rulesync 9.3.0 → 9.4.0

package/dist/{import-CE3Rx3Wt.cjs → import-DVGMvuhx.cjs}

@@ -114,22 +114,22 @@ function formatError(error) {
 }
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$248 } = node_path.posix;
+const { join: join$247 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "rules");
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "commands");
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "subagents");
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "rules");
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "commands");
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "subagents");
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$248(RULESYNC_RELATIVE_DIR_PATH, "skills");
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$248(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$247(RULESYNC_RELATIVE_DIR_PATH, "skills");
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$247(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_MCP_FILE_NAME = "mcp.json";
 const RULESYNC_HOOKS_FILE_NAME = "hooks.json";
@@ -3919,6 +3919,297 @@ const OPENCODE_JSON_FILE_NAME = "opencode.json";
 const OPENCODE_RULE_FILE_NAME = "AGENTS.md";
 const OPENCODE_HOOKS_FILE_NAME = "rulesync-hooks.js";
 //#endregion
+//#region src/constants/takt-paths.ts
+const TAKT_DIR = ".takt";
+const TAKT_FACETS_SUBDIR = "facets";
+const TAKT_FACETS_DIR_PATH = (0, node_path.join)(TAKT_DIR, TAKT_FACETS_SUBDIR);
+const TAKT_RULES_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "policies");
+const TAKT_COMMANDS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "instructions");
+const TAKT_SKILLS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "knowledge");
+const TAKT_SUBAGENTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "personas");
+const TAKT_OUTPUT_CONTRACTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "output-contracts");
+const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
+/**
+* Takt's shared config file. Lives at `.takt/config.yaml` (project) and
+* `~/.takt/config.yaml` (global); it holds the active provider, provider
+* profiles (including permission modes), and other Takt settings.
+* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+const TAKT_CONFIG_FILE_NAME = "config.yaml";
+/**
+* Top-level key in Takt's `config.yaml` holding the workflow MCP transport
+* allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
+* transport must be explicitly enabled here before any workflow-defined MCP
+* server using it is permitted to run.
+* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+const TAKT_WORKFLOW_MCP_SERVERS_KEY = "workflow_mcp_servers";
+//#endregion
+//#region src/utils/prototype-pollution.ts
+/**
+* Keys that, if walked into when constructing or merging objects from
+* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
+* chain) and propagate state to every other object in the runtime. Any code
+* that copies arbitrary user-supplied keys into a fresh object — frontmatter
+* parsing, MCP config conversion, settings round-trip — should skip these.
+*/
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPrototypePollutionKey(key) {
+	return PROTOTYPE_POLLUTION_KEYS.has(key);
+}
+/**
+* Returns a shallow copy of a record's own entries with every
+* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
+*
+* Use when copying a nested, user-supplied string map — an MCP server's `env`
+* or `headers` table — into freshly generated config. Carrying such a map by
+* reference, or re-assigning its keys via bracket notation, would let a literal
+* `__proto__` key ride along (and re-assigning it would mutate the target's
+* prototype). Walking the entries through this helper severs that path while
+* preserving every legitimate key.
+*/
+function omitPrototypePollutionKeys(record) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+//#endregion
+//#region src/features/shared/shared-config-gateway.ts
+function sanitizeSharedConfigValue(value) {
+	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
+	if (!isPlainObject(value)) return value;
+	const result = {};
+	for (const [key, nested] of Object.entries(omitPrototypePollutionKeys(value))) result[key] = sanitizeSharedConfigValue(nested);
+	return result;
+}
+/**
+* Parse a shared config file into a plain document: an empty/whitespace file
+* is `{}`, prototype-pollution keys are dropped recursively, and a non-mapping
+* root follows `invalidRootPolicy`. Syntax errors are wrapped with the file
+* path when one is given.
+*/
+function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy = "coerce-empty" }) {
+	if (fileContent.trim() === "") return {};
+	const at = filePath === void 0 ? "" : ` at ${filePath}`;
+	let parsed;
+	try {
+		if (format === "yaml") parsed = (0, js_yaml.load)(fileContent);
+		else if (format === "json") parsed = JSON.parse(fileContent);
+		else parsed = (0, jsonc_parser.parse)(fileContent);
+	} catch (error) {
+		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
+	}
+	if (parsed === void 0 || parsed === null) return {};
+	if (!isPlainObject(parsed)) {
+		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
+		return {};
+	}
+	return sanitizeSharedConfigValue(parsed);
+}
+/**
+* Serialize a shared config document. YAML output always ends with exactly one
+* newline; JSON output matches the 2-space `JSON.stringify` shape the JSON
+* writers have always emitted (no trailing newline).
+*/
+function stringifySharedConfig({ format, document }) {
+	if (format === "yaml") return (0, js_yaml.dump)(document, {
+		noRefs: true,
+		sortKeys: false
+	}).trimEnd() + "\n";
+	return JSON.stringify(document, null, 2);
+}
+/**
+* Shallow merge: every top-level key in `patch` replaces the base key
+* wholesale; all other base keys are preserved. The policy for a feature that
+* owns a fixed set of top-level keys.
+*/
+function mergeSharedConfigShallow({ base, patch }) {
+	return {
+		...base,
+		...sanitizeSharedConfigValue(patch)
+	};
+}
+/**
+* Deep merge (`patch` wins): nested plain objects are merged key-by-key; every
+* other value (arrays, scalars) is replaced wholesale. The policy for a
+* feature whose contribution interleaves with user-authored siblings at any
+* depth (e.g. permissions overlays onto `approvals`/`security` structures, or
+* per-provider option tables) — nested sibling keys are preserved by
+* construction instead of by per-tool re-implementation. Prototype-pollution
+* keys are dropped.
+*/
+function mergeSharedConfigDeep({ base, patch }) {
+	const result = { ...base };
+	for (const [key, patchValue] of Object.entries(patch)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const baseValue = result[key];
+		if (isPlainObject(baseValue) && isPlainObject(patchValue)) result[key] = mergeSharedConfigDeep({
+			base: baseValue,
+			patch: patchValue
+		});
+		else result[key] = sanitizeSharedConfigValue(patchValue);
+	}
+	return result;
+}
+const CLAUDE_SETTINGS_SHARED_FILE_KEY = ".claude/settings.json";
+const HERMES_CONFIG_SHARED_FILE_KEY = ".hermes/config.yaml";
+const TAKT_CONFIG_SHARED_FILE_KEY = ".takt/config.yaml";
+/**
+* Who owns what in each gateway-managed shared config file, and which policy
+* resolves conflicts. Keys are `dir/file` tokens matching
+* `deriveSharedFileWriters()`; a test keeps each entry's feature set in
+* lock-step with the writers derived from the processor registry, so an
+* undeclared writer fails CI instead of merging by accident.
+*/
+const SHARED_CONFIG_OWNERSHIP = {
+	[CLAUDE_SETTINGS_SHARED_FILE_KEY]: {
+		format: "json",
+		features: {
+			ignore: {
+				kind: "custom",
+				policyFunction: "applyIgnoreReadDenies"
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "custom",
+				policyFunction: "applyPermissions"
+			}
+		}
+	},
+	[HERMES_CONFIG_SHARED_FILE_KEY]: {
+		format: "yaml",
+		features: {
+			subagents: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["plugins"]
+			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp_servers"]
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "deep-merge",
+				replaceKeys: ["permissions"]
+			}
+		}
+	},
+	[TAKT_CONFIG_SHARED_FILE_KEY]: {
+		format: "yaml",
+		invalidRootPolicy: "error",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: [TAKT_WORKFLOW_MCP_SERVERS_KEY]
+			},
+			permissions: { kind: "deep-merge" }
+		}
+	}
+};
+/**
+* Execute a feature's declared write to a gateway-managed shared file: parse
+* the existing content, merge the patch under the feature's declared policy,
+* and serialize. Throws when the file or feature is undeclared, when a
+* `replace-owned-keys` patch strays outside its owned keys, or when the
+* feature's policy is `custom` (those calls go to the named policy function
+* instead).
