rulesync 9.6.3 → 9.7.0

package/dist/{import-DnpMhZOY.cjs → import-D5f_X4-A.cjs}

@@ -2703,6 +2703,13 @@ const CODEXCLI_MCP_FILE_NAME = "config.toml";
 const CODEXCLI_RULE_FILE_NAME = "AGENTS.md";
 const CODEXCLI_BASH_RULES_FILE_NAME = "rulesync.rules";
 const CODEXCLI_OPENAI_YAML_RELATIVE_PATH = (0, node_path.join)("agents", "openai.yaml");
+const CODEXCLI_OVERRIDE_KEYS = [
+	"approval_policy",
+	"sandbox_mode",
+	"sandbox_workspace_write",
+	"apps",
+	"approvals_reviewer"
+];
 //#endregion
 //#region src/features/commands/codexcli-command.ts
 const CodexcliCommandFrontmatterSchema = zod_mini.z.looseObject({
@@ -4082,14 +4089,22 @@ function sanitizeSharedConfigValue(value) {
 * root follows `invalidRootPolicy`. Syntax errors are wrapped with the file
 * path when one is given.
 */
-function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy = "coerce-empty" }) {
+function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy = "coerce-empty", jsoncParseErrors = "tolerate" }) {
 	if (fileContent.trim() === "") return {};
 	const at = filePath === void 0 ? "" : ` at ${filePath}`;
 	let parsed;
 	try {
 		if (format === "yaml") parsed = loadYaml(fileContent);
+		else if (format === "toml") parsed = (0, smol_toml.parse)(fileContent);
 		else if (format === "json") parsed = JSON.parse(fileContent);
-		else parsed = (0, jsonc_parser.parse)(fileContent);
+		else if (jsoncParseErrors === "error") {
+			const errors = [];
+			parsed = (0, jsonc_parser.parse)(fileContent, errors, { allowTrailingComma: true });
+			if (errors.length > 0) {
+				const details = errors.map((error) => `${(0, jsonc_parser.printParseErrorCode)(error.error)} at offset ${error.offset}`).join(", ");
+				throw new Error(details);
+			}
+		} else parsed = (0, jsonc_parser.parse)(fileContent);
 	} catch (error) {
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
@@ -4103,13 +4118,15 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 /**
 * Serialize a shared config document. YAML output always ends with exactly one
 * newline; JSON output matches the 2-space `JSON.stringify` shape the JSON
-* writers have always emitted (no trailing newline).
+* writers have always emitted (no trailing newline); TOML output matches the
+* `smol-toml` `stringify` shape the TOML writers have always emitted.
 */
 function stringifySharedConfig({ format, document }) {
 	if (format === "yaml") return (0, js_yaml.dump)(document, {
 		noRefs: true,
 		sortKeys: false
 	}).trimEnd() + "\n";
+	if (format === "toml") return (0, smol_toml.stringify)(document);
 	return JSON.stringify(document, null, 2);
 }
 /**
@@ -4148,6 +4165,25 @@ function mergeSharedConfigDeep({ base, patch }) {
 const CLAUDE_SETTINGS_SHARED_FILE_KEY = ".claude/settings.json";
 const HERMES_CONFIG_SHARED_FILE_KEY = ".hermes/config.yaml";
 const TAKT_CONFIG_SHARED_FILE_KEY = ".takt/config.yaml";
+const CODEXCLI_CONFIG_SHARED_FILE_KEY = ".codex/config.toml";
+const GROKCLI_CONFIG_SHARED_FILE_KEY = ".grok/config.toml";
+const VIBE_CONFIG_SHARED_FILE_KEY = ".vibe/config.toml";
+const REASONIX_PROJECT_CONFIG_SHARED_FILE_KEY = "reasonix.toml";
+const REASONIX_GLOBAL_CONFIG_SHARED_FILE_KEY = ".reasonix/config.toml";
+/**
+* Build the `SHARED_CONFIG_OWNERSHIP` lookup key from a tool's settable paths.
+* Mirrors `sharedFileKey` in `src/lib/shared-file-derive.ts` (kept separate so
+* feature classes don't pull the processor registry through this module and
+* create an import cycle); the ownership lock-step test keeps the two aligned.
+* Lets a tool whose file lives at a scope-dependent path (`.zed/settings.json`
+* vs `.config/zed/settings.json`) resolve its declaration from the settable
+* paths it already holds.
