rulesync 9.7.0 → 10.0.0

package/README.md

@@ -95,7 +95,7 @@ The tables below show whether each tool supports a given feature (✅ = supporte
 | GitHub Copilot CLI     |  ✅   |        | ✅  |          |    ✅     |   ✅   |  ✅   |             |
 | Goose                  |  ✅   |   ✅   | ✅  |    ✅    |    ✅     |   ✅   |  ✅   |     ✅      |
 | Hermes Agent           |  ✅   |        | ✅  |    ✅    |    ✅     |   ✅   |  ✅   |     ✅      |
-| Grok CLI               |  ✅   |        | ✅  |          |    ✅     |   ✅   |       |     ✅      |
+| Grok CLI               |  ✅   |        | ✅  |          |    ✅     |   ✅   |  ✅   |     ✅      |
 | Cursor                 |  ✅   |   ✅   | ✅  |    ✅    |    ✅     |   ✅   |  ✅   |     ✅      |
 | deepagents-cli         |  ✅   |        | ✅  |          |    ✅     |   ✅   |  ✅   |             |
 | Factory Droid          |  ✅   |        | ✅  |    ✅    |    ✅     |   ✅   |  ✅   |     ✅      |

package/dist/cli/index.cjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const require_import = require("../import-D5f_X4-A.cjs");
+const require_import = require("../import-Dcj5HiOE.cjs");
 let commander = require("commander");
 let zod_mini = require("zod/mini");
 let node_path = require("node:path");
@@ -542,9 +542,9 @@ const FEATURE_PATHS = {
 	subagents: ["subagents"],
 	skills: ["skills"],
 	ignore: [require_import.RULESYNC_AIIGNORE_FILE_NAME],
-	mcp: [require_import.RULESYNC_MCP_FILE_NAME],
-	hooks: [require_import.RULESYNC_HOOKS_FILE_NAME],
-	permissions: [require_import.RULESYNC_PERMISSIONS_FILE_NAME]
+	mcp: [require_import.RULESYNC_MCP_FILE_NAME, require_import.RULESYNC_MCP_JSONC_FILE_NAME],
+	hooks: [require_import.RULESYNC_HOOKS_FILE_NAME, require_import.RULESYNC_HOOKS_JSONC_FILE_NAME],
+	permissions: [require_import.RULESYNC_PERMISSIONS_FILE_NAME, require_import.RULESYNC_PERMISSIONS_JSONC_FILE_NAME]
 };
 /**
 * Check if target is a tool target (not rulesync)
@@ -1425,6 +1425,11 @@ const GITIGNORE_ENTRY_REGISTRY = [
 			target: "codexcli",
 			feature: "ignore",
 			entry: "**/.codexignore"
+		},
+		{
+			target: "codexcli",
+			feature: "permissions",
+			entry: `**/${require_import.CODEXCLI_DIR}/rules/`
 		}
 	],
 	...deriveAllGitignoreEntries(),
@@ -1499,45 +1504,69 @@ const resolveGitignoreEntries = (params) => {
 //#endregion
 //#region src/cli/commands/gitignore.ts
 const RULESYNC_HEADER = "# Generated by Rulesync";
+const RULESYNC_FOOTER = "# End of Rulesync";
 const LEGACY_RULESYNC_HEADER = "# Generated by rulesync - AI tool configuration files";
 const isRulesyncHeader = (line) => {
 	const trimmed = line.trim();
 	return trimmed === RULESYNC_HEADER || trimmed === LEGACY_RULESYNC_HEADER;
 };
+const isRulesyncFooter = (line) => {
+	return line.trim() === RULESYNC_FOOTER;
+};
 const isRulesyncEntry = (line) => {
 	const trimmed = line.trim();
-	if (trimmed === "" || isRulesyncHeader(line)) return false;
+	if (trimmed === "" || isRulesyncHeader(line) || isRulesyncFooter(line)) return false;
 	return ALL_GITIGNORE_ENTRIES.includes(trimmed);
 };
+const findRulesyncFooterIndex = (lines, start) => {
+	for (let index = start; index < lines.length; index++) {
+		const line = lines[index] ?? "";
+		if (isRulesyncFooter(line)) return index;
+		if (isRulesyncHeader(line)) return -1;
+	}
+	return -1;
+};
+const skipLegacyRulesyncBlock = (lines, headerIndex) => {
+	let index = headerIndex + 1;
+	let consecutiveEmptyLines = 0;
+	while (index < lines.length) {
+		const line = lines[index] ?? "";
+		if (line.trim() === "") {
+			consecutiveEmptyLines++;
+			index++;
+			if (consecutiveEmptyLines >= 2) break;
+			continue;
+		}
+		if (isRulesyncEntry(line)) {
+			consecutiveEmptyLines = 0;
+			index++;
+			continue;
+		}
+		break;
+	}
+	return index;
+};
 const removeExistingRulesyncEntries = (content) => {