+*/
+function applySharedConfigPatch({ fileKey, feature, existingContent, patch, filePath }) {
+	const declaration = SHARED_CONFIG_OWNERSHIP[fileKey];
+	if (!declaration) throw new Error(`Shared config file '${fileKey}' has no SHARED_CONFIG_OWNERSHIP declaration; declare its writers and policies before writing it through the gateway.`);
+	const policy = declaration.features[feature];
+	if (!policy) throw new Error(`Feature '${feature}' declares no ownership of '${fileKey}'; add it to SHARED_CONFIG_OWNERSHIP before writing.`);
+	if (policy.kind === "custom") throw new Error(`Feature '${feature}' writes '${fileKey}' through its dedicated policy function '${policy.policyFunction}' in shared-config-gateway.ts, not applySharedConfigPatch.`);
+	const base = parseSharedConfig({
+		format: declaration.format,
+		fileContent: existingContent,
+		filePath,
+		...declaration.invalidRootPolicy !== void 0 && { invalidRootPolicy: declaration.invalidRootPolicy }
+	});
+	if (policy.kind === "replace-owned-keys") {
+		const unowned = Object.keys(patch).filter((key) => !policy.ownedKeys.includes(key));
+		if (unowned.length > 0) throw new Error(`Feature '${feature}' tried to write undeclared keys [${unowned.join(", ")}] to '${fileKey}'; extend its ownedKeys declaration if that ownership is intended.`);
+		return stringifySharedConfig({
+			format: declaration.format,
+			document: mergeSharedConfigShallow({
+				base,
+				patch
+			})
+		});
+	}
+	const merged = mergeSharedConfigDeep({
+		base,
+		patch
+	});
+	for (const key of policy.replaceKeys ?? []) if (patch[key] !== void 0) merged[key] = sanitizeSharedConfigValue(patch[key]);
+	return stringifySharedConfig({
+		format: declaration.format,
+		document: merged
+	});
+}
+const READ_TOOL_NAME = "Read";
+const isReadDenyEntry = (entry) => entry.startsWith(`${READ_TOOL_NAME}(`) && entry.endsWith(")");
+const buildReadDenyEntry = (pattern) => `${READ_TOOL_NAME}(${pattern})`;
+const parsePermissionsBlock = (settings) => {
+	const permissions = settings.permissions ?? {};
+	return {
+		allow: permissions.allow ?? [],
+		ask: permissions.ask ?? [],
+		deny: permissions.deny ?? []
+	};
+};
+const withPermissions = (settings, next) => {
+	const permissions = { ...settings.permissions };
+	const assign = (key, values) => {
+		if (values.length > 0) permissions[key] = values;
+		else delete permissions[key];
+	};
+	assign("allow", next.allow);
+	assign("ask", next.ask);
+	assign("deny", next.deny);
+	return {
+		...settings,
+		permissions
+	};
+};
+const applyIgnoreReadDenies = (params) => {
+	const { settings, readDenies } = params;
+	const current = parsePermissionsBlock(settings);
+	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry) || readDenies.includes(entry));
+	return withPermissions(settings, {
+		allow: current.allow,
+		ask: current.ask,
+		deny: (0, es_toolkit.uniq)([...preservedDeny, ...readDenies].toSorted())
+	});
+};
+const applyPermissions = (params) => {
+	const { settings, managedToolNames, toolNameOf, allow, ask, deny, logger } = params;
+	const current = parsePermissionsBlock(settings);
+	const keepUnmanaged = (entries) => entries.filter((entry) => !managedToolNames.has(toolNameOf(entry)));
+	if (logger && managedToolNames.has(READ_TOOL_NAME)) {
+		const overwrittenReadDenies = current.deny.filter((entry) => toolNameOf(entry) === READ_TOOL_NAME);
+		if (overwrittenReadDenies.length > 0) logger.warn(`Permissions feature manages '${READ_TOOL_NAME}' tool and will overwrite ${overwrittenReadDenies.length} existing ${READ_TOOL_NAME} deny entries. Permissions take precedence.`);
+	}
+	return withPermissions(settings, {
+		allow: (0, es_toolkit.uniq)([...keepUnmanaged(current.allow), ...allow].toSorted()),
+		ask: (0, es_toolkit.uniq)([...keepUnmanaged(current.ask), ...ask].toSorted()),
+		deny: (0, es_toolkit.uniq)([...keepUnmanaged(current.deny), ...deny].toSorted())
+	});
+};
+//#endregion
 //#region src/features/opencode-config.ts
 /**
 * Reads and parses the OpenCode config (`opencode.jsonc` preferred, then
@@ -3943,9 +4234,10 @@ async function readOpencodeConfig({ outputRoot, global = false }) {
 	});
 	const fileContent = await readFileContentOrNull((0, node_path.join)(configDir, "opencode.jsonc")) ?? await readFileContentOrNull((0, node_path.join)(configDir, "opencode.json"));
 	if (!fileContent) return {};
-	const parsed = (0, jsonc_parser.parse)(fileContent);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-	return parsed;
+	return parseSharedConfig({
+		format: "jsonc",
+		fileContent
+	});
 }
 /**
 * Narrows an unknown value to a plain record of entries keyed by name, as used
@@ -4854,32 +5146,6 @@ var RovodevPromptsManifest = class extends ToolFile {
 	}
 };
 //#endregion
-//#region src/constants/takt-paths.ts
-const TAKT_DIR = ".takt";
-const TAKT_FACETS_SUBDIR = "facets";
-const TAKT_FACETS_DIR_PATH = (0, node_path.join)(TAKT_DIR, TAKT_FACETS_SUBDIR);
-const TAKT_RULES_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "policies");
-const TAKT_COMMANDS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "instructions");
-const TAKT_SKILLS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "knowledge");
-const TAKT_SUBAGENTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "personas");
-const TAKT_OUTPUT_CONTRACTS_DIR_PATH = (0, node_path.join)(TAKT_FACETS_DIR_PATH, "output-contracts");
-const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
-/**
-* Takt's shared config file. Lives at `.takt/config.yaml` (project) and
-* `~/.takt/config.yaml` (global); it holds the active provider, provider
-* profiles (including permission modes), and other Takt settings.
-* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
-*/
-const TAKT_CONFIG_FILE_NAME = "config.yaml";
-/**
-* Top-level key in Takt's `config.yaml` holding the workflow MCP transport
-* allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
-* transport must be explicitly enabled here before any workflow-defined MCP
-* server using it is permitted to run.
-* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
-*/
-const TAKT_WORKFLOW_MCP_SERVERS_KEY = "workflow_mcp_servers";
-//#endregion
 //#region src/features/takt-shared.ts
 /**
 * Shared utilities for all TAKT-* tool file classes.
@@ -6357,42 +6623,6 @@ const CANONICAL_TO_REASONIX_EVENT_NAMES = {
 */
 const REASONIX_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_REASONIX_EVENT_NAMES).map(([k, v]) => [v, k]));
 //#endregion
-//#region src/utils/prototype-pollution.ts
-/**
-* Keys that, if walked into when constructing or merging objects from
-* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
-* chain) and propagate state to every other object in the runtime. Any code
-* that copies arbitrary user-supplied keys into a fresh object — frontmatter
-* parsing, MCP config conversion, settings round-trip — should skip these.
-*/
-const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isPrototypePollutionKey(key) {
-	return PROTOTYPE_POLLUTION_KEYS.has(key);
-}
-/**
-* Returns a shallow copy of a record's own entries with every
-* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
-*
-* Use when copying a nested, user-supplied string map — an MCP server's `env`
-* or `headers` table — into freshly generated config. Carrying such a map by
-* reference, or re-assigning its keys via bracket notation, would let a literal
-* `__proto__` key ride along (and re-assigning it would mutate the target's
-* prototype). Walking the entries through this helper severs that path while
-* preserving every legitimate key.
-*/
-function omitPrototypePollutionKeys(record) {
-	const sanitized = {};
-	for (const [key, value] of Object.entries(record)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = value;
-	}
-	return sanitized;
-}
-//#endregion
 //#region src/features/hooks/tool-hooks-converter.ts
 function isToolMatcherEntry(x) {
 	if (x === null || typeof x !== "object") return false;
@@ -7051,24 +7281,19 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		const paths = ClaudecodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
-		let settings;
-		try {
-			settings = JSON.parse(existingContent);
-		} catch (error) {
-			throw new Error(`Failed to parse existing Claude settings at ${filePath}: ${formatError(error)}`, { cause: error });
-		}
 		const config = rulesyncHooks.getJson();
-		const claudeHooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.claudecode?.hooks,
-			converterConfig: CLAUDE_CONVERTER_CONFIG,
-			logger
+		const fileContent = applySharedConfigPatch({
+			fileKey: CLAUDE_SETTINGS_SHARED_FILE_KEY,
+			feature: "hooks",
+			existingContent,
+			patch: { hooks: canonicalToToolHooks({
+				config,
+				toolOverrideHooks: config.claudecode?.hooks,
+				converterConfig: CLAUDE_CONVERTER_CONFIG,
+				logger
+			}) },
+			filePath
 		});
-		const merged = {
-			...settings,
-			hooks: claudeHooks
-		};
-		const fileContent = JSON.stringify(merged, null, 2);
 		return new ClaudecodeHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -8300,55 +8525,6 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hermes-config.ts
-function sanitizeHermesConfigValue(value) {
-	if (Array.isArray(value)) return value.map(sanitizeHermesConfigValue);
-	if (!isPlainObject(value)) return value;
-	const sanitized = omitPrototypePollutionKeys(value);
-	const result = {};
-	for (const [key, nestedValue] of Object.entries(sanitized)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		result[key] = sanitizeHermesConfigValue(nestedValue);
-	}
-	return result;
-}
-function parseHermesConfig(fileContent) {
-	if (!fileContent.trim()) return {};
-	const parsed = (0, js_yaml.load)(fileContent);
-	if (isPlainObject(parsed)) return sanitizeHermesConfigValue(parsed);
-	return {};
-}
-function stringifyHermesConfig(config) {
-	return (0, js_yaml.dump)(config, {
-		noRefs: true,
-		sortKeys: false
-	}).trimEnd() + "\n";
-}
-function mergeHermesConfig(fileContent, patch) {
-	return stringifyHermesConfig({
-		...parseHermesConfig(fileContent),
-		...patch
-	});
-}
-/**
-* Recursively merge `patch` into `base` (patch wins). Nested plain objects are
-* merged key-by-key; every other value (arrays, scalars) is replaced wholesale.
-* Used to overlay the Hermes-scoped permission override onto the natively
-* emitted `approvals`/`security` structures without one clobbering the other
-* (e.g. `approvals.deny` from canonical deny rules coexisting with an
-* `approvals.mode` from the override). Prototype-pollution keys are dropped.