+*/
+const sharedConfigFileKey = ({ relativeDirPath, relativeFilePath }) => {
+	const dir = relativeDirPath.replace(/\\/g, "/").replace(/\/$/, "");
+	const file = relativeFilePath.replace(/\\/g, "/");
+	return dir === "" || dir === "." ? file : `${dir}/${file}`;
+};
 /**
 * Who owns what in each gateway-managed shared config file, and which policy
 * resolves conflicts. Keys are `dir/file` tokens matching
@@ -4204,6 +4240,298 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: { kind: "deep-merge" }
 		}
+	},
+	".zed/settings.json": {
+		format: "json",
+		features: {
+			ignore: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["private_files"]
+			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["context_servers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["agent"]
+			}
+		}
+	},
+	".config/zed/settings.json": {
+		format: "json",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["context_servers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["agent"]
+			}
+		}
+	},
+	".qwen/settings.json": {
+		format: "json",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcpServers"]
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks", "disableAllHooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: [
+					"permissions",
+					"tools",
+					"security"
+				]
+			}
+		}
+	},
+	".augment/settings.json": {
+		format: "json",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcpServers"]
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["toolPermissions"]
+			}
+		}
+	},
+	".devin/config.json": {
+		format: "json",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcpServers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["permissions"]
+			}
+		}
+	},
+	".config/devin/config.json": {
+		format: "json",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcpServers"]
+			},
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["permissions"]
+			}
+		}
+	},
+	".kiro/agents/default.json": {
+		format: "json",
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["allowedTools", "toolsSettings"]
+			}
+		}
+	},
+	".amp/settings.json": {
+		format: "jsonc",
+		invalidRootPolicy: "error",
+		jsoncParseErrors: "error",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["amp.mcpServers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: [
+					"amp.tools.disable",
+					"amp.permissions",
+					"amp.guardedFiles.allowlist",
+					"amp.dangerouslyAllowAll",
+					"amp.mcpPermissions"
+				]
+			}
+		}
+	},
+	".config/amp/settings.json": {
+		format: "jsonc",
+		invalidRootPolicy: "error",
+		jsoncParseErrors: "error",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["amp.mcpServers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: [
+					"amp.tools.disable",
+					"amp.permissions",
+					"amp.guardedFiles.allowlist",
+					"amp.dangerouslyAllowAll",
+					"amp.mcpPermissions"
+				]
+			}
+		}
+	},
+	"opencode.json": {
+		format: "jsonc",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp", "tools"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["permission"]
+			},
+			rules: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["instructions"]
+			}
+		}
+	},
+	".config/opencode/opencode.json": {
+		format: "jsonc",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp", "tools"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["permission"]
+			}
+		}
+	},
+	"kilo.json": {
+		format: "jsonc",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp", "tools"]
+			},
+			rules: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["instructions"]
+			}
+		}
+	},
+	".config/kilo/kilo.json": {
+		format: "jsonc",
+		features: { mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp", "tools"]
+		} }
+	},
+	[CODEXCLI_CONFIG_SHARED_FILE_KEY]: {
+		format: "toml",
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["features"]
+			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp_servers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: [
+					"permissions",
+					"default_permissions",
+					...CODEXCLI_OVERRIDE_KEYS
+				]
+			}
+		}
+	},
+	[GROKCLI_CONFIG_SHARED_FILE_KEY]: {
+		format: "toml",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp_servers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["permission", "ui"]
+			}
+		}
+	},
+	[VIBE_CONFIG_SHARED_FILE_KEY]: {
+		format: "toml",
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["enable_experimental_hooks"]
+			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["mcp_servers"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: [
+					"tools",
+					"enabled_tools",
+					"disabled_tools"
+				]
+			}
+		}
+	},
+	[REASONIX_PROJECT_CONFIG_SHARED_FILE_KEY]: {
+		format: "toml",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["plugins"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: [
+					"permissions",
+					"sandbox",
+					"agent"
+				]
+			}
+		}
+	},
+	[REASONIX_GLOBAL_CONFIG_SHARED_FILE_KEY]: {
+		format: "toml",
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["plugins"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: [
+					"permissions",
+					"sandbox",
+					"agent"
+				]
+			}
+		}
 	}
 };
 /**
@@ -4224,17 +4552,20 @@ function applySharedConfigPatch({ fileKey, feature, existingContent, patch, file
 		format: declaration.format,
 		fileContent: existingContent,
 		filePath,
-		...declaration.invalidRootPolicy !== void 0 && { invalidRootPolicy: declaration.invalidRootPolicy }
+		...declaration.invalidRootPolicy !== void 0 && { invalidRootPolicy: declaration.invalidRootPolicy },
+		...declaration.jsoncParseErrors !== void 0 && { jsoncParseErrors: declaration.jsoncParseErrors }
 	});
 	if (policy.kind === "replace-owned-keys") {
 		const unowned = Object.keys(patch).filter((key) => !policy.ownedKeys.includes(key));
 		if (unowned.length > 0) throw new Error(`Feature '${feature}' tried to write undeclared keys [${unowned.join(", ")}] to '${fileKey}'; extend its ownedKeys declaration if that ownership is intended.`);
+		const document = mergeSharedConfigShallow({
+			base,
+			patch