 	const lines = content.split("\n");
 	const filteredLines = [];
-	let inRulesyncBlock = false;
-	let consecutiveEmptyLines = 0;
-	for (const line of lines) {
-		const trimmed = line.trim();
+	let index = 0;
+	while (index < lines.length) {
+		const line = lines[index] ?? "";
 		if (isRulesyncHeader(line)) {
-			inRulesyncBlock = true;
-			continue;
-		}
-		if (inRulesyncBlock) {
-			if (trimmed === "") {
-				consecutiveEmptyLines++;
-				if (consecutiveEmptyLines >= 2) {
-					inRulesyncBlock = false;
-					consecutiveEmptyLines = 0;
-				}
+			const footerIndex = findRulesyncFooterIndex(lines, index + 1);
+			if (footerIndex !== -1) {
+				index = footerIndex + 1;
 				continue;
 			}
-			if (isRulesyncEntry(line)) {
-				consecutiveEmptyLines = 0;
-				continue;
-			}
-			inRulesyncBlock = false;
-			consecutiveEmptyLines = 0;
+			index = skipLegacyRulesyncBlock(lines, index);
+			continue;
+		}
+		if (isRulesyncEntry(line)) {
+			index++;
+			continue;
 		}
-		if (isRulesyncEntry(line)) continue;
 		filteredLines.push(line);
+		index++;
 	}
 	let result = filteredLines.join("\n");
 	while (result.endsWith("\n\n")) result = result.slice(0, -1);
@@ -1579,10 +1608,14 @@ const gitignoreCommand = async (logger, options) => {
 		let content = "";
 		if (await require_import.fileExists(filePath)) content = await require_import.readFileContent(filePath);
 		const cleanedContent = removeExistingRulesyncEntries(content);
-		const existingEntries = new Set(content.split("\n").map((line) => line.trim()).filter((line) => line !== "" && !isRulesyncHeader(line)));
+		const existingEntries = new Set(content.split("\n").map((line) => line.trim()).filter((line) => line !== "" && !isRulesyncHeader(line) && !isRulesyncFooter(line)));
 		const alreadyExistedEntries = entries.filter((entry) => existingEntries.has(entry));
 		const entriesToAdd = entries.filter((entry) => !existingEntries.has(entry));
-		const rulesyncBlock = [RULESYNC_HEADER, ...entries].join("\n");
+		const rulesyncBlock = [
+			RULESYNC_HEADER,
+			...entries,
+			RULESYNC_FOOTER
+		].join("\n");
 		const newContent = entries.length === 0 ? cleanedContent.trim() ? `${cleanedContent.trimEnd()}\n` : "" : cleanedContent.trim() ? `${cleanedContent.trimEnd()}\n\n${rulesyncBlock}\n` : `${rulesyncBlock}\n`;
 		if (content === newContent) return {
 			updated: false,
@@ -1715,7 +1748,8 @@ async function createConfigFile() {
 			"commands",
 			"subagents",
 			"skills",
-			"hooks"
+			"hooks",
+			"permissions"
 		],
 		outputRoots: ["."],
 		delete: true,
@@ -1859,6 +1893,25 @@ Keep the summary concise and ready to reuse in future tasks.`
     ]
   }
 }
+` };
+	const samplePermissionsFile = { content: `{
+  "$schema": "${require_import.RULESYNC_PERMISSIONS_SCHEMA_URL}",
+  "permission": {
+    "bash": {
+      "git status": "allow",
+      "git diff": "allow",
+      "ls *": "allow",
+      "rm -rf *": "deny",
+      "*": "ask"
+    },
+    "edit": {
+      "src/**": "allow"
+    },
+    "read": {
+      ".env": "deny"
+    }
+  }
+}
 ` };
 	const rulePaths = require_import.RulesyncRule.getSettablePaths();
 	const mcpPaths = require_import.RulesyncMcp.getSettablePaths();
@@ -1867,6 +1920,7 @@ Keep the summary concise and ready to reuse in future tasks.`
 	const skillPaths = require_import.RulesyncSkill.getSettablePaths();
 	const ignorePaths = require_import.RulesyncIgnore.getSettablePaths();
 	const hooksPaths = require_import.RulesyncHooks.getSettablePaths();
+	const permissionsPaths = require_import.RulesyncPermissions.getSettablePaths();
 	await require_import.ensureDir(rulePaths.recommended.relativeDirPath);
 	await require_import.ensureDir(mcpPaths.recommended.relativeDirPath);
 	await require_import.ensureDir(commandPaths.relativeDirPath);