-*/
-function deepMergeHermesConfig(base, patch) {
-	const result = { ...base };
-	for (const [key, patchValue] of Object.entries(patch)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		const baseValue = result[key];
-		if (isPlainObject(baseValue) && isPlainObject(patchValue)) result[key] = deepMergeHermesConfig(baseValue, patchValue);
-		else result[key] = sanitizeHermesConfigValue(patchValue);
-	}
-	return result;
-}
-//#endregion
 //#region src/features/hooks/hermesagent-hooks.ts
 /**
 * Canonical events that map to a Hermes tool-call event (`pre_tool_call` /
@@ -8476,10 +8652,21 @@ var HermesagentHooks = class HermesagentHooks extends ToolHooks {
 		return true;
 	}
 	setFileContent(fileContent) {
-		this.fileContent = mergeHermesConfig(fileContent, parseHermesConfig(this.fileContent));
+		this.fileContent = applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "hooks",
+			existingContent: fileContent,
+			patch: parseSharedConfig({
+				format: "yaml",
+				fileContent: this.fileContent
+			})
+		});
 	}
 	toRulesyncHooks() {
-		const hooks = hermesHooksToCanonical(parseHermesConfig(this.getFileContent()).hooks);
+		const hooks = hermesHooksToCanonical(parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent()
+		}).hooks);
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify({
 			version: 1,
 			hooks
@@ -8489,11 +8676,14 @@ var HermesagentHooks = class HermesagentHooks extends ToolHooks {
 		const config = rulesyncHooks.getJson();
 		return new HermesagentHooks({
 			outputRoot,
-			fileContent: stringifyHermesConfig({ hooks: canonicalToHermesHooks({
-				config,
-				toolOverrideHooks: config.hermesagent?.hooks,
-				logger
-			}) })
+			fileContent: stringifySharedConfig({
+				format: "yaml",
+				document: { hooks: canonicalToHermesHooks({
+					config,
+					toolOverrideHooks: config.hermesagent?.hooks,
+					logger
+				}) }
+			})
 		});
 	}
 };
@@ -10513,66 +10703,6 @@ var AugmentcodeIgnore = class AugmentcodeIgnore extends ToolIgnore {
 	}
 };
 //#endregion
-//#region src/features/claudecode-settings-gateway.ts
-/**
-* Single owner of the `.claude/settings.json` `permissions` block, which both
-* `ignore` (writes `Read(...)` into `permissions.deny`) and `permissions`
-* (writes the whole `allow`/`ask`/`deny`) read-modify-write. The entry format,
-* the merge, and the cross-feature ownership rule (permissions' explicit `Read`
-* rules win over ignore-derived `Read` denies) used to be duplicated across both
-* feature files; they live here once so each feature just states its intent and
-* never reasons about the other's existence.
-*/
-const READ_TOOL_NAME = "Read";
-const isReadDenyEntry = (entry) => entry.startsWith(`${READ_TOOL_NAME}(`) && entry.endsWith(")");
-const buildReadDenyEntry = (pattern) => `${READ_TOOL_NAME}(${pattern})`;
-const parsePermissionsBlock = (settings) => {
-	const permissions = settings.permissions ?? {};
-	return {
-		allow: permissions.allow ?? [],
-		ask: permissions.ask ?? [],
-		deny: permissions.deny ?? []
-	};
-};
-const withPermissions = (settings, next) => {
-	const permissions = { ...settings.permissions };
-	const assign = (key, values) => {
-		if (values.length > 0) permissions[key] = values;
-		else delete permissions[key];
-	};
-	assign("allow", next.allow);
-	assign("ask", next.ask);
-	assign("deny", next.deny);
-	return {
-		...settings,
-		permissions
-	};
-};
-const applyIgnoreReadDenies = (params) => {
-	const { settings, readDenies } = params;
-	const current = parsePermissionsBlock(settings);
-	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry) || readDenies.includes(entry));
-	return withPermissions(settings, {
-		allow: current.allow,
-		ask: current.ask,
-		deny: (0, es_toolkit.uniq)([...preservedDeny, ...readDenies].toSorted())
-	});
-};
-const applyPermissions = (params) => {
-	const { settings, managedToolNames, toolNameOf, allow, ask, deny, logger } = params;
-	const current = parsePermissionsBlock(settings);
-	const keepUnmanaged = (entries) => entries.filter((entry) => !managedToolNames.has(toolNameOf(entry)));
-	if (logger && managedToolNames.has(READ_TOOL_NAME)) {
-		const overwrittenReadDenies = current.deny.filter((entry) => toolNameOf(entry) === READ_TOOL_NAME);
-		if (overwrittenReadDenies.length > 0) logger.warn(`Permissions feature manages '${READ_TOOL_NAME}' tool and will overwrite ${overwrittenReadDenies.length} existing ${READ_TOOL_NAME} deny entries. Permissions take precedence.`);
-	}
-	return withPermissions(settings, {
-		allow: (0, es_toolkit.uniq)([...keepUnmanaged(current.allow), ...allow].toSorted()),
-		ask: (0, es_toolkit.uniq)([...keepUnmanaged(current.ask), ...ask].toSorted()),
-		deny: (0, es_toolkit.uniq)([...keepUnmanaged(current.deny), ...deny].toSorted())
-	});
-};
-//#endregion
 //#region src/features/ignore/claudecode-ignore.ts
 const DEFAULT_FILE_MODE = "shared";
 /**
@@ -11995,7 +12125,6 @@ var AntigravityIdeMcp = class extends AntigravityMcp {
 };
 //#endregion
 //#region src/features/mcp/augmentcode-mcp.ts
-const AUGMENTCODE_GLOBAL_ONLY_MESSAGE = "AugmentCode MCP is global-only; use --global to sync ~/.augment/settings.json";
 function parseAugmentcodeSettings(fileContent, relativeDirPath, relativeFilePath) {
 	const configPath = (0, node_path.join)(relativeDirPath, relativeFilePath);
 	let parsed;
@@ -12010,13 +12139,15 @@ function parseAugmentcodeSettings(fileContent, relativeDirPath, relativeFilePath
 /**
 * AugmentCode (Auggie CLI) MCP servers.
 *
-* MCP servers are persisted in the shared user settings file
-* `~/.augment/settings.json` (global only — the docs do not document a
-* project-level MCP location). That same file also holds `hooks` and
+* MCP servers are persisted in the shared settings file `.augment/settings.json`
+* at either scope: the committed workspace file for team-shared servers (project)
+* or `~/.augment/settings.json` (global). That same file also holds `hooks` and
 * `toolPermissions`, so generation merges the `mcpServers` block into the
-* existing settings instead of overwriting it, and the file is never deleted.
+* existing settings instead of overwriting it, and the file is never deleted. On
+* project-scope import the gitignored `.augment/settings.local.json` overrides
+* file is overlaid on top (the same layering the hooks/permissions adapters use).
 *
-* @see https://docs.augmentcode.com/cli/integrations
+* @see https://docs.augmentcode.com/cli/config
 */
 var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 	json;
@@ -12038,9 +12169,14 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 		};
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		if (!global) throw new Error(AUGMENTCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const json = parseAugmentcodeSettings(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}", paths.relativeDirPath, paths.relativeFilePath);
+		const json = parseAugmentcodeSettings(await readAugmentcodeSettingsWithLocalOverlay({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			baseFileName: paths.relativeFilePath,
+			baseFallbackContent: "{}",
+			includeLocalOverlay: !global
+		}), paths.relativeDirPath, paths.relativeFilePath);
 		const newJson = {
 			...json,
 			mcpServers: json.mcpServers ?? {}
@@ -12055,7 +12191,6 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
-		if (!global) throw new Error(AUGMENTCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const merged = {
 			...parseAugmentcodeSettings(await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), JSON.stringify({}, null, 2)), paths.relativeDirPath, paths.relativeFilePath),
@@ -13705,7 +13840,10 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	config;
 	constructor(params) {
 		super(params);
-		this.config = this.fileContent !== void 0 ? parseHermesConfig(this.fileContent) : {};
+		this.config = this.fileContent !== void 0 ? parseSharedConfig({
+			format: "yaml",
+			fileContent: this.fileContent
+		}) : {};
 	}
 	getConfig() {
 		return this.config;
@@ -13714,9 +13852,17 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 		return true;
 	}
 	setFileContent(fileContent) {
-		const merged = mergeHermesMcpServers(parseHermesConfig(fileContent), isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const merged = mergeHermesMcpServers(parseSharedConfig({
+			format: "yaml",
+			fileContent
+		}), isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
 		this.config = merged;
-		super.setFileContent(stringifyHermesConfig(merged));
+		super.setFileContent(applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "mcp",
+			existingContent: fileContent,
+			patch: { mcp_servers: merged.mcp_servers }
+		}));
 	}
 	isDeletable() {
 		return false;
@@ -13743,12 +13889,21 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const merged = mergeHermesMcpServers(parseHermesConfig(await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), "")), convertToHermesFormat(rulesyncMcp.getMcpServers()));
+		const fileContent = await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), "");
+		const merged = mergeHermesMcpServers(parseSharedConfig({
+			format: "yaml",
+			fileContent
+		}), convertToHermesFormat(rulesyncMcp.getMcpServers()));
 		return new HermesagentMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: stringifyHermesConfig(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+				feature: "mcp",
+				existingContent: fileContent,
+				patch: { mcp_servers: merged.mcp_servers }
+			}),
 			validate,
 			global
 		});
@@ -14913,28 +15068,6 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 	}
 };
 //#endregion
-//#region src/features/shared/takt-config.ts
-/**
-* Parse a Takt `config.yaml` into a plain object, treating an empty file as `{}`.
-*
-* Shared by the Takt adapters that read-modify-write the same `config.yaml`
-* (mcp, permissions, ...). Uses `isPlainObject` (not `isRecord`) so class
-* instances are rejected for prototype-pollution hardening; a YAML mapping
-* always parses to a plain object.
