rulesync 9.8.0 → 10.0.0

package/dist/{import-Dioh9ca8.js → import-B02AyWkQ.js}

@@ -99,6 +99,9 @@ const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH,
 const RULESYNC_MCP_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
 const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
 const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const RULESYNC_MCP_JSONC_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_JSONC_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_JSONC_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
 const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
@@ -109,8 +112,12 @@ const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_MCP_FILE_NAME = "mcp.json";
 const RULESYNC_HOOKS_FILE_NAME = "hooks.json";
 const RULESYNC_PERMISSIONS_FILE_NAME = "permissions.json";
+const RULESYNC_MCP_JSONC_FILE_NAME = "mcp.jsonc";
+const RULESYNC_HOOKS_JSONC_FILE_NAME = "hooks.jsonc";
+const RULESYNC_PERMISSIONS_JSONC_FILE_NAME = "permissions.jsonc";
 const RULESYNC_CONFIG_SCHEMA_URL = "https://github.com/dyoshikawa/rulesync/releases/latest/download/config-schema.json";
 const RULESYNC_MCP_SCHEMA_URL = "https://github.com/dyoshikawa/rulesync/releases/latest/download/mcp-schema.json";
+const RULESYNC_PERMISSIONS_SCHEMA_URL = "https://github.com/dyoshikawa/rulesync/releases/latest/download/permissions-schema.json";
 const MAX_FILE_SIZE = 10 * 1024 * 1024;
 //#endregion
 //#region src/types/tool-target-tuples.ts
@@ -7317,12 +7324,55 @@ function toolHooksToCanonical({ hooks, converterConfig }) {
 	return canonical;
 }
 //#endregion
+//#region src/utils/jsonc.ts
+/**
+* Rebuild the parsed value from its own enumerable entries, dropping
+* prototype-pollution keys (`__proto__`, `constructor`, `prototype`).
+* `jsonc-parser` assigns keys with plain `obj[key] = value` semantics, so a
+* literal `__proto__` key would replace the containing object's prototype
+* instead of becoming an own property; rebuilding gives every object a clean
+* `Object.prototype` again and severs that path.
+*/
+function deepSanitize(value) {
+	if (Array.isArray(value)) return value.map((item) => deepSanitize(item));
+	if (value !== null && typeof value === "object") {
+		const sanitized = {};
+		for (const [key, entry] of Object.entries(value)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			sanitized[key] = deepSanitize(entry);
+		}
+		return sanitized;
+	}
+	return value;
+}
+/**
+* Parse a JSONC (JSON with Comments) document strictly.
+*
+* Unlike `jsonc-parser`'s bare `parse` (which silently tolerates syntax
+* errors and returns a best-effort value), this throws on any parse error so
+* a malformed source file fails loudly instead of generating half-empty tool
+* configs. Plain JSON is valid JSONC, so this is a drop-in replacement for
+* `JSON.parse` on files that may contain comments or trailing commas.