@@ -1889,6 +1943,8 @@ Keep the summary concise and ready to reuse in future tasks.`
 	results.push(await writeIfNotExists(ignoreFilepath, sampleIgnoreFile.content));
 	const hooksFilepath = (0, node_path.join)(hooksPaths.relativeDirPath, hooksPaths.relativeFilePath);
 	results.push(await writeIfNotExists(hooksFilepath, sampleHooksFile.content));
+	const permissionsFilepath = (0, node_path.join)(permissionsPaths.relativeDirPath, permissionsPaths.relativeFilePath);
+	results.push(await writeIfNotExists(permissionsFilepath, samplePermissionsFile.content));
 	return results;
 }
 async function writeIfNotExists(path, content) {
@@ -1930,7 +1986,7 @@ async function initCommand(logger) {
 	}
 	logger.success("rulesync initialized successfully!");
 	logger.info("Next steps:");
-	logger.info(`1. Edit ${require_import.RULESYNC_RELATIVE_DIR_PATH}/**/*.md, ${require_import.RULESYNC_RELATIVE_DIR_PATH}/skills/*/${require_import.SKILL_FILE_NAME}, ${require_import.RULESYNC_MCP_RELATIVE_FILE_PATH}, ${require_import.RULESYNC_HOOKS_RELATIVE_FILE_PATH} and ${require_import.RULESYNC_AIIGNORE_RELATIVE_FILE_PATH}`);
+	logger.info(`1. Edit ${require_import.RULESYNC_RELATIVE_DIR_PATH}/**/*.md, ${require_import.RULESYNC_RELATIVE_DIR_PATH}/skills/*/${require_import.SKILL_FILE_NAME}, ${require_import.RULESYNC_MCP_RELATIVE_FILE_PATH}, ${require_import.RULESYNC_HOOKS_RELATIVE_FILE_PATH}, ${require_import.RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH} and ${require_import.RULESYNC_AIIGNORE_RELATIVE_FILE_PATH}`);
 	logger.info("2. Run 'rulesync generate' to create configuration files");
 }
 //#endregion
@@ -4740,6 +4796,8 @@ async function putHooksFile({ content }) {
 	try {
 		const outputRoot = process.cwd();
 		const paths = require_import.RulesyncHooks.getSettablePaths();
+		const jsoncRelativePath = (0, node_path.join)(paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath);
+		if (await require_import.fileExists((0, node_path.join)(outputRoot, jsoncRelativePath))) throw new Error(`${jsoncRelativePath} exists and takes precedence over ${require_import.RULESYNC_HOOKS_RELATIVE_FILE_PATH}. Edit ${jsoncRelativePath} directly instead.`);
 		const relativeDirPath = paths.relativeDirPath;
 		const relativeFilePath = paths.relativeFilePath;
 		const fullPath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
@@ -4768,6 +4826,7 @@ async function deleteHooksFile() {
 		const outputRoot = process.cwd();
 		const paths = require_import.RulesyncHooks.getSettablePaths();
 		await require_import.removeFile((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		await require_import.removeFile((0, node_path.join)(outputRoot, paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath));
 		return { relativePathFromCwd: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath) };
 	} catch (error) {
 		throw new Error(`Failed to delete hooks file (${require_import.RULESYNC_HOOKS_RELATIVE_FILE_PATH}): ${require_import.formatError(error)}`, { cause: error });
@@ -5018,6 +5077,8 @@ async function putMcpFile({ content }) {
 	try {
 		const outputRoot = process.cwd();
 		const paths = require_import.RulesyncMcp.getSettablePaths();
+		const jsoncRelativePath = (0, node_path.join)(paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath);
+		if (await require_import.fileExists((0, node_path.join)(outputRoot, jsoncRelativePath))) throw new Error(`${jsoncRelativePath} exists and takes precedence over ${require_import.RULESYNC_MCP_RELATIVE_FILE_PATH}. Edit ${jsoncRelativePath} directly instead.`);
 		const relativeDirPath = paths.recommended.relativeDirPath;
 		const relativeFilePath = paths.recommended.relativeFilePath;
 		const fullPath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
@@ -5048,6 +5109,7 @@ async function deleteMcpFile() {