-*/
-function parseTaktConfig(fileContent, relativeDirPath, relativeFilePath) {
-	const configPath = (0, node_path.join)(relativeDirPath, relativeFilePath);
-	let parsed;
-	try {
-		parsed = fileContent.trim() === "" ? {} : (0, js_yaml.load)(fileContent);
-	} catch (error) {
-		throw new Error(`Failed to parse Takt config at ${configPath}: ${formatError(error)}`, { cause: error });
-	}
-	if (parsed === void 0 || parsed === null) return {};
-	if (!isPlainObject(parsed)) throw new Error(`Failed to parse Takt config at ${configPath}: expected a YAML mapping`);
-	return parsed;
-}
-//#endregion
 //#region src/features/mcp/takt-mcp.ts
 /**
 * MCP adapter for Takt (`.takt/config.yaml` project / `~/.takt/config.yaml`
@@ -15000,17 +15133,20 @@ var TaktMcp = class TaktMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = TaktMcp.getSettablePaths({ global });
-		const config = parseTaktConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath);
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const allowlist = deriveTransportAllowlist(rulesyncMcp.getMcpServers());
-		const merged = {
-			...config,
-			[TAKT_WORKFLOW_MCP_SERVERS_KEY]: allowlist
-		};
 		return new TaktMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: (0, js_yaml.dump)(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: TAKT_CONFIG_SHARED_FILE_KEY,
+				feature: "mcp",
+				existingContent,
+				patch: { [TAKT_WORKFLOW_MCP_SERVERS_KEY]: allowlist },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -15455,7 +15591,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 	["augmentcode", {
 		class: AugmentcodeMcp,
 		meta: {
-			supportsProject: false,
+			supportsProject: true,
 			supportsGlobal: true,
 			supportsEnabledTools: false,
 			supportsDisabledTools: false
@@ -16037,15 +16173,97 @@ const JuniePermissionsOverrideSchema = zod_mini.z.looseObject({
 	defaultBehavior: zod_mini.z.optional(zod_mini.z.string())
 });
 /**
+* Tool-scoped override block for Takt. Takt's `config.yaml` carries two
+* permission surfaces the canonical coarse-mode mapping can't express:
+* `step_permission_overrides` — a per-workflow-step map (`<step>` →
+* `readonly`/`edit`/`full`) that lives inside the active provider profile
+* alongside `default_permission_mode` and layers on top of it at that step; and
+* `provider_options` — a top-level, per-provider table of sandbox/network knobs
+* orthogonal to the permission mode (e.g. `codex.network_access`,
+* `claude.sandbox.allow_unsandboxed_commands`, `opencode.allowed_tools`). Fields
+* placed here are merged into `config.yaml` and emitted only for Takt, while the
+* shared `permission` block continues to drive `default_permission_mode`. Kept
+* `looseObject` (verbatim passthrough); Takt validates its own value sets (e.g.
+* `provider_options.<p>.base_url` must be loopback). Both project and global
+* scope are supported.
+*
+* Note: Takt's config loader hard-rejects unknown top-level keys, so only keys
+* Takt actually recognizes belong here. `required_permission_mode` is NOT one —
+* it is a per-step field of the workflow YAML (not `config.yaml`), so it is out
+* of scope for this override.
+*
+* @example
+* { "step_permission_overrides": { "ai_review": "readonly" }, "provider_options": { "codex": { "network_access": true } } }
+*/
+const TaktPermissionsOverrideSchema = zod_mini.z.looseObject({
+	step_permission_overrides: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
+	provider_options: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Tool-scoped override block for Amp. Amp's `amp.permissions` array and sibling
+* settings carry shapes the canonical per-command allow/ask/deny model can't
+* express, so they are authored here and merged into the shared Amp settings
+* file, while the shared `permission` block continues to drive the canonical
+* `amp.permissions` (allow/ask/reject) + `amp.tools.disable` entries:
+* - `permissions` — extra `amp.permissions` entries with non-`cmd` matchers
+*   (`path`/`url`/`query`/…), regex/array match values, `context`
+*   (`thread`/`subagent`), `delegate` (+`to`), or `reject` (+`message`). These
+*   are appended AFTER the canonical-generated entries (Amp is first-match-wins,
+*   so generated allow/ask/reject rules take precedence; authored entries act as
+*   later fallbacks), preserving author order.
+* - `mcpPermissions` — Amp's `amp.mcpPermissions` array (`{ matches, action }`).
+* - `guardedFiles` — `amp.guardedFiles.allowlist` (globs allowed without
+*   confirmation).
+* - `dangerouslyAllowAll` — `amp.dangerouslyAllowAll` (disable all confirmation).
+* Kept `looseObject` (verbatim passthrough). Both project and global scope are
+* supported.
+*
+* @example
+* { "dangerouslyAllowAll": false, "guardedFiles": { "allowlist": ["docs/**"] },
+*   "permissions": [{ "tool": "Bash", "action": "delegate", "to": "approve.sh" }] }
+*/
+const AmpPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permissions: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.looseObject({
+		tool: zod_mini.z.string(),
+		action: zod_mini.z.string()
+	}))),
+	mcpPermissions: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.looseObject({}))),
+	guardedFiles: zod_mini.z.optional(zod_mini.z.looseObject({ allowlist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) })),
+	dangerouslyAllowAll: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* Tool-scoped override block for the Google Antigravity CLI. Antigravity's CLI
+* `settings.json` carries two global autonomy/sandbox knobs outside the
+* `permissions.allow/ask/deny` arrays rulesync manages: `toolPermission` (the
+* global autonomy preset — `request-review` (default) / `proceed-in-sandbox` /
+* `always-proceed` / `strict`) and `enableTerminalSandbox` (a boolean confining
+* agent-run commands to OS containment). Antigravity applies the allow/deny
+* lists as per-rule exceptions to the preset at runtime, so rulesync only
+* authors these keys verbatim — no precedence modeling is needed on our side.
+* Fields placed here are merged onto the top level of
+* `~/.gemini/antigravity-cli/settings.json` (global-only) and emitted only for
+* the CLI. The Antigravity IDE exposes the same concepts through a GUI (no
+* documented JSON schema), so this override does NOT apply to `antigravity-ide`.
+* Verified against https://antigravity.google/docs/cli/reference and
+* https://antigravity.google/docs/cli/sandbox.
+*
+* @example
+* { "toolPermission": "strict", "enableTerminalSandbox": true }
+*/
+const AntigravityCliPermissionsOverrideSchema = zod_mini.z.looseObject({
+	toolPermission: zod_mini.z.optional(zod_mini.z.string()),
+	enableTerminalSandbox: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
 * The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
-* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie` keys are tool-scoped
-* overrides consumed only by their respective translator (see the matching
-* `*PermissionsOverrideSchema`); every other tool reads the shared `permission`
-* block and ignores them.
+* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie`/`takt`/`amp`/
+* `antigravity-cli` keys are tool-scoped overrides consumed only by their
+* respective translator (see the matching `*PermissionsOverrideSchema`); every
+* other tool reads the shared `permission` block and ignores them.
 *
 * @example
 * {
@@ -16066,7 +16284,10 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	reasonix: zod_mini.z.optional(ReasonixPermissionsOverrideSchema),
 	factorydroid: zod_mini.z.optional(FactorydroidPermissionsOverrideSchema),
 	warp: zod_mini.z.optional(WarpPermissionsOverrideSchema),
-	junie: zod_mini.z.optional(JuniePermissionsOverrideSchema)
+	junie: zod_mini.z.optional(JuniePermissionsOverrideSchema),
+	takt: zod_mini.z.optional(TaktPermissionsOverrideSchema),
+	amp: zod_mini.z.optional(AmpPermissionsOverrideSchema),
+	"antigravity-cli": zod_mini.z.optional(AntigravityCliPermissionsOverrideSchema)
 });
 /**
 * Full permissions file schema including optional $schema field.
@@ -16178,6 +16399,39 @@ const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 * Reference: https://ampcode.com/manual ("amp.permissions").
 */
 const AMP_PERMISSIONS_KEY = "amp.permissions";
+/**
+* The `amp.guardedFiles.allowlist` array (file globs allowed without
+* confirmation), `amp.dangerouslyAllowAll` boolean (disable all confirmation),
+* and `amp.mcpPermissions` array — sibling settings authored through the `amp`
+* permissions override. Reference: https://ampcode.com/manual.
+*/
+const AMP_GUARDED_FILES_ALLOWLIST_KEY = "amp.guardedFiles.allowlist";
+const AMP_DANGEROUSLY_ALLOW_ALL_KEY = "amp.dangerouslyAllowAll";
+const AMP_MCP_PERMISSIONS_KEY = "amp.mcpPermissions";
+/**
+* The read-only `cmd` string of an entry's `matches`, or `undefined` when the
+* matcher is absent or uses a non-`cmd` key / non-string value.
+*/
+function ampMatchesCmd(entry) {
+	const cmd = entry.matches?.cmd;
+	return typeof cmd === "string" ? cmd : void 0;
+}
+/**
+* Whether an `amp.permissions` entry is fully expressible in the canonical
+* per-command allow/ask/deny model: a plain `allow`/`ask`/`reject` action with
+* no `context`/`message`/`to` and a matcher that is either absent or exactly a
+* single string `cmd`. Everything else (non-`cmd` matchers, regex/array match
+* values, `delegate`, `reject`+`message`, `context`) is routed to the `amp`
+* override verbatim instead of being flattened with loss or dropped.
+*/
+function isCanonicalAmpEntry(entry) {
+	if (entry.action === "delegate") return false;
+	if (entry.context !== void 0 || entry.message !== void 0 || entry.to !== void 0) return false;
+	const matches = entry.matches;
+	if (matches === void 0) return true;
+	const keys = Object.keys(matches);
+	return keys.length === 0 || keys.length === 1 && typeof matches.cmd === "string";
+}
 function parseAmpSettings(fileContent) {
 	const errors = [];
 	const parsed = (0, jsonc_parser.parse)(fileContent || "{}", errors, { allowTrailingComma: true });
@@ -16193,10 +16447,20 @@ function toDisableList(value) {
 	return value.filter((entry) => typeof entry === "string");
 }
 /**
+* Read `amp.guardedFiles.allowlist` (an array of file glob strings) from parsed
+* settings, returning `undefined` when the key is absent or not an array so the
+* override omits it.