+		});
+		for (const [key, value] of Object.entries(patch)) if (value === void 0) delete document[key];
 		return stringifySharedConfig({
 			format: declaration.format,
-			document: mergeSharedConfigShallow({
-				base,
-				patch
-			})
+			document
 		});
 	}
 	const merged = mergeSharedConfigDeep({
@@ -7307,12 +7638,6 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 		const paths = AugmentcodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
-		let settings;
-		try {
-			settings = JSON.parse(existingContent);
-		} catch (error) {
-			throw new Error(`Failed to parse existing AugmentCode settings at ${filePath}: ${formatError(error)}`, { cause: error });
-		}
 		const config = rulesyncHooks.getJson();
 		const augmentHooks = canonicalToToolHooks({
 			config,
@@ -7320,11 +7645,13 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 			converterConfig: AUGMENTCODE_CONVERTER_CONFIG,
 			logger
 		});
-		const merged = {
-			...settings,
-			hooks: augmentHooks
-		};
-		const fileContent = JSON.stringify(merged, null, 2);
+		const fileContent = applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "hooks",
+			existingContent,
+			patch: { hooks: augmentHooks },
+			filePath
+		});
 		return new AugmentcodeHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -7491,15 +7818,28 @@ const CODEXCLI_CONVERTER_CONFIG = {
 */
 async function buildCodexConfigTomlContent({ outputRoot }) {
 	const configPath = (0, node_path.join)(outputRoot, CODEXCLI_DIR, CODEXCLI_MCP_FILE_NAME);
-	const existingContent = await readFileContentOrNull(configPath) ?? smol_toml.stringify({});
+	const existingContent = await readFileContentOrNull(configPath) ?? "";
 	let configToml;
 	try {
-		configToml = smol_toml.parse(existingContent);
+		configToml = smol_toml.parse(existingContent || smol_toml.stringify({}));
 	} catch (error) {
 		throw new Error(`Failed to parse existing Codex CLI config at ${configPath}: ${formatError(error)}`, { cause: error });
 	}
-	if (typeof configToml.features === "object" && configToml.features !== null) delete configToml.features.codex_hooks;
-	return smol_toml.stringify(configToml);
+	let features;
+	if (typeof configToml.features === "object" && configToml.features !== null) {
+		features = { ...configToml.features };
+		delete features.codex_hooks;
+	}
+	return applySharedConfigPatch({
+		fileKey: sharedConfigFileKey({
+			relativeDirPath: CODEXCLI_DIR,
+			relativeFilePath: CODEXCLI_MCP_FILE_NAME
+		}),
+		feature: "hooks",
+		existingContent,
+		patch: { features },
+		filePath: configPath
+	});
 }
 /**
 * Represents the `.codex/config.toml` file as a generated ToolFile,
@@ -8415,17 +8755,13 @@ var DevinHooks = class DevinHooks extends ToolHooks {
 		let fileContent;
 		if (global) {
 			const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
-			let parsedSettings;
-			try {
-				parsedSettings = JSON.parse(existingContent);
-			} catch (error) {
-				throw new Error(`Failed to parse existing Devin config at ${filePath}: ${formatError(error)}`, { cause: error });
-			}
-			const merged = {
-				...isRecord(parsedSettings) ? parsedSettings : {},
-				hooks: devinHooks
-			};
-			fileContent = JSON.stringify(merged, null, 2);
+			fileContent = applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "hooks",
+				existingContent,
+				patch: { hooks: devinHooks },
+				filePath
+			});
 		} else {
 			await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
 			fileContent = JSON.stringify(devinHooks, null, 2);
@@ -9237,18 +9573,14 @@ var KiroHooks = class KiroHooks extends ToolHooks {
 		const paths = KiroHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
-		let agentConfig;
-		try {
-			agentConfig = JSON.parse(existingContent);
-		} catch (error) {
-			throw new Error(`Failed to parse existing Kiro agent config at ${filePath}: ${formatError(error)}`, { cause: error });
-		}
 		const kiroHooks = canonicalToKiroHooks(rulesyncHooks.getJson(), this.getOverrideKey());
-		const merged = {
-			...agentConfig,
-			hooks: kiroHooks
-		};
-		const fileContent = JSON.stringify(merged, null, 2);
+		const fileContent = applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "hooks",
+			existingContent,
+			patch: { hooks: kiroHooks },
+			filePath
+		});
 		return new KiroHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -9743,21 +10075,17 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 		const paths = QwencodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
-		let settings;
-		try {
-			settings = JSON.parse(existingContent);
-		} catch (error) {
-			throw new Error(`Failed to parse existing Qwen Code settings at ${filePath}: ${formatError(error)}`, { cause: error });
-		}
 		const config = rulesyncHooks.getJson();
-		const qwencodeHooks = canonicalToQwencodeHooks(config);
-		const merged = {
-			...settings,
-			hooks: qwencodeHooks
-		};
+		const patch = { hooks: canonicalToQwencodeHooks(config) };
 		const disableAllHooks = config.qwencode?.disableAllHooks;
-		if (typeof disableAllHooks === "boolean") merged.disableAllHooks = disableAllHooks;
-		const fileContent = JSON.stringify(merged, null, 2);
+		if (typeof disableAllHooks === "boolean") patch.disableAllHooks = disableAllHooks;
+		const fileContent = applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "hooks",
+			existingContent,
+			patch,
+			filePath
+		});
 		return new QwencodeHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -10016,10 +10344,6 @@ function canonicalToVibeHooks(config, toolOverride) {
 	}
 	return { hooks };
 }
-/**
-* Reverse {@link canonicalToVibeHooks}: parse the flat `[[hooks]]` array back
-* into a canonical event → definition[] record.
-*/
 /** Convert one raw `[[hooks]]` entry to a canonical definition, or null to skip. */
 function vibeEntryToCanonicalDef(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
@@ -10039,6 +10363,10 @@ function vibeEntryToCanonicalDef(raw) {
 		def
 	};
 }
+/**
+* Reverse {@link canonicalToVibeHooks}: parse the flat `[[hooks]]` array back
+* into a canonical event → definition[] record.