 		const recommendedPath = (0, node_path.join)(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath);
 		const legacyPath = (0, node_path.join)(outputRoot, paths.legacy.relativeDirPath, paths.legacy.relativeFilePath);
 		await require_import.removeFile(recommendedPath);
+		await require_import.removeFile((0, node_path.join)(outputRoot, paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath));
 		await require_import.removeFile(legacyPath);
 		return { relativePathFromCwd: (0, node_path.join)(paths.recommended.relativeDirPath, paths.recommended.relativeFilePath) };
 	} catch (error) {
@@ -5124,6 +5186,8 @@ async function putPermissionsFile({ content }) {
 	try {
 		const outputRoot = process.cwd();
 		const paths = require_import.RulesyncPermissions.getSettablePaths();
+		const jsoncRelativePath = (0, node_path.join)(paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath);
+		if (await require_import.fileExists((0, node_path.join)(outputRoot, jsoncRelativePath))) throw new Error(`${jsoncRelativePath} exists and takes precedence over ${require_import.RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}. Edit ${jsoncRelativePath} directly instead.`);
 		const relativeDirPath = paths.relativeDirPath;
 		const relativeFilePath = paths.relativeFilePath;
 		const fullPath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
@@ -5152,6 +5216,7 @@ async function deletePermissionsFile() {
 		const outputRoot = process.cwd();
 		const paths = require_import.RulesyncPermissions.getSettablePaths();
 		await require_import.removeFile((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		await require_import.removeFile((0, node_path.join)(outputRoot, paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath));
 		return { relativePathFromCwd: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath) };
 	} catch (error) {
 		throw new Error(`Failed to delete permissions file (${require_import.RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}): ${require_import.formatError(error)}`, { cause: error });
@@ -6450,7 +6515,7 @@ function wrapCommand$1({ name, errorCode, handler, getVersion, loggerFactory = c
 }
 //#endregion
 //#region src/cli/index.ts
-const getVersion = () => "9.7.0";
+const getVersion = () => "10.0.0";
 function wrapCommand(name, errorCode, handler) {
 	return wrapCommand$1({
 		name,

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as removeTempDirectory, A as RulesyncCommand, B as checkPathTraversal, C as RulesyncHooks, Ct as RULESYNC_RULES_RELATIVE_DIR_PATH, D as CLAUDECODE_MEMORIES_DIR_NAME, Dt as formatError, E as CLAUDECODE_LOCAL_RULE_FILE_NAME, Et as RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, F as findControlCharacter, G as findFilesByGlobs, H as directoryExists, I as ConsoleLogger, J as isSymlink, K as getFileSize, L as JsonLogger, M as stringifyFrontmatter, N as loadYaml, O as CLAUDECODE_SETTINGS_LOCAL_FILE_NAME, Ot as ALL_FEATURES, P as ConfigResolver, Q as removeFile, R as CLIError, S as HooksProcessor, St as RULESYNC_RELATIVE_DIR_PATH, T as CLAUDECODE_DIR, Tt as RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH, U as ensureDir, V as createTempDirectory, W as fileExists, X as readFileContent, Y as listDirectoryFiles, Z as removeDirectory, _ as RulesyncPermissions, _t as RULESYNC_MCP_RELATIVE_FILE_PATH, a as convertFromTool, at as MAX_FILE_SIZE, b as IgnoreProcessor, bt as RULESYNC_PERMISSIONS_FILE_NAME, c as RulesyncRuleFrontmatterSchema, ct as RULESYNC_COMMANDS_RELATIVE_DIR_PATH, d as RulesyncSubagentFrontmatterSchema, dt as RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH, et as toPosixPath, f as SkillsProcessor, ft as RULESYNC_HOOKS_FILE_NAME, g as SKILL_FILE_NAME$1, gt as RULESYNC_MCP_FILE_NAME, h as RulesyncSkillFrontmatterSchema, ht as RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH, i