+*/
+function extractAmpGuardedAllowlist(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter((entry) => typeof entry === "string");
+}
+/**
 * Read an `amp.permissions` array from untrusted parsed settings. Only entries
-* whose shape rulesync understands are retained; the original objects are kept
-* by reference (with a normalized `action`) so unknown sibling keys survive a
-* round-trip when the entry is preserved.
+* whose `tool`/`action` rulesync understands are retained; every other key —
+* including the full `matches` object (so non-`cmd` matchers, regex/array
+* values, `context`, `to`, `message`) — is kept verbatim so it survives a
+* round-trip.
 */
 function toPermissionsList(value) {
 	if (!Array.isArray(value)) return [];
@@ -16206,14 +16470,11 @@ function toPermissionsList(value) {
 		const { tool, action } = raw;
 		if (typeof tool !== "string" || typeof action !== "string") continue;
 		if (action !== "allow" && action !== "reject" && action !== "ask" && action !== "delegate") continue;
-		const matches = raw.matches;
-		let normalizedMatches;
-		if (isPlainObject(matches) && typeof matches.cmd === "string") normalizedMatches = { cmd: matches.cmd };
 		entries.push({
 			...raw,
 			tool,
 			action,
-			...normalizedMatches ? { matches: normalizedMatches } : {}
+			...isPlainObject(raw.matches) ? { matches: raw.matches } : {}
 		});
 	}
 	return entries;
@@ -16238,6 +16499,13 @@ function toPermissionsList(value) {
 * The settings file is shared with the MCP feature (`amp.mcpServers`), so reads
 * and writes merge into the existing JSON rather than overwriting it, and the
 * file is never deleted.
+*
+* Amp shapes with no canonical category are authored and round-tripped through
+* the `amp` permissions override (see `AmpPermissionsOverrideSchema`): extra
+* `amp.permissions` entries with non-`cmd` matchers / `context` / `delegate` /
+* `reject`+`message` (appended after the generated canonical entries), plus the
+* sibling `amp.mcpPermissions`, `amp.guardedFiles.allowlist`, and
+* `amp.dangerouslyAllowAll` settings.
 */
 var AmpPermissions = class AmpPermissions extends ToolPermissions {
 	constructor(params) {
@@ -16307,15 +16575,25 @@ var AmpPermissions = class AmpPermissions extends ToolPermissions {
 		const jsonDir = (0, node_path.join)(outputRoot, basePaths.relativeDirPath);
 		const { fileContent, relativeFilePath } = await this.resolveSettingsFile(jsonDir);
 		const json = fileContent ? parseAmpSettings(fileContent) : {};
-		const { disable, permissions } = convertRulesyncToAmp(rulesyncPermissions.getJson());
-		const preservedDelegates = toPermissionsList(json[AMP_PERMISSIONS_KEY]).filter((entry) => entry.action === "delegate");
+		const config = rulesyncPermissions.getJson();
+		const { disable, permissions } = convertRulesyncToAmp(config);
+		const override = config.amp;
+		const authoredExtras = override?.permissions ? toPermissionsList(override.permissions) : [];
+		const preservedDelegates = override?.permissions ? [] : toPermissionsList(json[AMP_PERMISSIONS_KEY]).filter((entry) => entry.action === "delegate");
 		const newJson = {
 			...json,
 			[AMP_TOOLS_DISABLE_KEY]: disable
 		};
-		const mergedPermissions = [...permissions, ...preservedDelegates];
+		const mergedPermissions = mergeAmpPermissions([
+			...permissions,
+			...authoredExtras,
+			...preservedDelegates
+		]);
 		if (mergedPermissions.length > 0) newJson[AMP_PERMISSIONS_KEY] = mergedPermissions;
 		else delete newJson[AMP_PERMISSIONS_KEY];
+		if (override?.guardedFiles?.allowlist !== void 0) newJson[AMP_GUARDED_FILES_ALLOWLIST_KEY] = override.guardedFiles.allowlist;
+		if (override?.dangerouslyAllowAll !== void 0) newJson[AMP_DANGEROUSLY_ALLOW_ALL_KEY] = override.dangerouslyAllowAll;
+		if (override?.mcpPermissions !== void 0) newJson[AMP_MCP_PERMISSIONS_KEY] = override.mcpPermissions;
 		return new AmpPermissions({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
@@ -16326,11 +16604,22 @@ var AmpPermissions = class AmpPermissions extends ToolPermissions {
 	}
 	toRulesyncPermissions() {
 		const json = parseAmpSettings(this.getFileContent());
+		const allPermissions = toPermissionsList(json[AMP_PERMISSIONS_KEY]);
+		const canonicalEntries = allPermissions.filter(isCanonicalAmpEntry);
+		const overrideEntries = allPermissions.filter((entry) => !isCanonicalAmpEntry(entry));
 		const config = convertAmpToRulesync({
 			disable: toDisableList(json[AMP_TOOLS_DISABLE_KEY]),
-			permissions: toPermissionsList(json[AMP_PERMISSIONS_KEY])
-		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+			permissions: canonicalEntries
+		});
+		const ampOverride = {};
+		if (overrideEntries.length > 0) ampOverride.permissions = overrideEntries;
+		if (Array.isArray(json[AMP_MCP_PERMISSIONS_KEY])) ampOverride.mcpPermissions = json[AMP_MCP_PERMISSIONS_KEY];
+		const allowlist = extractAmpGuardedAllowlist(json[AMP_GUARDED_FILES_ALLOWLIST_KEY]);
+		if (allowlist !== void 0) ampOverride.guardedFiles = { allowlist };
+		if (typeof json[AMP_DANGEROUSLY_ALLOW_ALL_KEY] === "boolean") ampOverride.dangerouslyAllowAll = json[AMP_DANGEROUSLY_ALLOW_ALL_KEY];
+		const result = { ...config };
+		if (Object.keys(ampOverride).length > 0) result.amp = ampOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		try {
@@ -16377,6 +16666,37 @@ const ACTION_PRIORITY = {
 	allow: 2
 };
 /**
+* Fail-closed action priority for merging the full `amp.permissions` list
+* (generated + authored/preserved). `reject` leads so no `allow` can shadow it
+* under first-match-wins; `delegate` (which defers to an external approver, so
+* it never auto-allows) trails as the final fallback.
+*/
+const MERGE_ACTION_PRIORITY = {
+	reject: 0,
+	ask: 1,
+	allow: 2,
+	delegate: 3
+};
+/**
+* Stable fail-closed merge of generated and authored `amp.permissions` entries:
+* order by {@link MERGE_ACTION_PRIORITY} only, preserving each source's relative
+* order within an action class. Guarantees an authored `reject` cannot be
+* shadowed by a generated catch-all `allow`.
+*/
+function mergeAmpPermissions(entries) {
+	const decorated = entries.map((entry, index) => ({
+		entry,
+		index
+	}));
+	decorated.sort((a, b) => {
+		const ap = MERGE_ACTION_PRIORITY[a.entry.action] ?? MERGE_ACTION_PRIORITY.allow;
+		const bp = MERGE_ACTION_PRIORITY[b.entry.action] ?? MERGE_ACTION_PRIORITY.allow;
+		if (ap !== bp) return ap - bp;
+		return a.index - b.index;
+	});
+	return decorated.map((d) => d.entry);
+}
+/**
 * Convert a rulesync permissions config into Amp's two permission surfaces.
 *
 * For each `(category, pattern, action)` — where the category name IS the Amp
@@ -16441,14 +16761,14 @@ function sortAmpPermissions(entries) {
 		const ap = ACTION_PRIORITY[a.entry.action] ?? 0;
 		const bp = ACTION_PRIORITY[b.entry.action] ?? 0;
 		if (ap !== bp) return ap - bp;
-		const aHasCmd = a.entry.matches?.cmd !== void 0 ? 0 : 1;
-		const bHasCmd = b.entry.matches?.cmd !== void 0 ? 0 : 1;
+		const aHasCmd = ampMatchesCmd(a.entry) !== void 0 ? 0 : 1;
+		const bHasCmd = ampMatchesCmd(b.entry) !== void 0 ? 0 : 1;
 		if (aHasCmd !== bHasCmd) return aHasCmd - bHasCmd;
 		const at = a.entry.tool;
 		const bt = b.entry.tool;
 		if (at !== bt) return at < bt ? -1 : 1;
-		const ac = a.entry.matches?.cmd ?? "";
-		const bc = b.entry.matches?.cmd ?? "";
+		const ac = ampMatchesCmd(a.entry) ?? "";
+		const bc = ampMatchesCmd(b.entry) ?? "";
 		if (ac !== bc) return ac < bc ? -1 : 1;
 		return a.index - b.index;
 	});
@@ -16487,7 +16807,7 @@ function convertAmpToRulesync({ disable, permissions }) {
 	for (const tool of disable) assign(tool, "*", "deny");
 	for (const entry of permissions) {
 		if (entry.action === "delegate") continue;
-		const pattern = entry.matches?.cmd ?? "*";
+		const pattern = ampMatchesCmd(entry) ?? "*";
 		const action = entry.action === "reject" ? "deny" : entry.action === "ask" ? "ask" : "allow";
 		assign(entry.tool, pattern, action);
 	}
@@ -16569,6 +16889,11 @@ function buildPermissionEntry$1(toolName, pattern) {
 * Permissions are written to the global `~/.gemini/antigravity-cli/settings.json`
 * file (global scope only). The file holds other CLI settings besides
 * permissions, so it is never deleted.
+*
+* Two CLI-only autonomy/sandbox knobs outside the allow/ask/deny arrays —
+* `toolPermission` (the global autonomy preset) and `enableTerminalSandbox` — are
+* authored and round-tripped through the `antigravity-cli` permissions override
+* (see `AntigravityCliPermissionsOverrideSchema`).