+*/
 function vibeHooksToCanonical(parsed) {
 	const canonical = {};
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return canonical;
@@ -10067,15 +10395,22 @@ function parseVibeToml(fileContent) {
 */
 async function buildVibeConfigTomlContent({ outputRoot }) {
 	const configPath = (0, node_path.join)(outputRoot, VIBE_DIR, VIBE_CONFIG_FILE_NAME);
-	const existingContent = await readFileContentOrNull(configPath) ?? smol_toml.stringify({});
-	let config;
+	const existingContent = await readFileContentOrNull(configPath) ?? "";
 	try {
-		config = parseVibeToml(existingContent);
+		parseVibeToml(existingContent);
 	} catch (error) {
 		throw new Error(`Failed to parse existing Vibe config at ${configPath}: ${formatError(error)}`, { cause: error });
 	}
-	config.enable_experimental_hooks = true;
-	return smol_toml.stringify(config);
+	return applySharedConfigPatch({
+		fileKey: sharedConfigFileKey({
+			relativeDirPath: VIBE_DIR,
+			relativeFilePath: VIBE_CONFIG_FILE_NAME
+		}),
+		feature: "hooks",
+		existingContent,
+		patch: { enable_experimental_hooks: true },
+		filePath: configPath
+	});
 }
 /**
 * Represents the `.vibe/config.toml` file as a generated ToolFile so it goes
@@ -11575,17 +11910,18 @@ var ZedIgnore = class ZedIgnore extends ToolIgnore {
 		const patterns = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
 		const filePath = (0, node_path.join)(outputRoot, this.getSettablePaths().relativeDirPath, this.getSettablePaths().relativeFilePath);
 		const existingFileContent = await fileExists(filePath) ? await readFileContent(filePath) : "{}";
-		const existingJsonValue = JSON.parse(existingFileContent);
-		const mergedPatterns = (0, es_toolkit.uniq)([...existingJsonValue.private_files ?? [], ...patterns].toSorted());
-		const jsonValue = {
-			...existingJsonValue,
-			private_files: mergedPatterns
-		};
+		const mergedPatterns = (0, es_toolkit.uniq)([...JSON.parse(existingFileContent).private_files ?? [], ...patterns].toSorted());
 		return new ZedIgnore({
 			outputRoot,
 			relativeDirPath: this.getSettablePaths().relativeDirPath,
 			relativeFilePath: this.getSettablePaths().relativeFilePath,
-			fileContent: JSON.stringify(jsonValue, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(this.getSettablePaths()),
+				feature: "ignore",
+				existingContent: existingFileContent,
+				patch: { private_files: mergedPatterns },
+				filePath
+			}),
 			validate: true
 		});
 	}
@@ -12042,17 +12378,17 @@ var AmpMcp = class AmpMcp extends ToolMcp {
 		const basePaths = this.getSettablePaths({ global });
 		const jsonDir = (0, node_path.join)(outputRoot, basePaths.relativeDirPath);
 		const { fileContent, relativeFilePath } = await this.resolveSettingsFile(jsonDir);
-		const json = fileContent ? parseAmpSettingsJsonc(fileContent) : { [AMP_MCP_SERVERS_KEY]: {} };
-		const filteredMcpServers = filterMcpServers(rulesyncMcp.getMcpServers());
-		const newJson = {
-			...json,
-			[AMP_MCP_SERVERS_KEY]: filteredMcpServers
-		};
 		return new AmpMcp({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(basePaths),
+				feature: "mcp",
+				existingContent: fileContent ?? "",
+				patch: { [AMP_MCP_SERVERS_KEY]: filterMcpServers(rulesyncMcp.getMcpServers()) },
+				filePath: (0, node_path.join)(jsonDir, relativeFilePath)
+			}),
 			validate,
 			global
 		});
@@ -12339,15 +12675,19 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const merged = {
-			...parseAugmentcodeSettings(await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), JSON.stringify({}, null, 2)), paths.relativeDirPath, paths.relativeFilePath),
-			mcpServers: rulesyncMcp.getMcpServers()
-		};
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({}, null, 2));
 		return new AugmentcodeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(merged, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { mcpServers: rulesyncMcp.getMcpServers() },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -12741,8 +13081,9 @@ var CodexcliMcp = class CodexcliMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const configTomlFileContent = await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), smol_toml.stringify({}));
-		const configToml = smol_toml.parse(configTomlFileContent);
+		const configTomlFilePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const configTomlFileContent = await readFileContentOrNull(configTomlFilePath) ?? "";
+		const configToml = smol_toml.parse(configTomlFileContent || smol_toml.stringify({}));
 		const strippedMcpServers = rulesyncMcp.getMcpServers();
 		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const converted = convertToCodexFormat(Object.fromEntries(Object.entries(strippedMcpServers).map(([serverName, serverConfig]) => {
@@ -12755,7 +13096,7 @@ var CodexcliMcp = class CodexcliMcp extends ToolMcp {
 		const filteredMcpServers = this.removeEmptyEntries(converted);
 		for (const name of Object.keys(converted)) if (!Object.hasOwn(filteredMcpServers, name)) warnWithFallback(void 0, `MCP server "${name}" had no non-empty configuration and was dropped from the codex CLI config`);
 		const existingMcpServers = isRecord(configToml["mcp_servers"]) ? configToml["mcp_servers"] : {};
-		configToml["mcp_servers"] = Object.fromEntries(Object.entries(filteredMcpServers).map(([name, serverConfig]) => {
+		const mergedMcpServers = Object.fromEntries(Object.entries(filteredMcpServers).map(([name, serverConfig]) => {
 			const existingServer = isRecord(existingMcpServers[name]) ? existingMcpServers[name] : void 0;
 			const serverRecord = serverConfig;
 			if (existingServer && isRecord(existingServer["tools"]) && !("tools" in serverRecord)) return [name, {
@@ -12768,7 +13109,13 @@ var CodexcliMcp = class CodexcliMcp extends ToolMcp {
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: smol_toml.stringify(configToml),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent: configTomlFileContent,
+				patch: { mcp_servers: mergedMcpServers },
+				filePath: configTomlFilePath
+			}),