as getProcessorRegistryEntry, it as ToolTargetSchema, j as RulesyncCommandFrontmatterSchema, k as CLAUDECODE_SKILLS_DIR_PATH, kt as ALL_FEATURES_WITH_WILDCARD, l as SubagentsProcessor, lt as RULESYNC_CONFIG_RELATIVE_FILE_PATH, m as RulesyncSkill, mt as RULESYNC_IGNORE_RELATIVE_FILE_PATH, n as checkRulesyncDirExists, nt as ALL_TOOL_TARGETS, o as RulesProcessor, ot as RULESYNC_AIIGNORE_FILE_NAME, p as getLocalSkillDirNames, pt as RULESYNC_HOOKS_RELATIVE_FILE_PATH, q as getHomeDirectory, r as generate, rt as ALL_TOOL_TARGETS_WITH_WILDCARD, s as RulesyncRule, st as RULESYNC_AIIGNORE_RELATIVE_FILE_PATH, t as importFromTool, tt as writeFileContent, u as RulesyncSubagent, ut as RULESYNC_CONFIG_SCHEMA_URL, v as McpProcessor, vt as RULESYNC_MCP_SCHEMA_URL, w as CommandsProcessor, wt as RULESYNC_SKILLS_RELATIVE_DIR_PATH, x as RulesyncIgnore, xt as RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH, y as RulesyncMcp, yt as RULESYNC_OVERVIEW_FILE_NAME, z as ErrorCodes } from "../import-DC9T1JlQ.js";
+import { $ as removeFile, A as CLAUDECODE_SKILLS_DIR_PATH, At as RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH, B as ErrorCodes, C as RulesyncHooks, Ct as RULESYNC_PERMISSIONS_FILE_NAME, D as CLAUDECODE_LOCAL_RULE_FILE_NAME, Dt as RULESYNC_RELATIVE_DIR_PATH, E as CLAUDECODE_DIR, Et as RULESYNC_PERMISSIONS_SCHEMA_URL, F as ConfigResolver, G as fileExists, H as createTempDirectory, I as findControlCharacter, J as getHomeDirectory, K as findFilesByGlobs, L as ConsoleLogger, M as RulesyncCommandFrontmatterSchema, Mt as formatError, N as stringifyFrontmatter, Nt as ALL_FEATURES, O as CLAUDECODE_MEMORIES_DIR_NAME, Ot as RULESYNC_RULES_RELATIVE_DIR_PATH, P as loadYaml, Pt as ALL_FEATURES_WITH_WILDCARD, Q as removeDirectory, R as JsonLogger, S as HooksProcessor, St as RULESYNC_OVERVIEW_FILE_NAME, T as CODEXCLI_DIR, Tt as RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH, U as directoryExists, V as checkPathTraversal, W as ensureDir, X as listDirectoryFiles, Y as isSymlink, Z as readFileContent, _ as RulesyncPermissions, _t as RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH, a as convertFromTool, at as ToolTargetSchema, b as IgnoreProcessor, bt as RULESYNC_MCP_RELATIVE_FILE_PATH, c as RulesyncRuleFrontmatterSchema, ct as RULESYNC_AIIGNORE_RELATIVE_FILE_PATH, d as RulesyncSubagentFrontmatterSchema, dt as RULESYNC_CONFIG_SCHEMA_URL, et as removeTempDirectory, f as SkillsProcessor, ft as RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH, g as SKILL_FILE_NAME$1, gt as RULESYNC_IGNORE_RELATIVE_FILE_PATH, h as RulesyncSkillFrontmatterSchema, ht as RULESYNC_HOOKS_RELATIVE_FILE_PATH, i as getProcessorRegistryEntry, it as ALL_TOOL_TARGETS_WITH_WILDCARD, j as RulesyncCommand, jt as RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, k as CLAUDECODE_SETTINGS_LOCAL_FILE_NAME, kt as RULESYNC_SKILLS_RELATIVE_DIR_PATH, l as SubagentsProcessor, lt as RULESYNC_COMMANDS_RELATIVE_DIR_PATH, m as RulesyncSkill, mt as RULESYNC_HOOKS_JSONC_FILE_NAME, n as checkRulesyncDirExists, nt as writeFileContent, o as RulesProcessor, ot as MAX_FILE_SIZE, p as getLocalSkillDirNames, pt as RULESYNC_HOOKS_FILE_NAME, q as getFileSize, r as generate, rt as ALL_TOOL_TARGETS, s as RulesyncRule, st as RULESYNC_AIIGNORE_FILE_NAME, t as importFromTool, tt as toPosixPath, u as RulesyncSubagent, ut as RULESYNC_CONFIG_RELATIVE_FILE_PATH, v as McpProcessor, vt as RULESYNC_MCP_FILE_NAME, w as CommandsProcessor, wt as RULESYNC_PERMISSIONS_JSONC_FILE_NAME, x as RulesyncIgnore, xt as RULESYNC_MCP_SCHEMA_URL, y as RulesyncMcp, yt as RULESYNC_MCP_JSONC_FILE_NAME, z as CLIError } from "../import-B02AyWkQ.js";
 import { Command } from "commander";
 import { nonnegative, optional, refine, z } from "zod/mini";
 import * as path$1 from "node:path";