 */
 var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPermissions {
 	constructor(params) {
@@ -16629,6 +16954,9 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			...settings,
 			permissions: mergedPermissions
 		};
+		const override = config["antigravity-cli"];
+		if (override?.toolPermission !== void 0) merged.toolPermission = override.toolPermission;
+		if (override?.enableTerminalSandbox !== void 0) merged.enableTerminalSandbox = override.enableTerminalSandbox;
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new AntigravityCliPermissions({
 			outputRoot,
@@ -16652,7 +16980,12 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const override = {};
+		if (typeof settings.toolPermission === "string") override.toolPermission = settings.toolPermission;
+		if (typeof settings.enableTerminalSandbox === "boolean") override.enableTerminalSandbox = settings.enableTerminalSandbox;
+		const result = { ...config };
+		if (Object.keys(override).length > 0) result["antigravity-cli"] = override;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -19338,14 +19671,21 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		return true;
 	}
 	setFileContent(fileContent) {
-		const existing = parseHermesConfig(fileContent);
-		const generated = parseHermesConfig(this.fileContent);
-		const merged = deepMergeHermesConfig(existing, generated);
-		if (generated.permissions !== void 0) merged.permissions = generated.permissions;
-		this.fileContent = stringifyHermesConfig(merged);
+		this.fileContent = applySharedConfigPatch({
+			fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+			feature: "permissions",
+			existingContent: fileContent,
+			patch: parseSharedConfig({
+				format: "yaml",
+				fileContent: this.fileContent
+			})
+		});
 	}
 	toRulesyncPermissions() {
-		const config = parseHermesConfig(this.getFileContent());
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent()
+		});
 		const permissions = config.permissions && typeof config.permissions === "object" ? config.permissions.rulesync : {};
 		return new RulesyncPermissions({
 			relativeDirPath: "",
@@ -19366,11 +19706,17 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			enabled: true,
 			domains: webfetchDeny
 		} };
-		if (permissions.hermes && typeof permissions.hermes === "object") config = deepMergeHermesConfig(config, permissions.hermes);
+		if (permissions.hermes && typeof permissions.hermes === "object") config = mergeSharedConfigDeep({
+			base: config,
+			patch: permissions.hermes
+		});
 		config.permissions = { rulesync: permissions };
 		return new HermesagentPermissions({
 			outputRoot,
-			fileContent: stringifyHermesConfig(config)
+			fileContent: stringifySharedConfig({
+				format: "yaml",
+				document: config
+			})
 		});
 	}
 };
@@ -20926,6 +21272,8 @@ function isPermissionAction(value) {
 const TAKT_PROVIDER_KEY = "provider";
 const TAKT_PROVIDER_PROFILES_KEY = "provider_profiles";
 const TAKT_DEFAULT_PERMISSION_MODE_KEY = "default_permission_mode";
+const TAKT_STEP_PERMISSION_OVERRIDES_KEY = "step_permission_overrides";
+const TAKT_PROVIDER_OPTIONS_KEY = "provider_options";
 const TAKT_DEFAULT_PROVIDER = "claude";
 const CATCH_ALL_PATTERN = "*";
 /**
@@ -20955,10 +21303,16 @@ const CATCH_ALL_PATTERN = "*";
 *     `bash: { "*": "deny" }`. These round-trip the generate mapping.
 *
 * Both project and global scope are supported. The shared config is merged in
-* place: only `provider_profiles.<provider>.default_permission_mode` is set;
-* the active provider's other keys (e.g. `step_permission_overrides`), every
-* other provider profile, and all other top-level keys are preserved. The file
-* is never deleted.
+* place: `provider_profiles.<provider>.default_permission_mode` is set from the
+* derived mode; every other provider profile and all other top-level keys are
+* preserved. The file is never deleted.
+*
+* Two Takt-specific surfaces with no canonical category round-trip through the
+* `takt` override (see `TaktPermissionsOverrideSchema`):
+* `step_permission_overrides` (a per-step mode map inside the active provider
+* profile, layered on top of `default_permission_mode`) and `provider_options`
+* (a top-level per-provider sandbox/network table). Both are authored on
+* generate and re-extracted on import.
 */
 var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	constructor(params) {
@@ -20990,37 +21344,62 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
 		const paths = TaktPermissions.getSettablePaths({ global });
-		const config = parseTaktConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath);
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: existingContent,
+			filePath,
+			invalidRootPolicy: "error"
+		});
+		const rulesyncJson = rulesyncPermissions.getJson();
 		const provider = resolveActiveProvider(config);
-		const mode = deriveTaktPermissionMode(rulesyncPermissions.getJson());
-		const existingProfiles = isPlainObject(config[TAKT_PROVIDER_PROFILES_KEY]) ? config[TAKT_PROVIDER_PROFILES_KEY] : {};
-		const existingProfile = isPlainObject(existingProfiles[provider]) ? existingProfiles[provider] : {};
-		const merged = {
-			...config,
-			[TAKT_PROVIDER_PROFILES_KEY]: {
-				...existingProfiles,
-				[provider]: {
-					...existingProfile,
-					[TAKT_DEFAULT_PERMISSION_MODE_KEY]: mode
-				}
-			}
+		const mode = deriveTaktPermissionMode(rulesyncJson);
+		const override = isPlainObject(rulesyncJson.takt) ? rulesyncJson.takt : void 0;
+		const stepOverrides = isPlainObject(override?.[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? override[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
+		const overrideProviderOptions = isPlainObject(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const patch = {
+			[TAKT_PROVIDER_PROFILES_KEY]: { [provider]: {
+				[TAKT_DEFAULT_PERMISSION_MODE_KEY]: mode,
+				...stepOverrides !== void 0 && { [TAKT_STEP_PERMISSION_OVERRIDES_KEY]: stepOverrides }
+			} },
+			...overrideProviderOptions !== void 0 && { [TAKT_PROVIDER_OPTIONS_KEY]: overrideProviderOptions }
 		};
 		return new TaktPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: (0, js_yaml.dump)(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: TAKT_CONFIG_SHARED_FILE_KEY,
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath
+			}),
 			validate: true,
 			global
 		});
 	}
 	toRulesyncPermissions() {
-		const config = parseTaktConfig(this.getFileContent(), this.getRelativeDirPath(), this.getRelativeFilePath());
+		const config = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.getFileContent(),
+			filePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath()),
+			invalidRootPolicy: "error"
+		});
 		const provider = resolveActiveProvider(config);
 		const profiles = isPlainObject(config[TAKT_PROVIDER_PROFILES_KEY]) ? config[TAKT_PROVIDER_PROFILES_KEY] : {};
-		const mode = (isPlainObject(profiles[provider]) ? profiles[provider] : {})[TAKT_DEFAULT_PERMISSION_MODE_KEY];
+		const profile = isPlainObject(profiles[provider]) ? profiles[provider] : {};
+		const mode = profile[TAKT_DEFAULT_PERMISSION_MODE_KEY];
 		const rulesyncConfig = taktModeToRulesyncConfig(mode);
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+		const stepOverrides = isPlainObject(profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
+		const providerOptions = isPlainObject(config[TAKT_PROVIDER_OPTIONS_KEY]) ? config[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const taktOverride = {};
+		if (stepOverrides && Object.keys(stepOverrides).length > 0) taktOverride[TAKT_STEP_PERMISSION_OVERRIDES_KEY] = stepOverrides;
+		if (providerOptions && Object.keys(providerOptions).length > 0) taktOverride[TAKT_PROVIDER_OPTIONS_KEY] = providerOptions;
+		const result = { ...rulesyncConfig };
+		if (Object.keys(taktOverride).length > 0) result.takt = taktOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -29915,14 +30294,21 @@ def register(ctx):
 `;
 }
 function getEnabledPluginConfigContent(currentContent) {
-	const config = parseHermesConfig(currentContent);
+	const config = parseSharedConfig({
+		format: "yaml",
+		fileContent: currentContent
+	});
 	const plugins = config.plugins && typeof config.plugins === "object" ? config.plugins : {};
 	const enabled = Array.isArray(plugins.enabled) ? plugins.enabled : [];
-	config.plugins = {
-		...plugins,
-		enabled: Array.from(/* @__PURE__ */ new Set([...enabled, "rulesync-subagents"]))
-	};
-	return stringifyHermesConfig(config);
+	return applySharedConfigPatch({
+		fileKey: HERMES_CONFIG_SHARED_FILE_KEY,
+		feature: "subagents",
+		existingContent: currentContent,
+		patch: { plugins: {
+			...plugins,
+			enabled: Array.from(/* @__PURE__ */ new Set([...enabled, "rulesync-subagents"]))
+		} }
+	});
 }
 function getSubagentSpec(rulesyncSubagent) {
 	const json = rulesyncSubagent.getFrontmatter();
@@ -30008,6 +30394,17 @@ var HermesagentSubagent = class HermesagentSubagent extends ToolSubagent {
 	static getSettablePaths() {
 		return { relativeDirPath: HERMESAGENT_RULESYNC_SUBAGENTS_DIR_PATH };
 	}
+	/**
+	* Beyond the subagent spec files, generation also read-modify-writes the
+	* shared `~/.hermes/config.yaml` (enabling the `rulesync-subagents` plugin),
+	* so the write must be declared for the shared-file order derivation.
+	*/
+	static getExtraSharedWritePaths() {
+		return [{
+			relativeDirPath: HERMESAGENT_GLOBAL_DIR,
+			relativeFilePath: (0, node_path.basename)(HERMESAGENT_CONFIG_FILE_PATH)
+		}];
+	}
 	static getSettablePathsForRulesyncSubagent(rulesyncSubagent) {
 		return [(0, node_path.join)(HERMESAGENT_RULESYNC_SUBAGENTS_DIR_PATH, `${subagentSlug(rulesyncSubagent.getRelativePathFromCwd())}.json`)];
 	}
@@ -31746,7 +32143,9 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 	})),
 	kiro: zod_mini.z.optional(zod_mini.z.looseObject({
 		inclusion: zod_mini.z.optional(zod_mini.z.string()),
-		fileMatchPattern: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+		fileMatchPattern: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+		name: zod_mini.z.optional(zod_mini.z.string()),
+		description: zod_mini.z.optional(zod_mini.z.string())
 	})),
 	takt: zod_mini.z.optional(zod_mini.z.looseObject({
 		name: zod_mini.z.optional(zod_mini.z.string()),
@@ -34662,7 +35061,8 @@ function toFileMatchPattern(globs) {
 *
 * Precedence:
 * 1. An explicit `kiro.inclusion` block round-trips as-is (with `fileMatchPattern`
-*    taken from the block, or derived from `globs` when omitted for `fileMatch`).