+*/
+function parseJsonc(content) {
+	const errors = [];
+	const result = parse(content, errors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (errors.length > 0) {
+		const details = errors.map((e) => `${printParseErrorCode(e.error)} at offset ${e.offset}`).join(", ");
+		throw new SyntaxError(`Failed to parse JSONC content: ${details}`);
+	}
+	return deepSanitize(result);
+}
+//#endregion
 //#region src/features/hooks/rulesync-hooks.ts
 var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 	json;
 	constructor(params) {
 		super({ ...params });
-		this.json = JSON.parse(this.fileContent);
+		this.json = parseJsonc(this.fileContent);
 		if (params.validate) {
 			const result = this.validate();
 			if (!result.success) throw result.error;
@@ -7331,7 +7381,11 @@ var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 	static getSettablePaths() {
 		return {
 			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: "hooks.json"
+			relativeFilePath: RULESYNC_HOOKS_FILE_NAME,
+			jsonc: {
+				relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
+				relativeFilePath: RULESYNC_HOOKS_JSONC_FILE_NAME
+			}
 		};
 	}
 	validate() {
@@ -7347,16 +7401,23 @@ var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
 		const paths = RulesyncHooks.getSettablePaths();
-		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		if (!await fileExists(filePath)) throw new Error(`No ${RULESYNC_HOOKS_RELATIVE_FILE_PATH} found.`);
-		const fileContent = await readFileContent(filePath);
-		return new RulesyncHooks({
-			outputRoot,
+		const candidates = [paths.jsonc, {
 			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
+			relativeFilePath: paths.relativeFilePath
+		}];
+		for (const candidate of candidates) {
+			const filePath = join(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			if (!await fileExists(filePath)) continue;
+			const fileContent = await readFileContent(filePath);
+			return new RulesyncHooks({
+				outputRoot,
+				relativeDirPath: candidate.relativeDirPath,
+				relativeFilePath: candidate.relativeFilePath,
+				fileContent,
+				validate
+			});
+		}
+		throw new Error(`No ${RULESYNC_HOOKS_RELATIVE_FILE_PATH} or ${RULESYNC_HOOKS_JSONC_RELATIVE_FILE_PATH} found.`);
 	}
 	getJson() {
 		return this.json;
@@ -12364,15 +12425,51 @@ const RulesyncMcpServerSchema = z.extend(McpServerSchema, {
 	exposed: z.optional(z.boolean())
 });
 const RulesyncMcpConfigSchema = z.object({ mcpServers: z.record(z.string(), RulesyncMcpServerSchema) });
+/**
+* Tool-scoped MCP block: servers that apply only to one tool. A named entry
+* replaces/adds the same-named shared server wholesale for that tool; `null`
+* removes the shared server for that tool. Mirrors `{toolname}.hooks` in
+* `.rulesync/hooks.json` and `{toolname}.permission` in
+* `.rulesync/permissions.json`.
+*/
+const toolScopedMcpSchema = z.looseObject({ mcpServers: z.optional(z.record(z.string(), z.nullable(RulesyncMcpServerSchema))) });
 const RulesyncMcpFileSchema = z.looseObject({
 	$schema: z.optional(z.string()),
-	...RulesyncMcpConfigSchema.shape
+	...RulesyncMcpConfigSchema.shape,
+	amp: z.optional(toolScopedMcpSchema),
+	"antigravity-cli": z.optional(toolScopedMcpSchema),
+	"antigravity-ide": z.optional(toolScopedMcpSchema),
+	augmentcode: z.optional(toolScopedMcpSchema),
+	claudecode: z.optional(toolScopedMcpSchema),
+	cline: z.optional(toolScopedMcpSchema),
+	codexcli: z.optional(toolScopedMcpSchema),
+	copilot: z.optional(toolScopedMcpSchema),
+	copilotcli: z.optional(toolScopedMcpSchema),
+	cursor: z.optional(toolScopedMcpSchema),
+	deepagents: z.optional(toolScopedMcpSchema),
+	devin: z.optional(toolScopedMcpSchema),
+	factorydroid: z.optional(toolScopedMcpSchema),
+	goose: z.optional(toolScopedMcpSchema),
+	grokcli: z.optional(toolScopedMcpSchema),
+	hermesagent: z.optional(toolScopedMcpSchema),