@@ -540,9 +540,9 @@ const FEATURE_PATHS = {
 	subagents: ["subagents"],
 	skills: ["skills"],
 	ignore: [RULESYNC_AIIGNORE_FILE_NAME],
-	mcp: [RULESYNC_MCP_FILE_NAME],
-	hooks: [RULESYNC_HOOKS_FILE_NAME],
-	permissions: [RULESYNC_PERMISSIONS_FILE_NAME]
+	mcp: [RULESYNC_MCP_FILE_NAME, RULESYNC_MCP_JSONC_FILE_NAME],
+	hooks: [RULESYNC_HOOKS_FILE_NAME, RULESYNC_HOOKS_JSONC_FILE_NAME],
+	permissions: [RULESYNC_PERMISSIONS_FILE_NAME, RULESYNC_PERMISSIONS_JSONC_FILE_NAME]
 };
 /**
 * Check if target is a tool target (not rulesync)
@@ -1423,6 +1423,11 @@ const GITIGNORE_ENTRY_REGISTRY = [
 			target: "codexcli",
 			feature: "ignore",
 			entry: "**/.codexignore"
+		},
+		{
+			target: "codexcli",
+			feature: "permissions",
+			entry: `**/${CODEXCLI_DIR}/rules/`
 		}
 	],
 	...deriveAllGitignoreEntries(),
@@ -1497,45 +1502,69 @@ const resolveGitignoreEntries = (params) => {
 //#endregion
 //#region src/cli/commands/gitignore.ts
 const RULESYNC_HEADER = "# Generated by Rulesync";
+const RULESYNC_FOOTER = "# End of Rulesync";
 const LEGACY_RULESYNC_HEADER = "# Generated by rulesync - AI tool configuration files";
 const isRulesyncHeader = (line) => {
 	const trimmed = line.trim();
 	return trimmed === RULESYNC_HEADER || trimmed === LEGACY_RULESYNC_HEADER;
 };
+const isRulesyncFooter = (line) => {
+	return line.trim() === RULESYNC_FOOTER;
+};
 const isRulesyncEntry = (line) => {
 	const trimmed = line.trim();
-	if (trimmed === "" || isRulesyncHeader(line)) return false;
+	if (trimmed === "" || isRulesyncHeader(line) || isRulesyncFooter(line)) return false;
 	return ALL_GITIGNORE_ENTRIES.includes(trimmed);
 };
+const findRulesyncFooterIndex = (lines, start) => {
+	for (let index = start; index < lines.length; index++) {
+		const line = lines[index] ?? "";
+		if (isRulesyncFooter(line)) return index;
+		if (isRulesyncHeader(line)) return -1;
+	}
+	return -1;
+};
+const skipLegacyRulesyncBlock = (lines, headerIndex) => {
+	let index = headerIndex + 1;
+	let consecutiveEmptyLines = 0;
+	while (index < lines.length) {
+		const line = lines[index] ?? "";
+		if (line.trim() === "") {
+			consecutiveEmptyLines++;
+			index++;
+			if (consecutiveEmptyLines >= 2) break;
+			continue;
+		}
+		if (isRulesyncEntry(line)) {
+			consecutiveEmptyLines = 0;
+			index++;
+			continue;
+		}
+		break;
+	}
+	return index;
+};
 const removeExistingRulesyncEntries = (content) => {
 	const lines = content.split("\n");
 	const filteredLines = [];
-	let inRulesyncBlock = false;
-	let consecutiveEmptyLines = 0;
-	for (const line of lines) {
-		const trimmed = line.trim();
+	let index = 0;
+	while (index < lines.length) {
+		const line = lines[index] ?? "";
 		if (isRulesyncHeader(line)) {
-			inRulesyncBlock = true;
-			continue;
-		}
-		if (inRulesyncBlock) {
-			if (trimmed === "") {
-				consecutiveEmptyLines++;
-				if (consecutiveEmptyLines >= 2) {
-					inRulesyncBlock = false;
-					consecutiveEmptyLines = 0;
-				}
+			const footerIndex = findRulesyncFooterIndex(lines, index + 1);
+			if (footerIndex !== -1) {
+				index = footerIndex + 1;
 				continue;
 			}
-			if (isRulesyncEntry(line)) {
-				consecutiveEmptyLines = 0;
-				continue;
-			}
-			inRulesyncBlock = false;
-			consecutiveEmptyLines = 0;
+			index = skipLegacyRulesyncBlock(lines, index);
+			continue;
+		}
+		if (isRulesyncEntry(line)) {
+			index++;
+			continue;
 		}
-		if (isRulesyncEntry(line)) continue;
 		filteredLines.push(line);
+		index++;
 	}
 	let result = filteredLines.join("\n");
 	while (result.endsWith("\n\n")) result = result.slice(0, -1);
@@ -1577,10 +1606,14 @@ const gitignoreCommand = async (logger, options) => {
 		let content = "";
 		if (await fileExists(filePath)) content = await readFileContent(filePath);
 		const cleanedContent = removeExistingRulesyncEntries(content);