 			validate
 		});
 	}
@@ -13335,16 +13682,19 @@ var DevinMcp = class DevinMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const fileContent = await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), JSON.stringify({ mcpServers: {} }, null, 2));
-		const devinConfig = {
-			...this.parseJsonOrThrow(fileContent, paths.relativeDirPath, paths.relativeFilePath),
-			mcpServers: rulesyncMcp.getMcpServers()
-		};
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({ mcpServers: {} }, null, 2));
 		return new DevinMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(devinConfig, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { mcpServers: rulesyncMcp.getMcpServers() },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -13831,17 +14181,22 @@ var GrokcliMcp = class GrokcliMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const configTomlFileContent = await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), smol_toml.stringify({}));
-		const configToml = smol_toml.parse(configTomlFileContent);
+		const configTomlFilePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const configTomlFileContent = await readFileContentOrNull(configTomlFilePath) ?? "";
 		const converted = convertToGrokFormat(rulesyncMcp.getMcpServers());
 		const filteredMcpServers = this.removeEmptyEntries(converted);
 		for (const name of Object.keys(converted)) if (!Object.hasOwn(filteredMcpServers, name)) warnWithFallback(void 0, `MCP server "${name}" had no non-empty configuration and was dropped from the grok CLI config`);
-		configToml["mcp_servers"] = filteredMcpServers;
 		return new GrokcliMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: smol_toml.stringify(configToml),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent: configTomlFileContent,
+				patch: { mcp_servers: filteredMcpServers },
+				filePath: configTomlFilePath
+			}),
 			validate
 		});
 	}
@@ -14374,20 +14729,21 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = KILO_JSON_FILE_NAME;
 		}
-		if (!fileContent) fileContent = JSON.stringify({ mcp: {} }, null, 2);
-		const json = (0, jsonc_parser.parse)(fileContent);
 		const { mcp: convertedMcp, tools: mcpTools } = convertToKiloFormat(rulesyncMcp.getMcpServers());
-		const { tools: _existingTools, ...jsonWithoutTools } = json;
-		const newJson = {
-			...jsonWithoutTools,
-			mcp: convertedMcp,
-			...Object.keys(mcpTools).length > 0 && { tools: mcpTools }
-		};
 		return new KiloMcp({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(basePaths),
+				feature: "mcp",
+				existingContent: fileContent ?? "",
+				patch: {
+					mcp: convertedMcp,
+					tools: Object.keys(mcpTools).length > 0 ? mcpTools : void 0
+				},
+				filePath: (0, node_path.join)(jsonDir, relativeFilePath)
+			}),
 			validate
 		});
 	}
@@ -14416,15 +14772,17 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 		const json = fileContent ? (0, jsonc_parser.parse)(fileContent) : {};
 		const existingInstructions = Array.isArray(json.instructions) ? json.instructions.filter((entry) => typeof entry === "string") : [];
 		const mergedInstructions = Array.from(/* @__PURE__ */ new Set([...existingInstructions, ...instructions])).toSorted();
-		const newJson = {
-			...json,
-			instructions: mergedInstructions
-		};
 		return new KiloMcp({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(basePaths),
+				feature: "rules",
+				existingContent: fileContent ?? "",
+				patch: { instructions: mergedInstructions },
+				filePath: (0, node_path.join)(jsonDir, relativeFilePath)
+			}),
 			validate
 		});
 	}
@@ -14696,23 +15054,24 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
-		if (!fileContent) fileContent = JSON.stringify({ mcp: {} }, null, 2);
-		const json = (0, jsonc_parser.parse)(fileContent);
 		const { mcp: convertedMcp, tools: mcpTools } = convertToOpencodeFormat(convertEnvVarRefsToToolFormat({
 			mcpServers: rulesyncMcp.getMcpServers(),
 			replacement: "{env:$1}"
 		}));
-		const { tools: _existingTools, ...jsonWithoutTools } = json;
-		const newJson = {
-			...jsonWithoutTools,
-			mcp: convertedMcp,
-			...Object.keys(mcpTools).length > 0 && { tools: mcpTools }
-		};
 		return new OpencodeMcp({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(basePaths),
+				feature: "mcp",
+				existingContent: fileContent ?? "",
+				patch: {
+					mcp: convertedMcp,
+					tools: Object.keys(mcpTools).length > 0 ? mcpTools : void 0
+				},
+				filePath: (0, node_path.join)(jsonDir, relativeFilePath)
+			}),
 			validate
 		});
 	}
@@ -14747,15 +15106,17 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 		const json = fileContent ? (0, jsonc_parser.parse)(fileContent) : {};
 		const existingInstructions = Array.isArray(json.instructions) ? json.instructions.filter((entry) => typeof entry === "string") : [];
 		const mergedInstructions = Array.from(/* @__PURE__ */ new Set([...existingInstructions, ...instructions])).toSorted();
-		const newJson = {
-			...json,
-			instructions: mergedInstructions
-		};
 		return new OpencodeMcp({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(basePaths),
+				feature: "rules",
+				existingContent: fileContent ?? "",
+				patch: { instructions: mergedInstructions },
+				filePath: (0, node_path.join)(jsonDir, relativeFilePath)
+			}),
 			validate
 		});
 	}
@@ -14865,16 +15226,19 @@ var QwencodeMcp = class QwencodeMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const fileContent = await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), JSON.stringify({ mcpServers: {} }, null, 2));
-		const newJson = {
-			...JSON.parse(fileContent),
-			mcpServers: convertToQwencodeFormat(rulesyncMcp.getMcpServers())
-		};
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readOrInitializeFileContent(filePath, JSON.stringify({ mcpServers: {} }, null, 2));
 		return new QwencodeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { mcpServers: convertToQwencodeFormat(rulesyncMcp.getMcpServers()) },
+				filePath
+			}),
 			validate
 		});
 	}