+	junie: z.optional(toolScopedMcpSchema),
+	kilo: z.optional(toolScopedMcpSchema),
+	kiro: z.optional(toolScopedMcpSchema),
+	opencode: z.optional(toolScopedMcpSchema),
+	qwencode: z.optional(toolScopedMcpSchema),
+	reasonix: z.optional(toolScopedMcpSchema),
+	roo: z.optional(toolScopedMcpSchema),
+	rovodev: z.optional(toolScopedMcpSchema),
+	takt: z.optional(toolScopedMcpSchema),
+	vibe: z.optional(toolScopedMcpSchema),
+	warp: z.optional(toolScopedMcpSchema),
+	zed: z.optional(toolScopedMcpSchema)
 });
 var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	json;
 	constructor(params) {
 		super(params);
-		this.json = JSON.parse(this.fileContent);
+		this.json = parseJsonc(this.fileContent);
 		if (params.validate) {
 			const result = this.validate();
 			if (!result.success) throw result.error;
@@ -12382,7 +12479,11 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 		return {
 			recommended: {
 				relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-				relativeFilePath: "mcp.json"
+				relativeFilePath: RULESYNC_MCP_FILE_NAME
+			},
+			jsonc: {
+				relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
+				relativeFilePath: RULESYNC_MCP_JSONC_FILE_NAME
 			},
 			legacy: {
 				relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
@@ -12404,7 +12505,18 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	static async fromFile({ outputRoot = process.cwd(), validate = true, logger }) {
 		const paths = this.getSettablePaths();
 		const recommendedPath = join(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath);
+		const jsoncPath = join(outputRoot, paths.jsonc.relativeDirPath, paths.jsonc.relativeFilePath);
 		const legacyPath = join(outputRoot, paths.legacy.relativeDirPath, paths.legacy.relativeFilePath);
+		if (await fileExists(jsoncPath)) {
+			const fileContent = await readFileContent(jsoncPath);
+			return new RulesyncMcp({
+				outputRoot,
+				relativeDirPath: paths.jsonc.relativeDirPath,
+				relativeFilePath: paths.jsonc.relativeFilePath,
+				fileContent,
+				validate
+			});
+		}
 		if (await fileExists(recommendedPath)) {
 			const fileContent = await readFileContent(recommendedPath);
 			return new RulesyncMcp({
@@ -12464,7 +12576,141 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	getJson() {
 		return this.json;
 	}
-};
+	/**
+	* Build the effective MCP config for one tool target:
+	*
+	* 1. Filter shared servers by the DEPRECATED per-server `targets` field
+	*    (missing/`["*"]` means every tool). A deprecation warning points at
+	*    the tool-scoped blocks that replace it.
+	* 2. Overlay the tool-scoped `{toolname}.mcpServers` block(s): a named
+	*    entry replaces/adds the shared server wholesale for this tool; `null`
+	*    removes it.
+	*
+	* Targets that share one output file resolve identically so the shared
+	* file's content never depends on which of them generates last — see
+	* `resolveMcpTarget` for the alias groups (kiro trio, claudecode/-legacy,
+	* and the Antigravity pair).
+	*
+	* Returns the same instance when neither mechanism is used.
+	*/
+	forTarget({ toolTarget, logger }) {
+		const { blockKeys, acceptedTargetNames } = resolveMcpTarget({ toolTarget });
+		const json = this.json;
+		const sharedServers = this.json.mcpServers ?? {};
+		const serverNamesWithTargets = Object.entries(sharedServers).filter(([, serverConfig]) => serverConfig.targets !== void 0).map(([serverName]) => serverName);
+		if (serverNamesWithTargets.length > 0) this.warnTargetsDeprecationOnce({
+			serverNamesWithTargets,
+			logger
+		});
+		for (const ignoredKey of MCP_IGNORED_ALIAS_SOURCE_KEYS) {
+			if (!isRecord(json[ignoredKey])) continue;
+			this.warnOncePerFile(`alias:${ignoredKey}`, `The "${ignoredKey}" block in ${join(this.relativeDirPath, this.relativeFilePath)} is ignored. Author it under the "${MCP_BLOCK_KEY_ALIASES[ignoredKey]}" key instead.`, logger);
+		}