-		const existingEntries = new Set(content.split("\n").map((line) => line.trim()).filter((line) => line !== "" && !isRulesyncHeader(line)));
+		const existingEntries = new Set(content.split("\n").map((line) => line.trim()).filter((line) => line !== "" && !isRulesyncHeader(line) && !isRulesyncFooter(line)));
 		const alreadyExistedEntries = entries.filter((entry) => existingEntries.has(entry));
 		const entriesToAdd = entries.filter((entry) => !existingEntries.has(entry));
-		const rulesyncBlock = [RULESYNC_HEADER, ...entries].join("\n");
+		const rulesyncBlock = [
+			RULESYNC_HEADER,
+			...entries,
+			RULESYNC_FOOTER
+		].join("\n");
 		const newContent = entries.length === 0 ? cleanedContent.trim() ? `${cleanedContent.trimEnd()}\n` : "" : cleanedContent.trim() ? `${cleanedContent.trimEnd()}\n\n${rulesyncBlock}\n` : `${rulesyncBlock}\n`;
 		if (content === newContent) return {
 			updated: false,
@@ -1713,7 +1746,8 @@ async function createConfigFile() {
 			"commands",
 			"subagents",
 			"skills",
-			"hooks"
+			"hooks",
+			"permissions"
 		],
 		outputRoots: ["."],
 		delete: true,
@@ -1857,6 +1891,25 @@ Keep the summary concise and ready to reuse in future tasks.`
     ]
   }
 }
+` };
+	const samplePermissionsFile = { content: `{
+  "$schema": "${RULESYNC_PERMISSIONS_SCHEMA_URL}",
+  "permission": {
+    "bash": {
+      "git status": "allow",
+      "git diff": "allow",
+      "ls *": "allow",
+      "rm -rf *": "deny",
+      "*": "ask"
+    },
+    "edit": {
+      "src/**": "allow"
+    },
+    "read": {
+      ".env": "deny"
+    }
+  }
+}
 ` };
 	const rulePaths = RulesyncRule.getSettablePaths();
 	const mcpPaths = RulesyncMcp.getSettablePaths();
@@ -1865,6 +1918,7 @@ Keep the summary concise and ready to reuse in future tasks.`
 	const skillPaths = RulesyncSkill.getSettablePaths();
 	const ignorePaths = RulesyncIgnore.getSettablePaths();
 	const hooksPaths = RulesyncHooks.getSettablePaths();
+	const permissionsPaths = RulesyncPermissions.getSettablePaths();
 	await ensureDir(rulePaths.recommended.relativeDirPath);
 	await ensureDir(mcpPaths.recommended.relativeDirPath);
 	await ensureDir(commandPaths.relativeDirPath);
@@ -1887,6 +1941,8 @@ Keep the summary concise and ready to reuse in future tasks.`
 	results.push(await writeIfNotExists(ignoreFilepath, sampleIgnoreFile.content));
 	const hooksFilepath = join(hooksPaths.relativeDirPath, hooksPaths.relativeFilePath);
 	results.push(await writeIfNotExists(hooksFilepath, sampleHooksFile.content));
+	const permissionsFilepath = join(permissionsPaths.relativeDirPath, permissionsPaths.relativeFilePath);
+	results.push(await writeIfNotExists(permissionsFilepath, samplePermissionsFile.content));
 	return results;
 }
 async function writeIfNotExists(path, content) {
@@ -1928,7 +1984,7 @@ async function initCommand(logger) {
 	}
 	logger.success("rulesync initialized successfully!");
 	logger.info("Next steps:");
-	logger.info(`1. Edit ${RULESYNC_RELATIVE_DIR_PATH}/**/*.md, ${RULESYNC_RELATIVE_DIR_PATH}/skills/*/${SKILL_FILE_NAME$1}, ${RULESYNC_MCP_RELATIVE_FILE_PATH}, ${RULESYNC_HOOKS_RELATIVE_FILE_PATH} and ${RULESYNC_AIIGNORE_RELATIVE_FILE_PATH}`);
+	logger.info(`1. Edit ${RULESYNC_RELATIVE_DIR_PATH}/**/*.md, ${RULESYNC_RELATIVE_DIR_PATH}/skills/*/${SKILL_FILE_NAME$1}, ${RULESYNC_MCP_RELATIVE_FILE_PATH}, ${RULESYNC_HOOKS_RELATIVE_FILE_PATH}, ${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH} and ${RULESYNC_AIIGNORE_RELATIVE_FILE_PATH}`);
 	logger.info("2. Run 'rulesync generate' to create configuration files");
 }
 //#endregion
@@ -4738,6 +4794,8 @@ async function putHooksFile({ content }) {
 	try {
 		const outputRoot = process.cwd();
 		const paths = RulesyncHooks.getSettablePaths();