@@ -14959,13 +15323,20 @@ var ReasonixMcp = class ReasonixMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const config = parseReasonixConfig$1(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? smol_toml.stringify({}));
-		config.plugins = Object.entries(rulesyncMcp.getMcpServers()).map(([name, server]) => rulesyncMcpServerToReasonix(name, server));
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const plugins = Object.entries(rulesyncMcp.getMcpServers()).map(([name, server]) => rulesyncMcpServerToReasonix(name, server));
 		return new ReasonixMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: smol_toml.stringify(config),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { plugins },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -15440,13 +15811,20 @@ var VibeMcp = class VibeMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const config = parseVibeConfig$1(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? smol_toml.stringify({}));
-		config.mcp_servers = Object.entries(rulesyncMcp.getMcpServers()).map(([name, server]) => rulesyncMcpServerToVibe(name, server));
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const mcpServers = Object.entries(rulesyncMcp.getMcpServers()).map(([name, server]) => rulesyncMcpServerToVibe(name, server));
 		return new VibeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: smol_toml.stringify(config),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { mcp_servers: mcpServers },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -15677,16 +16055,19 @@ var ZedMcp = class ZedMcp extends ToolMcp {
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const fileContent = await readOrInitializeFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath), "{}");
-		const newJson = {
-			...JSON.parse(fileContent),
-			context_servers: rulesyncMcp.getMcpServers()
-		};
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readOrInitializeFileContent(filePath, "{}");
 		return new ZedMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { context_servers: rulesyncMcp.getMcpServers() },
+				filePath
+			}),
 			validate
 		});
 	}
@@ -16855,25 +17236,29 @@ var AmpPermissions = class AmpPermissions extends ToolPermissions {
 		const override = config.amp;
 		const authoredExtras = override?.permissions ? toPermissionsList(override.permissions) : [];
 		const preservedDelegates = override?.permissions ? [] : toPermissionsList(json[AMP_PERMISSIONS_KEY]).filter((entry) => entry.action === "delegate");
-		const newJson = {
-			...json,
-			[AMP_TOOLS_DISABLE_KEY]: disable
-		};
 		const mergedPermissions = mergeAmpPermissions([
 			...permissions,
 			...authoredExtras,
 			...preservedDelegates
 		]);
-		if (mergedPermissions.length > 0) newJson[AMP_PERMISSIONS_KEY] = mergedPermissions;
-		else delete newJson[AMP_PERMISSIONS_KEY];
-		if (override?.guardedFiles?.allowlist !== void 0) newJson[AMP_GUARDED_FILES_ALLOWLIST_KEY] = override.guardedFiles.allowlist;
-		if (override?.dangerouslyAllowAll !== void 0) newJson[AMP_DANGEROUSLY_ALLOW_ALL_KEY] = override.dangerouslyAllowAll;
-		if (override?.mcpPermissions !== void 0) newJson[AMP_MCP_PERMISSIONS_KEY] = override.mcpPermissions;
+		const patch = {
+			[AMP_TOOLS_DISABLE_KEY]: disable,
+			[AMP_PERMISSIONS_KEY]: mergedPermissions.length > 0 ? mergedPermissions : void 0
+		};
+		if (override?.guardedFiles?.allowlist !== void 0) patch[AMP_GUARDED_FILES_ALLOWLIST_KEY] = override.guardedFiles.allowlist;
+		if (override?.dangerouslyAllowAll !== void 0) patch[AMP_DANGEROUSLY_ALLOW_ALL_KEY] = override.dangerouslyAllowAll;
+		if (override?.mcpPermissions !== void 0) patch[AMP_MCP_PERMISSIONS_KEY] = override.mcpPermissions;
 		return new AmpPermissions({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(basePaths),
+				feature: "permissions",
+				existingContent: fileContent ?? "",
+				patch,
+				filePath: (0, node_path.join)(jsonDir, relativeFilePath)
+			}),
 			validate: true
 		});
 	}
@@ -17815,11 +18200,13 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 			...preservedBasicEntries,
 			...authoredBasics
 		]);
-		const merged = {
-			...settings,
-			toolPermissions: [...specialEntries, ...sortedBasic]
-		};
-		const fileContent = JSON.stringify(merged, null, 2);
+		const fileContent = applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "permissions",
+			existingContent,
+			patch: { toolPermissions: [...specialEntries, ...sortedBasic] },
+			filePath
+		});
 		return new AugmentcodePermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -18411,13 +18798,6 @@ const WORKSPACE_WIDE_WRITE_PATTERNS = /* @__PURE__ */ new Set([
 ]);
 const CODEX_MINIMAL_KEY = ":minimal";
 const GLOBAL_WILDCARD_DOMAIN = "*";
-const CODEXCLI_OVERRIDE_KEYS = [
-	"approval_policy",
-	"sandbox_mode",
-	"sandbox_workspace_write",
-	"apps",
-	"approvals_reviewer"
-];
 var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 	static getSettablePaths(_options = {}) {
 		return {
@@ -18441,26 +18821,27 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const existingContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? smol_toml.stringify({});
-		const parsed = toMutableTable(smol_toml.parse(existingContent));
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = toMutableTable(smol_toml.parse(existingContent || smol_toml.stringify({})));
 		const newProfile = convertRulesyncToCodexProfile({
 			config: rulesyncPermissions.getJson(),
 			logger
 		});
-		const permissionsTable = toMutableTable(parsed.permissions);
+		const permissionsTable = toMutableTable(existing.permissions);
 		const { profile: existingProfile, domainsHadUnknown: existingDomainsHadUnknown } = toCodexProfile(permissionsTable[RULESYNC_PROFILE_NAME]);
-		if (existingProfile?.extends !== void 0 && existingProfile.extends !== newProfile.extends) logger?.warn(`Existing "extends" value "${existingProfile.extends}" will be replaced by Rulesync-managed "${newProfile.extends ?? "(none)"}".`);
