@ -31011,7 +32143,9 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 	})),
 	kiro: zod_mini.z.optional(zod_mini.z.looseObject({
 		inclusion: zod_mini.z.optional(zod_mini.z.string()),
-		fileMatchPattern: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+		fileMatchPattern: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+		name: zod_mini.z.optional(zod_mini.z.string()),
+		description: zod_mini.z.optional(zod_mini.z.string())
 	})),
 	takt: zod_mini.z.optional(zod_mini.z.looseObject({
 		name: zod_mini.z.optional(zod_mini.z.string()),
@@ -33927,7 +35061,8 @@ function toFileMatchPattern(globs) {
 *
 * Precedence:
 * 1. An explicit `kiro.inclusion` block round-trips as-is (with `fileMatchPattern`
-*    taken from the block, or derived from `globs` when omitted for `fileMatch`).
+*    taken from the block, or derived from `globs` when omitted for `fileMatch`;
+*    and with the companion `name`/`description` carried through for `auto`).
 * 2. Otherwise specific (non-wildcard) globs map to `fileMatch`, scoping the rule
 *    to matching files instead of leaving it implicitly always-on.
 * 3. Otherwise the rule stays `always` — represented by omitting the block so the
@@ -33945,6 +35080,11 @@ function deriveKiroInclusion({ kiro, globs }) {
 				fileMatchPattern
 			} : { inclusion: "fileMatch" };
 		}
+		if (kiro.inclusion === "auto") return {
+			inclusion: "auto",
+			...kiro.name !== void 0 ? { name: kiro.name } : {},
+			...kiro.description !== void 0 ? { description: kiro.description } : {}
+		};
 		return { inclusion: kiro.inclusion };
 	}
 	const fileMatchPattern = toFileMatchPattern(specificGlobs);
@@ -34016,6 +35156,8 @@ var KiroRule = class KiroRule extends ToolRule {
 		const rawPattern = frontmatter.fileMatchPattern;
 		const fileMatchPattern = Array.isArray(rawPattern) ? rawPattern.filter((p) => typeof p === "string") : typeof rawPattern === "string" ? rawPattern : void 0;
 		const globs = inclusion === "fileMatch" ? fileMatchPattern === void 0 ? [] : Array.isArray(fileMatchPattern) ? fileMatchPattern : [fileMatchPattern] : [];
+		const name = typeof frontmatter.name === "string" ? frontmatter.name : void 0;
+		const description = typeof frontmatter.description === "string" ? frontmatter.description : void 0;
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RulesyncRule.getSettablePaths().recommended.relativeDirPath,
@@ -34026,7 +35168,9 @@ var KiroRule = class KiroRule extends ToolRule {
 				globs,
 				kiro: {
 					inclusion,
-					...fileMatchPattern !== void 0 ? { fileMatchPattern } : {}
+					...fileMatchPattern !== void 0 ? { fileMatchPattern } : {},
+					...inclusion === "auto" && name !== void 0 ? { name } : {},
+					...inclusion === "auto" && description !== void 0 ? { description } : {}
 				}
 			},
 			body
@@ -36200,6 +37344,197 @@ function buildPermissionsStrategy(ctx) {
 	};
 }
 //#endregion
+//#region src/types/processor-registry.ts
+const PROCESSOR_REGISTRY = [
+	{
+		feature: "rules",
+		processor: RulesProcessor,
+		schema: RulesProcessorToolTargetSchema,
+		factory: toolRuleFactories
+	},
+	{
+		feature: "ignore",
+		processor: IgnoreProcessor,
+		schema: IgnoreProcessorToolTargetSchema,