+*    taken from the block, or derived from `globs` when omitted for `fileMatch`;
+*    and with the companion `name`/`description` carried through for `auto`).
 * 2. Otherwise specific (non-wildcard) globs map to `fileMatch`, scoping the rule
 *    to matching files instead of leaving it implicitly always-on.
 * 3. Otherwise the rule stays `always` — represented by omitting the block so the
@@ -34680,6 +35080,11 @@ function deriveKiroInclusion({ kiro, globs }) {
 				fileMatchPattern
 			} : { inclusion: "fileMatch" };
 		}
+		if (kiro.inclusion === "auto") return {
+			inclusion: "auto",
+			...kiro.name !== void 0 ? { name: kiro.name } : {},
+			...kiro.description !== void 0 ? { description: kiro.description } : {}
+		};
 		return { inclusion: kiro.inclusion };
 	}
 	const fileMatchPattern = toFileMatchPattern(specificGlobs);
@@ -34751,6 +35156,8 @@ var KiroRule = class KiroRule extends ToolRule {
 		const rawPattern = frontmatter.fileMatchPattern;
 		const fileMatchPattern = Array.isArray(rawPattern) ? rawPattern.filter((p) => typeof p === "string") : typeof rawPattern === "string" ? rawPattern : void 0;
 		const globs = inclusion === "fileMatch" ? fileMatchPattern === void 0 ? [] : Array.isArray(fileMatchPattern) ? fileMatchPattern : [fileMatchPattern] : [];
+		const name = typeof frontmatter.name === "string" ? frontmatter.name : void 0;
+		const description = typeof frontmatter.description === "string" ? frontmatter.description : void 0;
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RulesyncRule.getSettablePaths().recommended.relativeDirPath,
@@ -34761,7 +35168,9 @@ var KiroRule = class KiroRule extends ToolRule {
 				globs,
 				kiro: {
 					inclusion,
-					...fileMatchPattern !== void 0 ? { fileMatchPattern } : {}
+					...fileMatchPattern !== void 0 ? { fileMatchPattern } : {},
+					...inclusion === "auto" && name !== void 0 ? { name } : {},
+					...inclusion === "auto" && description !== void 0 ? { description } : {}
 				}
 			},
 			body
@@ -36935,6 +37344,197 @@ function buildPermissionsStrategy(ctx) {
 	};
 }
 //#endregion
+//#region src/types/processor-registry.ts
+const PROCESSOR_REGISTRY = [
+	{
+		feature: "rules",
+		processor: RulesProcessor,
+		schema: RulesProcessorToolTargetSchema,
+		factory: toolRuleFactories
+	},
+	{
+		feature: "ignore",
+		processor: IgnoreProcessor,
+		schema: IgnoreProcessorToolTargetSchema,
+		factory: toolIgnoreFactories
+	},
+	{
+		feature: "mcp",
+		processor: McpProcessor,
+		schema: McpProcessorToolTargetSchema,
+		factory: toolMcpFactories
+	},
+	{
+		feature: "commands",
+		processor: CommandsProcessor,
+		schema: CommandsProcessorToolTargetSchema,
+		factory: toolCommandFactories
+	},
+	{
+		feature: "subagents",
+		processor: SubagentsProcessor,
+		schema: SubagentsProcessorToolTargetSchema,
+		factory: toolSubagentFactories
+	},
+	{
+		feature: "skills",
+		processor: SkillsProcessor,
+		schema: SkillsProcessorToolTargetSchema,
+		factory: toolSkillFactories
+	},
+	{
+		feature: "hooks",
+		processor: HooksProcessor,
+		schema: HooksProcessorToolTargetSchema,
+		factory: toolHooksFactories
+	},
+	{
+		feature: "permissions",
+		processor: PermissionsProcessor,
+		schema: PermissionsProcessorToolTargetSchema,
+		factory: toolPermissionsFactories
+	}
+];
+const getProcessorRegistryEntry = (feature) => {
+	const entry = PROCESSOR_REGISTRY.find((e) => e.feature === feature);
+	if (!entry) throw new Error(`No processor registered for feature: ${feature}`);
+	return entry;
+};
+//#endregion
+//#region src/lib/shared-file-derive.ts
+/**
+* The single declaration of the cross-feature write order for shared
+* (read-modify-write) config files: when two features write the same on-disk
+* file, the earlier one writes first and the later one merges on top, so the
+* later feature's conflict policy decides what survives (e.g. `permissions`
+* overriding `ignore`-derived `Read(...)` denies in `.claude/settings.json`).
+* The generation step graph's `dependsOn` edges are derived from this list
+* plus the registry's `getSettablePaths` declarations — adding a tool or a
+* shared path never requires touching the graph by hand.
+*/
+const SHARED_WRITE_FEATURE_ORDER = [
+	"ignore",
+	"subagents",
+	"mcp",
+	"hooks",
+	"permissions",
+	"rules"
+];
+const SHARED_WRITE_FEATURES = new Set(SHARED_WRITE_FEATURE_ORDER);
+const TARGETS_NOT_DERIVED = /* @__PURE__ */ new Set(["augmentcode-legacy", "claudecode-legacy"]);
+const sharedFileKey = (path) => {
+	const dir = path.relativeDirPath.replace(/\\/g, "/").replace(/\/$/, "");
+	const file = path.relativeFilePath.replace(/\\/g, "/");
+	return dir === "" || dir === "." ? file : `${dir}/${file}`;
+};
+const settablePathsForScope = (cls, global) => {
+	const paths = [];
+	let settable;
+	try {
+		settable = cls.getSettablePaths?.({ global });
+	} catch {
+		return paths;
+	}
+	if (settable?.relativeFilePath) paths.push({
+		relativeDirPath: settable.relativeDirPath ?? ".",
+		relativeFilePath: settable.relativeFilePath
+	});
+	if (settable?.root) {
+		paths.push(settable.root);
+		for (const alt of settable.alternativeRoots ?? []) paths.push(alt);
+	}
+	for (const path of cls.getExtraSharedWritePaths?.({ global }) ?? []) if (path.relativeFilePath) paths.push(path);
+	return paths;
+};
+const collectFactoryPaths = (factory) => [...settablePathsForScope(factory.class, false), ...settablePathsForScope(factory.class, true)];
+/**
+* Derive, from the processor registry, every on-disk file that two or more
+* features read-modify-write. Source of truth the generation step graph's
+* `writesSharedFile` declarations must match.
+*/
+const deriveSharedFileWriters = () => {
+	const byKey = /* @__PURE__ */ new Map();
+	const pathByKey = /* @__PURE__ */ new Map();
+	for (const entry of PROCESSOR_REGISTRY) {
+		if (!SHARED_WRITE_FEATURES.has(entry.feature)) continue;
+		const factories = entry.factory;
+		for (const [tool, factory] of factories) {
+			if (TARGETS_NOT_DERIVED.has(tool)) continue;
+			for (const path of collectFactoryPaths(factory)) {
+				const key = sharedFileKey(path);
+				if (!pathByKey.has(key)) pathByKey.set(key, path);
+				let features = byKey.get(key);
+				if (!features) {
+					features = /* @__PURE__ */ new Map();
+					byKey.set(key, features);
+				}
+				let tools = features.get(entry.feature);
+				if (!tools) {
+					tools = /* @__PURE__ */ new Set();
+					features.set(entry.feature, tools);
+				}
+				tools.add(tool);
+			}
+		}
+	}
+	const writers = [];
+	for (const [key, features] of byKey) {
+		if (features.size < 2) continue;
+		const path = pathByKey.get(key);
+		const toolsByFeature = /* @__PURE__ */ new Map();
+		for (const [feature, tools] of features) toolsByFeature.set(feature, [...tools].toSorted());
+		writers.push({
+			key,
+			relativeDirPath: path.relativeDirPath,
+			relativeFilePath: path.relativeFilePath,
+			features: [...features.keys()].toSorted(),
+			toolsByFeature
+		});
+	}
+	return writers.toSorted((a, b) => a.key.localeCompare(b.key));
+};
+/**
+* Derive, per shared-write feature, the shared files it writes and the
+* `dependsOn` edges that fix a safe write order: for every shared file, each
+* writer depends on all writers that precede it in
+* {@link SHARED_WRITE_FEATURE_ORDER}. This is the source the generation step
+* graph consumes, so registry changes (a new tool, a new settable path)
+* propagate into the execution order without a hand-maintained declaration.
+*
+* @throws Error if a feature writes a shared file but has no position in
+*   `SHARED_WRITE_FEATURE_ORDER` — ordering it is a deliberate decision about
+*   whose merge policy wins, so it must be made explicitly there.