-		if (existingProfile?.network?.unix_sockets !== void 0) logger?.warn(`Preserving existing "network.unix_sockets" from config. Review these entries manually as they may grant broad system access.`);
-		if (existingProfile?.network?.mode !== void 0) logger?.warn(`Preserving existing "network.mode" from config. Review this value manually as it may grant broader network access than the Rulesync-managed domain rules.`);
-		if (existingDomainsHadUnknown) logger?.warn(`Existing "network.domains" contained unrecognized values. These entries were skipped and will not be imported.`);
+		warnAboutPreservedProfileState({
+			existingProfile,
+			newProfile,
+			existingDomainsHadUnknown,
+			logger
+		});
 		permissionsTable[RULESYNC_PROFILE_NAME] = mergeWithExistingProfile({
 			newProfile,
 			existingProfile
 		});
-		parsed.permissions = permissionsTable;
-		parsed.default_permissions = RULESYNC_PROFILE_NAME;
-		applyCodexcliOverride({
-			parsed,
+		const overridePatch = computeCodexcliOverridePatch({
+			existing,
 			override: rulesyncPermissions.getJson().codexcli,
 			logger
 		});
@@ -18468,7 +18849,17 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: smol_toml.stringify(parsed),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: {
+					permissions: permissionsTable,
+					default_permissions: RULESYNC_PROFILE_NAME,
+					...overridePatch
+				},
+				filePath
+			}),
 			validate
 		});
 	}
@@ -18638,6 +19029,12 @@ function toCodexProfile(value) {
 		domainsHadUnknown
 	};
 }
+function warnAboutPreservedProfileState({ existingProfile, newProfile, existingDomainsHadUnknown, logger }) {
+	if (existingProfile?.extends !== void 0 && existingProfile.extends !== newProfile.extends) logger?.warn(`Existing "extends" value "${existingProfile.extends}" will be replaced by Rulesync-managed "${newProfile.extends ?? "(none)"}".`);
+	if (existingProfile?.network?.unix_sockets !== void 0) logger?.warn(`Preserving existing "network.unix_sockets" from config. Review these entries manually as they may grant broad system access.`);
+	if (existingProfile?.network?.mode !== void 0) logger?.warn(`Preserving existing "network.mode" from config. Review this value manually as it may grant broader network access than the Rulesync-managed domain rules.`);
+	if (existingDomainsHadUnknown) logger?.warn(`Existing "network.domains" contained unrecognized values. These entries were skipped and will not be imported.`);
+}
 function mergeWithExistingProfile({ newProfile, existingProfile }) {
 	if (!existingProfile) return newProfile;
 	const mergedNetwork = { ...newProfile.network };
@@ -18688,8 +19085,9 @@ function toMutableTable(value) {
 function isPlainObject(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function applyCodexcliOverride({ parsed, override, logger }) {
-	if (!override) return;
+function computeCodexcliOverridePatch({ existing, override, logger }) {
+	const patch = {};
+	if (!override) return patch;
 	const allowed = new Set(CODEXCLI_OVERRIDE_KEYS);
 	for (const [key, value] of Object.entries(override)) {
 		if (!allowed.has(key)) {
@@ -18697,12 +19095,13 @@ function applyCodexcliOverride({ parsed, override, logger }) {
 			continue;
 		}
 		if (value === void 0) continue;
-		const existing = parsed[key];
-		parsed[key] = isPlainObject(existing) && isPlainObject(value) ? {
-			...existing,
+		const existingValue = existing[key];
+		patch[key] = isPlainObject(existingValue) && isPlainObject(value) ? {
+			...existingValue,
 			...value
 		} : value;
 	}
+	return patch;
 }
 function extractCodexcliOverride(table) {
 	const override = {};
@@ -19263,15 +19662,17 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 		else delete mergedPermissions.ask;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
-		const merged = {
-			...settings,
-			permissions: mergedPermissions
-		};
 		return new DevinPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(merged, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: { permissions: mergedPermissions },
+				filePath
+			}),
 			validate
 		});
 	}
@@ -19880,23 +20281,31 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		const config = rulesyncPermissions.getJson();
 		const existingPermission = isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {};
 		const buckets = buildGrokPermissionArrays(config, existingPermission, logger);
-		parsed[GROKCLI_PERMISSION_KEY] = {
+		const permission = {
 			...existingPermission,
 			allow: buckets.allow,
 			deny: buckets.deny,
 			ask: buckets.ask
 		};
 		const mode = deriveGrokPermissionMode(config);
-		const existingUi = isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {};
-		parsed[GROKCLI_UI_KEY] = {
-			...existingUi,
+		const ui = {
+			...isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {},
 			[GROKCLI_PERMISSION_MODE_KEY]: mode
 		};
 		return new GrokcliPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: smol_toml.stringify(parsed),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: {
+					[GROKCLI_PERMISSION_KEY]: permission,
+					[GROKCLI_UI_KEY]: ui
+				},
+				filePath
+			}),
 			validate: true,
 			global: true
 		});
@@ -20599,7 +21008,16 @@ var KiroPermissions = class KiroPermissions extends ToolPermissions {
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(next, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: {
+					allowedTools: next.allowedTools,
+					toolsSettings: next.toolsSettings
+				},
+				filePath
+			}),
 			validate
 		});
 	}
@@ -20896,21 +21314,22 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
-		const parsed = (0, jsonc_parser.parse)(fileContent ?? "{}");
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const overridePermission = rulesyncJson.opencode?.permission ?? {};
-		const nextJson = {
-			...parsed,
-			permission: {
-				...rulesyncJson.permission,
-				...overridePermission
-			}
-		};
 		return new OpencodePermissions({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify(nextJson, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(basePaths),