+		factory: toolIgnoreFactories
+	},
+	{
+		feature: "mcp",
+		processor: McpProcessor,
+		schema: McpProcessorToolTargetSchema,
+		factory: toolMcpFactories
+	},
+	{
+		feature: "commands",
+		processor: CommandsProcessor,
+		schema: CommandsProcessorToolTargetSchema,
+		factory: toolCommandFactories
+	},
+	{
+		feature: "subagents",
+		processor: SubagentsProcessor,
+		schema: SubagentsProcessorToolTargetSchema,
+		factory: toolSubagentFactories
+	},
+	{
+		feature: "skills",
+		processor: SkillsProcessor,
+		schema: SkillsProcessorToolTargetSchema,
+		factory: toolSkillFactories
+	},
+	{
+		feature: "hooks",
+		processor: HooksProcessor,
+		schema: HooksProcessorToolTargetSchema,
+		factory: toolHooksFactories
+	},
+	{
+		feature: "permissions",
+		processor: PermissionsProcessor,
+		schema: PermissionsProcessorToolTargetSchema,
+		factory: toolPermissionsFactories
+	}
+];
+const getProcessorRegistryEntry = (feature) => {
+	const entry = PROCESSOR_REGISTRY.find((e) => e.feature === feature);
+	if (!entry) throw new Error(`No processor registered for feature: ${feature}`);
+	return entry;
+};
+//#endregion
+//#region src/lib/shared-file-derive.ts
+/**
+* The single declaration of the cross-feature write order for shared
+* (read-modify-write) config files: when two features write the same on-disk
+* file, the earlier one writes first and the later one merges on top, so the
+* later feature's conflict policy decides what survives (e.g. `permissions`
+* overriding `ignore`-derived `Read(...)` denies in `.claude/settings.json`).
+* The generation step graph's `dependsOn` edges are derived from this list
+* plus the registry's `getSettablePaths` declarations — adding a tool or a
+* shared path never requires touching the graph by hand.
+*/
+const SHARED_WRITE_FEATURE_ORDER = [
+	"ignore",
+	"subagents",
+	"mcp",
+	"hooks",
+	"permissions",
+	"rules"
+];
+const SHARED_WRITE_FEATURES = new Set(SHARED_WRITE_FEATURE_ORDER);
+const TARGETS_NOT_DERIVED = /* @__PURE__ */ new Set(["augmentcode-legacy", "claudecode-legacy"]);
+const sharedFileKey = (path) => {
+	const dir = path.relativeDirPath.replace(/\\/g, "/").replace(/\/$/, "");
+	const file = path.relativeFilePath.replace(/\\/g, "/");
+	return dir === "" || dir === "." ? file : `${dir}/${file}`;
+};
+const settablePathsForScope = (cls, global) => {
+	const paths = [];
+	let settable;
+	try {
+		settable = cls.getSettablePaths?.({ global });
+	} catch {
+		return paths;
+	}
+	if (settable?.relativeFilePath) paths.push({
+		relativeDirPath: settable.relativeDirPath ?? ".",
+		relativeFilePath: settable.relativeFilePath
+	});
+	if (settable?.root) {
+		paths.push(settable.root);
+		for (const alt of settable.alternativeRoots ?? []) paths.push(alt);
+	}
+	for (const path of cls.getExtraSharedWritePaths?.({ global }) ?? []) if (path.relativeFilePath) paths.push(path);
+	return paths;
+};
+const collectFactoryPaths = (factory) => [...settablePathsForScope(factory.class, false), ...settablePathsForScope(factory.class, true)];
+/**
+* Derive, from the processor registry, every on-disk file that two or more
+* features read-modify-write. Source of truth the generation step graph's
+* `writesSharedFile` declarations must match.