+		const jsoncRelativePath = join(paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath);
+		if (await fileExists(join(outputRoot, jsoncRelativePath))) throw new Error(`${jsoncRelativePath} exists and takes precedence over ${RULESYNC_HOOKS_RELATIVE_FILE_PATH}. Edit ${jsoncRelativePath} directly instead.`);
 		const relativeDirPath = paths.relativeDirPath;
 		const relativeFilePath = paths.relativeFilePath;
 		const fullPath = join(outputRoot, relativeDirPath, relativeFilePath);
@@ -4766,6 +4824,7 @@ async function deleteHooksFile() {
 		const outputRoot = process.cwd();
 		const paths = RulesyncHooks.getSettablePaths();
 		await removeFile(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		await removeFile(join(outputRoot, paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath));
 		return { relativePathFromCwd: join(paths.relativeDirPath, paths.relativeFilePath) };
 	} catch (error) {
 		throw new Error(`Failed to delete hooks file (${RULESYNC_HOOKS_RELATIVE_FILE_PATH}): ${formatError(error)}`, { cause: error });
@@ -5016,6 +5075,8 @@ async function putMcpFile({ content }) {
 	try {
 		const outputRoot = process.cwd();
 		const paths = RulesyncMcp.getSettablePaths();
+		const jsoncRelativePath = join(paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath);
+		if (await fileExists(join(outputRoot, jsoncRelativePath))) throw new Error(`${jsoncRelativePath} exists and takes precedence over ${RULESYNC_MCP_RELATIVE_FILE_PATH}. Edit ${jsoncRelativePath} directly instead.`);
 		const relativeDirPath = paths.recommended.relativeDirPath;
 		const relativeFilePath = paths.recommended.relativeFilePath;
 		const fullPath = join(outputRoot, relativeDirPath, relativeFilePath);
@@ -5046,6 +5107,7 @@ async function deleteMcpFile() {
 		const recommendedPath = join(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath);
 		const legacyPath = join(outputRoot, paths.legacy.relativeDirPath, paths.legacy.relativeFilePath);
 		await removeFile(recommendedPath);
+		await removeFile(join(outputRoot, paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath));
 		await removeFile(legacyPath);
 		return { relativePathFromCwd: join(paths.recommended.relativeDirPath, paths.recommended.relativeFilePath) };
 	} catch (error) {
@@ -5122,6 +5184,8 @@ async function putPermissionsFile({ content }) {
 	try {
 		const outputRoot = process.cwd();
 		const paths = RulesyncPermissions.getSettablePaths();
+		const jsoncRelativePath = join(paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath);
+		if (await fileExists(join(outputRoot, jsoncRelativePath))) throw new Error(`${jsoncRelativePath} exists and takes precedence over ${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}. Edit ${jsoncRelativePath} directly instead.`);
 		const relativeDirPath = paths.relativeDirPath;
 		const relativeFilePath = paths.relativeFilePath;
 		const fullPath = join(outputRoot, relativeDirPath, relativeFilePath);
@@ -5150,6 +5214,7 @@ async function deletePermissionsFile() {
 		const outputRoot = process.cwd();
 		const paths = RulesyncPermissions.getSettablePaths();
 		await removeFile(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		await removeFile(join(outputRoot, paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath));
 		return { relativePathFromCwd: join(paths.relativeDirPath, paths.relativeFilePath) };
 	} catch (error) {
 		throw new Error(`Failed to delete permissions file (${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}): ${formatError(error)}`, { cause: error });
@@ -6448,7 +6513,7 @@ function wrapCommand$1({ name, errorCode, handler, getVersion, loggerFactory = c
 }
 //#endregion
 //#region src/cli/index.ts
-const getVersion = () => "9.7.0";
+const getVersion = () => "10.0.0";
 function wrapCommand(name, errorCode, handler) {
 	return wrapCommand$1({
 		name,