+				feature: "permissions",
+				existingContent: fileContent ?? "",
+				patch: { permission: {
+					...rulesyncJson.permission,
+					...overridePermission
+				} },
+				filePath: (0, node_path.join)(jsonDir, relativeFilePath)
+			}),
 			validate: true
 		});
 	}
@@ -21119,20 +21538,23 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 		else delete mergedPermissions.ask;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
-		const merged = {
-			...settings,
-			permissions: mergedPermissions
-		};
+		const patch = { permissions: mergedPermissions };
 		const override = config.qwencode;
-		if (override?.tools !== void 0) merged.tools = {
+		if (override?.tools !== void 0) patch.tools = {
 			...asPlainRecord(settings.tools),
 			...asPlainRecord(override.tools)
 		};
-		if (override?.security !== void 0) merged.security = {
+		if (override?.security !== void 0) patch.security = {
 			...asPlainRecord(settings.security),
 			...asPlainRecord(override.security)
 		};
-		const fileContent = JSON.stringify(merged, null, 2);
+		const fileContent = applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "permissions",
+			existingContent,
+			patch,
+			filePath
+		});
 		return new QwencodePermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -21367,7 +21789,9 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const parsed = parseReasonixConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? smol_toml.stringify({}));
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const parsed = parseReasonixConfig(existingContent);
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToReasonixPermissions(config);
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toReasonixToolName(category)));
@@ -21392,25 +21816,27 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		else delete mergedPermissions.ask;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
-		const merged = {
-			...parsed,
-			permissions: mergedPermissions
-		};
+		const patch = { permissions: mergedPermissions };
 		const override = config.reasonix;
-		if (override?.sandbox !== void 0) merged.sandbox = {
+		if (override?.sandbox !== void 0) patch.sandbox = {
 			...asReasonixRecord(parsed.sandbox),
 			...asReasonixRecord(override.sandbox)
 		};
-		if (override?.agent !== void 0) merged.agent = {
+		if (override?.agent !== void 0) patch.agent = {
 			...asReasonixRecord(parsed.agent),
 			...asReasonixRecord(override.agent)
 		};
-		const fileContent = smol_toml.stringify(merged);
 		return new ReasonixPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath
+			}),
 			validate
 		});
 	}
@@ -21981,7 +22407,9 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const config = parseVibeConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? smol_toml.stringify({}));
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const config = parseVibeConfig(existingContent);
 		const permission = rulesyncPermissions.getJson().permission;
 		const tools = toVibeToolsRecord(config.tools);
 		const enabledTools = new Set(toStringArray(config.enabled_tools));
@@ -22026,16 +22454,21 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			tools[vibeToolName] = nextTool;
 		}
 		applyVibeSensitivePatterns(tools, rulesyncPermissions.getJson().vibe);
-		config.tools = tools;
-		if (enabledTools.size > 0) config.enabled_tools = [...enabledTools].toSorted();
-		else delete config.enabled_tools;
-		if (disabledTools.size > 0) config.disabled_tools = [...disabledTools].toSorted();
-		else delete config.disabled_tools;
 		return new VibePermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: smol_toml.stringify(config),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: {
+					tools,
+					enabled_tools: enabledTools.size > 0 ? [...enabledTools].toSorted() : void 0,
+					disabled_tools: disabledTools.size > 0 ? [...disabledTools].toSorted() : void 0
+				},
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -22498,24 +22931,26 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		}
 		const managedToolNames = new Set(Object.keys(managedTools));
 		const preservedTools = Object.fromEntries(Object.entries(existingTools).filter(([toolName]) => !managedToolNames.has(toolName)));
-		const mergedSettings = {
-			...settings,
-			agent: {
-				...agent,
-				tool_permissions: {
-					...toolPermissions,
-					tools: {
-						...preservedTools,
-						...managedTools
-					}
-				}
-			}
-		};
 		return new ZedPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(mergedSettings, null, 2),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: { agent: {
+					...agent,
+					tool_permissions: {
+						...toolPermissions,
+						tools: {
+							...preservedTools,
+							...managedTools
+						}
+					}
+				} },
+				filePath
+			}),
 			validate: true
 		});
 	}
@@ -38205,8 +38640,13 @@ const collectFactoryPaths = (factory) => [...settablePathsForScope({
 * Derive, from the processor registry, every on-disk file that two or more
 * features read-modify-write. Source of truth the generation step graph's
 * `writesSharedFile` declarations must match.
+*
+* `minWriters: 1` widens the result to single-feature files as well — used to
+* validate `SHARED_CONFIG_OWNERSHIP` declarations for files that route through
+* the gateway without being cross-feature shared (e.g. a global-scope twin
+* only one feature writes).
 */
-const deriveSharedFileWriters = () => {
+const deriveSharedFileWriters = ({ minWriters = 2 } = {}) => {
 	const byKey = /* @__PURE__ */ new Map();
 	const pathByKey = /* @__PURE__ */ new Map();
 	for (const entry of PROCESSOR_REGISTRY) {
@@ -38232,7 +38672,7 @@ const deriveSharedFileWriters = () => {
 	}
 	const writers = [];
 	for (const [key, features] of byKey) {
-		if (features.size < 2) continue;
+		if (features.size < minWriters) continue;
 		const path = pathByKey.get(key);
 		const toolsByFeature = /* @__PURE__ */ new Map();
 		for (const [feature, tools] of features) toolsByFeature.set(feature, [...tools].toSorted());