+*/
+const deriveSharedFileWriters = () => {
+	const byKey = /* @__PURE__ */ new Map();
+	const pathByKey = /* @__PURE__ */ new Map();
+	for (const entry of PROCESSOR_REGISTRY) {
+		if (!SHARED_WRITE_FEATURES.has(entry.feature)) continue;
+		const factories = entry.factory;
+		for (const [tool, factory] of factories) {
+			if (TARGETS_NOT_DERIVED.has(tool)) continue;
+			for (const path of collectFactoryPaths(factory)) {
+				const key = sharedFileKey(path);
+				if (!pathByKey.has(key)) pathByKey.set(key, path);
+				let features = byKey.get(key);
+				if (!features) {
+					features = /* @__PURE__ */ new Map();
+					byKey.set(key, features);
+				}
+				let tools = features.get(entry.feature);
+				if (!tools) {
+					tools = /* @__PURE__ */ new Set();
+					features.set(entry.feature, tools);
+				}
+				tools.add(tool);
+			}
+		}
+	}
+	const writers = [];
+	for (const [key, features] of byKey) {
+		if (features.size < 2) continue;
+		const path = pathByKey.get(key);
+		const toolsByFeature = /* @__PURE__ */ new Map();
+		for (const [feature, tools] of features) toolsByFeature.set(feature, [...tools].toSorted());
+		writers.push({
+			key,
+			relativeDirPath: path.relativeDirPath,
+			relativeFilePath: path.relativeFilePath,
+			features: [...features.keys()].toSorted(),
+			toolsByFeature
+		});
+	}
+	return writers.toSorted((a, b) => a.key.localeCompare(b.key));
+};
+/**
+* Derive, per shared-write feature, the shared files it writes and the
+* `dependsOn` edges that fix a safe write order: for every shared file, each
+* writer depends on all writers that precede it in
+* {@link SHARED_WRITE_FEATURE_ORDER}. This is the source the generation step
+* graph consumes, so registry changes (a new tool, a new settable path)
+* propagate into the execution order without a hand-maintained declaration.
+*
+* @throws Error if a feature writes a shared file but has no position in
+*   `SHARED_WRITE_FEATURE_ORDER` — ordering it is a deliberate decision about
+*   whose merge policy wins, so it must be made explicitly there.
+*/
+const deriveSharedWriteSteps = () => {
+	const orderIndex = new Map(SHARED_WRITE_FEATURE_ORDER.map((feature, index) => [feature, index]));
+	const filesByFeature = /* @__PURE__ */ new Map();
+	const depsByFeature = /* @__PURE__ */ new Map();
+	for (const writer of deriveSharedFileWriters()) {
+		for (const feature of writer.features) if (!orderIndex.has(feature)) throw new Error(`Feature '${feature}' writes the shared file '${writer.key}' but has no position in SHARED_WRITE_FEATURE_ORDER. Decide where its writes merge relative to the other features and add it to the order.`);
+		const ordered = [...writer.features].toSorted((a, b) => orderIndex.get(a) - orderIndex.get(b));
+		for (const [position, feature] of ordered.entries()) {
+			let files = filesByFeature.get(feature);
+			if (!files) {
+				files = /* @__PURE__ */ new Set();
+				filesByFeature.set(feature, files);
+			}
+			files.add(writer.key);
+			let deps = depsByFeature.get(feature);
+			if (!deps) {
+				deps = /* @__PURE__ */ new Set();
+				depsByFeature.set(feature, deps);
+			}
+			for (const earlier of ordered.slice(0, position)) deps.add(earlier);
+		}
+	}
+	const steps = /* @__PURE__ */ new Map();
+	for (const [feature, files] of filesByFeature) steps.set(feature, {
+		writesSharedFile: [...files].toSorted(),
+		dependsOn: [...depsByFeature.get(feature) ?? []].toSorted((a, b) => orderIndex.get(a) - orderIndex.get(b))
+	});
+	return steps;
+};
+//#endregion
 //#region src/lib/generate.ts
 async function processFeatureGeneration(params) {
 	const { config, processor, toolFiles, skipFilePaths } = params;
@@ -36349,98 +37684,53 @@ function resolveExecutionOrder(steps) {
 	if (ordered.length !== steps.length) throw new Error("Generation steps contain a cyclic 'dependsOn' dependency.");
 	return ordered;
 }
+const SHARED_WRITE_STEPS = deriveSharedWriteSteps();
+const sharedWriteMeta = (id) => {
+	const step = SHARED_WRITE_STEPS.get(id);
+	return step ? {
+		writesSharedFile: step.writesSharedFile,
+		dependsOn: step.dependsOn
+	} : {};
+};
 /**
 * The static shape of the generation step graph: which steps write which shared
 * (read-modify-write) config files, and the `dependsOn` edges that fix a safe order
-* for those writers. Exported (separately from the `run` closures, which need a
-* live `config`/`logger`) so `resolveExecutionOrder`'s ordering guarantee can be
-* tested directly against the real graph rather than a hand-copied one. Readonly
-* so a consumer can't mutate this module-level singleton and affect every
-* subsequent `generate()` call in the process.