+*/
+const deriveSharedWriteSteps = () => {
+	const orderIndex = new Map(SHARED_WRITE_FEATURE_ORDER.map((feature, index) => [feature, index]));
+	const filesByFeature = /* @__PURE__ */ new Map();
+	const depsByFeature = /* @__PURE__ */ new Map();
+	for (const writer of deriveSharedFileWriters()) {
+		for (const feature of writer.features) if (!orderIndex.has(feature)) throw new Error(`Feature '${feature}' writes the shared file '${writer.key}' but has no position in SHARED_WRITE_FEATURE_ORDER. Decide where its writes merge relative to the other features and add it to the order.`);
+		const ordered = [...writer.features].toSorted((a, b) => orderIndex.get(a) - orderIndex.get(b));
+		for (const [position, feature] of ordered.entries()) {
+			let files = filesByFeature.get(feature);
+			if (!files) {
+				files = /* @__PURE__ */ new Set();
+				filesByFeature.set(feature, files);
+			}
+			files.add(writer.key);
+			let deps = depsByFeature.get(feature);
+			if (!deps) {
+				deps = /* @__PURE__ */ new Set();
+				depsByFeature.set(feature, deps);
+			}
+			for (const earlier of ordered.slice(0, position)) deps.add(earlier);
+		}
+	}
+	const steps = /* @__PURE__ */ new Map();
+	for (const [feature, files] of filesByFeature) steps.set(feature, {
+		writesSharedFile: [...files].toSorted(),
+		dependsOn: [...depsByFeature.get(feature) ?? []].toSorted((a, b) => orderIndex.get(a) - orderIndex.get(b))
+	});
+	return steps;
+};
+//#endregion
 //#region src/lib/generate.ts
 async function processFeatureGeneration(params) {
 	const { config, processor, toolFiles, skipFilePaths } = params;
@@ -37084,98 +37684,53 @@ function resolveExecutionOrder(steps) {
 	if (ordered.length !== steps.length) throw new Error("Generation steps contain a cyclic 'dependsOn' dependency.");
 	return ordered;
 }
+const SHARED_WRITE_STEPS = deriveSharedWriteSteps();
+const sharedWriteMeta = (id) => {
+	const step = SHARED_WRITE_STEPS.get(id);
+	return step ? {
+		writesSharedFile: step.writesSharedFile,
+		dependsOn: step.dependsOn
+	} : {};
+};
 /**
 * The static shape of the generation step graph: which steps write which shared
 * (read-modify-write) config files, and the `dependsOn` edges that fix a safe order
-* for those writers. Exported (separately from the `run` closures, which need a
-* live `config`/`logger`) so `resolveExecutionOrder`'s ordering guarantee can be
-* tested directly against the real graph rather than a hand-copied one. Readonly
-* so a consumer can't mutate this module-level singleton and affect every
-* subsequent `generate()` call in the process.
+* for those writers. Both are derived from the processor registry's settable
+* paths and `SHARED_WRITE_FEATURE_ORDER` (see `shared-file-derive.ts`), so a new
+* tool or shared path never requires editing this graph. Exported (separately
+* from the `run` closures, which need a live `config`/`logger`) so
+* `resolveExecutionOrder`'s ordering guarantee can be tested directly against
+* the real graph rather than a hand-copied one. Readonly so a consumer can't
+* mutate this module-level singleton and affect every subsequent `generate()`
+* call in the process.
 */
 const GENERATION_STEP_GRAPH = [
 	{
 		id: "ignore",
-		writesSharedFile: [".claude/settings.json", ".zed/settings.json"]
+		...sharedWriteMeta("ignore")
 	},
 	{
 		id: "mcp",
-		writesSharedFile: [
-			".amp/settings.json",
-			".augment/settings.json",
-			".codex/config.toml",
-			".config/amp/settings.json",
-			".config/devin/config.json",
-			".config/opencode/opencode.json",
-			".config/zed/settings.json",
-			".devin/config.json",
-			".grok/config.toml",
-			".hermes/config.yaml",
-			".qwen/settings.json",
-			".reasonix/config.toml",
-			".takt/config.yaml",
-			".vibe/config.toml",
-			".zed/settings.json",
-			"kilo.json",
-			"opencode.json",
-			"reasonix.toml"
-		],
-		dependsOn: ["ignore"]
+		...sharedWriteMeta("mcp")
 	},
 	{ id: "commands" },
-	{ id: "subagents" },
+	{
+		id: "subagents",
+		...sharedWriteMeta("subagents")
+	},
 	{ id: "skills" },
 	{
 		id: "hooks",
-		writesSharedFile: [
-			".augment/settings.json",
-			".claude/settings.json",
-			".codex/config.toml",
-			".config/devin/config.json",
-			".hermes/config.yaml",
-			".kiro/agents/default.json",
-			".qwen/settings.json",
-			".vibe/config.toml"
-		],
-		dependsOn: ["ignore", "mcp"]
+		...sharedWriteMeta("hooks")
 	},
 	{
 		id: "permissions",
-		writesSharedFile: [
-			".amp/settings.json",
-			".augment/settings.json",
-			".claude/settings.json",
-			".codex/config.toml",
-			".config/amp/settings.json",
-			".config/devin/config.json",
-			".config/opencode/opencode.json",
-			".config/zed/settings.json",
-			".devin/config.json",
-			".grok/config.toml",
-			".hermes/config.yaml",
-			".kiro/agents/default.json",
-			".qwen/settings.json",
-			".reasonix/config.toml",
-			".takt/config.yaml",
-			".vibe/config.toml",
-			".zed/settings.json",
-			"opencode.json",
-			"reasonix.toml"
-		],
-		dependsOn: [
-			"ignore",
-			"hooks",
-			"mcp"
-		]
+		...sharedWriteMeta("permissions")
 	},
 	{
 		id: "rules",
-		writesSharedFile: ["kilo.json", "opencode.json"],
-		dependsOn: [
-			"mcp",
-			"skills",
-			"permissions"
-		]
+		...sharedWriteMeta("rules"),
+		dependsOn: [...sharedWriteMeta("rules").dependsOn ?? [], "skills"]
 	}
 ];
 /**
@@ -37933,12 +38488,6 @@ Object.defineProperty(exports, "CommandsProcessor", {
 		return CommandsProcessor;
 	}
 });
-Object.defineProperty(exports, "CommandsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return CommandsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "ConfigResolver", {
 	enumerable: true,
 	get: function() {
@@ -37963,24 +38512,12 @@ Object.defineProperty(exports, "HooksProcessor", {
 		return HooksProcessor;
 	}
 });
-Object.defineProperty(exports, "HooksProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return HooksProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "IgnoreProcessor", {
 	enumerable: true,
 	get: function() {
 		return IgnoreProcessor;
 	}
 });
-Object.defineProperty(exports, "IgnoreProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return IgnoreProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "JsonLogger", {
 	enumerable: true,
 	get: function() {
@@ -37999,24 +38536,6 @@ Object.defineProperty(exports, "McpProcessor", {
 		return McpProcessor;
 	}
 });
-Object.defineProperty(exports, "McpProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return McpProcessorToolTargetSchema;
-	}
-});
-Object.defineProperty(exports, "PermissionsProcessor", {
-	enumerable: true,
-	get: function() {
-		return PermissionsProcessor;
-	}
-});
-Object.defineProperty(exports, "PermissionsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return PermissionsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "RULESYNC_AIIGNORE_FILE_NAME", {
 	enumerable: true,
 	get: function() {
@@ -38149,12 +38668,6 @@ Object.defineProperty(exports, "RulesProcessor", {
 		return RulesProcessor;
 	}
 });
-Object.defineProperty(exports, "RulesProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return RulesProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "RulesyncCommand", {
 	enumerable: true,
 	get: function() {
@@ -38239,24 +38752,12 @@ Object.defineProperty(exports, "SkillsProcessor", {
 		return SkillsProcessor;
 	}
 });
-Object.defineProperty(exports, "SkillsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return SkillsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "SubagentsProcessor", {
 	enumerable: true,
 	get: function() {
 		return SubagentsProcessor;
 	}
 });
-Object.defineProperty(exports, "SubagentsProcessorToolTargetSchema", {
-	enumerable: true,
-	get: function() {
-		return SubagentsProcessorToolTargetSchema;
-	}
-});
 Object.defineProperty(exports, "ToolTargetSchema", {
 	enumerable: true,
 	get: function() {
@@ -38353,6 +38854,12 @@ Object.defineProperty(exports, "getLocalSkillDirNames", {
 		return getLocalSkillDirNames;
 	}
 });
+Object.defineProperty(exports, "getProcessorRegistryEntry", {
+	enumerable: true,
+	get: function() {
+		return getProcessorRegistryEntry;
+	}
+});
 Object.defineProperty(exports, "importFromTool", {
 	enumerable: true,
 	get: function() {
@@ -38407,54 +38914,6 @@ Object.defineProperty(exports, "toPosixPath", {
 		return toPosixPath;
 	}
 });
-Object.defineProperty(exports, "toolCommandFactories", {
-	enumerable: true,
-	get: function() {
-		return toolCommandFactories;
-	}
-});
-Object.defineProperty(exports, "toolHooksFactories", {
-	enumerable: true,
-	get: function() {
-		return toolHooksFactories;
-	}
-});
-Object.defineProperty(exports, "toolIgnoreFactories", {
-	enumerable: true,
-	get: function() {
-		return toolIgnoreFactories;
-	}
-});
-Object.defineProperty(exports, "toolMcpFactories", {
-	enumerable: true,
-	get: function() {
-		return toolMcpFactories;
-	}
-});
-Object.defineProperty(exports, "toolPermissionsFactories", {
-	enumerable: true,
-	get: function() {
-		return toolPermissionsFactories;
-	}
-});
-Object.defineProperty(exports, "toolRuleFactories", {
-	enumerable: true,
-	get: function() {
-		return toolRuleFactories;
-	}
-});
-Object.defineProperty(exports, "toolSkillFactories", {
-	enumerable: true,
-	get: function() {
-		return toolSkillFactories;
-	}
-});
-Object.defineProperty(exports, "toolSubagentFactories", {
-	enumerable: true,
-	get: function() {
-		return toolSubagentFactories;
-	}
-});
 Object.defineProperty(exports, "writeFileContent", {
 	enumerable: true,
 	get: function() {