+* for those writers. Both are derived from the processor registry's settable
+* paths and `SHARED_WRITE_FEATURE_ORDER` (see `shared-file-derive.ts`), so a new
+* tool or shared path never requires editing this graph. Exported (separately
+* from the `run` closures, which need a live `config`/`logger`) so
+* `resolveExecutionOrder`'s ordering guarantee can be tested directly against
+* the real graph rather than a hand-copied one. Readonly so a consumer can't
+* mutate this module-level singleton and affect every subsequent `generate()`
+* call in the process.
 */
 const GENERATION_STEP_GRAPH = [
 	{
 		id: "ignore",
-		writesSharedFile: [".claude/settings.json", ".zed/settings.json"]
+		...sharedWriteMeta("ignore")
 	},
 	{
 		id: "mcp",
-		writesSharedFile: [
-			".amp/settings.json",
-			".augment/settings.json",
-			".codex/config.toml",
-			".config/amp/settings.json",
-			".config/devin/config.json",
-			".config/opencode/opencode.json",
-			".config/zed/settings.json",
-			".devin/config.json",
-			".grok/config.toml",
-			".hermes/config.yaml",
-			".qwen/settings.json",
-			".reasonix/config.toml",
-			".takt/config.yaml",
-			".vibe/config.toml",
-			".zed/settings.json",
-			"kilo.json",
-			"opencode.json",
-			"reasonix.toml"
-		],
-		dependsOn: ["ignore"]
+		...sharedWriteMeta("mcp")
 	},
 	{ id: "commands" },
-	{ id: "subagents" },
+	{
+		id: "subagents",
+		...sharedWriteMeta("subagents")
+	},
 	{ id: "skills" },
 	{
 		id: "hooks",
-		writesSharedFile: [
-			".augment/settings.json",
-			".claude/settings.json",
-			".codex/config.toml",
-			".config/devin/config.json",
-			".hermes/config.yaml",
-			".kiro/agents/default.json",
-			".qwen/settings.json",
-			".vibe/config.toml"
-		],
-		dependsOn: ["ignore", "mcp"]
+		...sharedWriteMeta("hooks")
 	},
 	{
 		id: "permissions",
-		writesSharedFile: [
-			".amp/settings.json",
-			".augment/settings.json",
-			".claude/settings.json",
-			".codex/config.toml",
-			".config/amp/settings.json",
-			".config/devin/config.json",
-			".config/opencode/opencode.json",
-			".config/zed/settings.json",
-			".devin/config.json",
-			".grok/config.toml",
-			".hermes/config.yaml",
-			".kiro/agents/default.json",
-			".qwen/settings.json",
-			".reasonix/config.toml",
-			".takt/config.yaml",
-			".vibe/config.toml",
-			".zed/settings.json",
-			"opencode.json",
-			"reasonix.toml"
-		],
-		dependsOn: [
-			"ignore",
-			"hooks",
-			"mcp"
-		]
+		...sharedWriteMeta("permissions")
 	},
 	{
 		id: "rules",
-		writesSharedFile: ["kilo.json", "opencode.json"],
-		dependsOn: [
-			"mcp",
-			"skills",
-			"permissions"
-		]
+		...sharedWriteMeta("rules"),
+		dependsOn: [...sharedWriteMeta("rules").dependsOn ?? [], "skills"]
 	}
 ];
 /**
@@ -37198,12 +38488,6 @@ Object.defineProperty(exports, "CommandsProcessor", {
 		return CommandsProcessor;
 	}
 });
-Object.defineProperty(exports, "CommandsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return CommandsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "ConfigResolver", {
 	enumerable: true,
 	get: function() {
@@ -37228,24 +38512,12 @@ Object.defineProperty(exports, "HooksProcessor", {
 		return HooksProcessor;
 	}
 });
-Object.defineProperty(exports, "HooksProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return HooksProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "IgnoreProcessor", {
 	enumerable: true,
 	get: function() {
 		return IgnoreProcessor;
 	}
 });
-Object.defineProperty(exports, "IgnoreProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return IgnoreProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "JsonLogger", {
 	enumerable: true,
 	get: function() {
@@ -37264,24 +38536,6 @@ Object.defineProperty(exports, "McpProcessor", {
 		return McpProcessor;
 	}
 });
-Object.defineProperty(exports, "McpProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return McpProcessorToolTargetSchema;
-	}
-});
-Object.defineProperty(exports, "PermissionsProcessor", {
-	enumerable: true,
-	get: function() {
-		return PermissionsProcessor;
-	}
-});
-Object.defineProperty(exports, "PermissionsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return PermissionsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "RULESYNC_AIIGNORE_FILE_NAME", {
 	enumerable: true,
 	get: function() {
@@ -37414,12 +38668,6 @@ Object.defineProperty(exports, "RulesProcessor", {
 		return RulesProcessor;
 	}
 });
-Object.defineProperty(exports, "RulesProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return RulesProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "RulesyncCommand", {
 	enumerable: true,
 	get: function() {
@@ -37504,24 +38752,12 @@ Object.defineProperty(exports, "SkillsProcessor", {
 		return SkillsProcessor;
 	}
 });
-Object.defineProperty(exports, "SkillsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return SkillsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "SubagentsProcessor", {
 	enumerable: true,
 	get: function() {
 		return SubagentsProcessor;
 	}
 });
-Object.defineProperty(exports, "SubagentsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return SubagentsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "ToolTargetSchema", {
 	enumerable: true,
 	get: function() {
@@ -37618,6 +38854,12 @@ Object.defineProperty(exports, "getLocalSkillDirNames", {
 		return getLocalSkillDirNames;
 	}
 });
+Object.defineProperty(exports, "getProcessorRegistryEntry", {
+	enumerable: true,
+	get: function() {
+		return getProcessorRegistryEntry;
+	}
+});
 Object.defineProperty(exports, "importFromTool", {
 	enumerable: true,
 	get: function() {
@@ -37672,54 +38914,6 @@ Object.defineProperty(exports, "toPosixPath", {
 		return toPosixPath;
 	}
 });
-Object.defineProperty(exports, "toolCommandFactories", {
-	enumerable: true,
-	get: function() {
-		return toolCommandFactories;
-	}
-});
-Object.defineProperty(exports, "toolHooksFactories", {
-	enumerable: true,
-	get: function() {
-		return toolHooksFactories;
-	}
-});
-Object.defineProperty(exports, "toolIgnoreFactories", {
-	enumerable: true,
-	get: function() {
-		return toolIgnoreFactories;
-	}
-});
-Object.defineProperty(exports, "toolMcpFactories", {
-	enumerable: true,
-	get: function() {
-		return toolMcpFactories;
-	}
-});
-Object.defineProperty(exports, "toolPermissionsFactories", {
-	enumerable: true,
-	get: function() {
-		return toolPermissionsFactories;
-	}
-});
-Object.defineProperty(exports, "toolRuleFactories", {
-	enumerable: true,
-	get: function() {
-		return toolRuleFactories;
-	}
-});
-Object.defineProperty(exports, "toolSkillFactories", {
-	enumerable: true,
-	get: function() {
-		return toolSkillFactories;
-	}
-});
-Object.defineProperty(exports, "toolSubagentFactories", {
-	enumerable: true,
-	get: function() {
-		return toolSubagentFactories;
-	}
-});
 Object.defineProperty(exports, "writeFileContent", {
 	enumerable: true,
 	get: function() {