+		const toolBlockKeys = Object.keys(json).filter((key) => MCP_TOOL_BLOCK_KEYS.has(key));
+		if (serverNamesWithTargets.length === 0 && toolBlockKeys.length === 0) return this;
+		const effectiveServers = Object.fromEntries(Object.entries(sharedServers).filter(([, serverConfig]) => {
+			const targets = serverConfig.targets;
+			if (targets === void 0) return true;
+			return targets.some((target) => target === "*" || acceptedTargetNames.has(target));
+		}));
+		for (const blockKey of blockKeys) {
+			const toolBlock = json[blockKey];
+			const toolServers = isRecord(toolBlock) && isRecord(toolBlock.mcpServers) ? toolBlock.mcpServers : void 0;
+			for (const [serverName, serverConfig] of Object.entries(toolServers ?? {})) {
+				if (isPrototypePollutionKey(serverName)) continue;
+				if (serverConfig === null) delete effectiveServers[serverName];
+				else effectiveServers[serverName] = serverConfig;
+			}
+		}
+		const rest = Object.fromEntries(Object.entries(json).filter(([key]) => !MCP_TOOL_BLOCK_KEYS.has(key)));
+		return new RulesyncMcp({
+			outputRoot: this.outputRoot,
+			relativeDirPath: this.relativeDirPath,
+			relativeFilePath: this.relativeFilePath,
+			fileContent: JSON.stringify({
+				...rest,
+				mcpServers: effectiveServers
+			}, null, 2)
+		});
+	}
+	/**
+	* The deprecation warning would otherwise repeat once per generated tool
+	* target (a full `--targets "*"` run creates one RulesyncMcp per target),
+	* so it is deduplicated per source file path.
+	*/
+	warnTargetsDeprecationOnce({ serverNamesWithTargets, logger }) {
+		this.warnOncePerFile("targets-deprecation", `The per-server "targets" field in ${join(this.relativeDirPath, this.relativeFilePath)} is deprecated (servers: ${serverNamesWithTargets.join(", ")}). Author tool-scoped "{toolname}.mcpServers" blocks instead.`, logger);
+	}
+	warnOncePerFile(kind, message, logger) {
+		const dedupeKey = `${this.getFilePath()}#${kind}`;
+		if (warnedOnceKeys.has(dedupeKey)) return;
+		warnedOnceKeys.add(dedupeKey);
+		logger?.warn(message);
+	}
+};
+/**
+* All keys that may hold a tool-scoped `{toolname}.mcpServers` block. Derived
+* from the MCP processor's target tuple so a newly added MCP-capable tool is
+* covered automatically.
+*/
+const MCP_TOOL_BLOCK_KEYS = new Set(mcpProcessorToolTargetTuple);
+/**
+* Targets whose `{toolname}.mcpServers` block key is ALWAYS another target's
+* key (at every scope): `claudecode-legacy` is a deprecated alias of
+* `claudecode`, and the Kiro IDE/CLI targets share the `kiro` block because
+* all three write the same `.kiro/settings/mcp.json` at both scopes. Blocks
+* authored under these source names are never read (a warning is emitted).
+*/
+const MCP_BLOCK_KEY_ALIASES = {
+	"claudecode-legacy": "claudecode",
+	"kiro-cli": "kiro",
+	"kiro-ide": "kiro"
+};
+const MCP_IGNORED_ALIAS_SOURCE_KEYS = Object.keys(MCP_BLOCK_KEY_ALIASES);
+/**
+* Resolve which tool-scoped blocks a target reads and which deprecated
+* `targets` names match it. Targets that share one output file must resolve
+* identically, otherwise the shared file's content would depend on which
+* target happened to generate last:
+*
+* - `claudecode-legacy` aliases `claudecode`; the Kiro trio shares `kiro`
+*   (same output file at both scopes).
+* - `antigravity-ide` / `antigravity-cli` share their output file at BOTH
+*   scopes — `.agents/mcp_config.json` (project) and
+*   `~/.gemini/config/mcp_config.json` (global; both global subdirs are
+*   `config`) — so both targets always apply both blocks in a fixed order
+*   (`antigravity-ide` first, `antigravity-cli` second — the CLI block wins
+*   per server on conflict).
+*/
+function resolveMcpTarget({ toolTarget }) {
+	if (toolTarget === "claudecode" || toolTarget === "claudecode-legacy") return {
+		blockKeys: ["claudecode"],
+		acceptedTargetNames: /* @__PURE__ */ new Set(["claudecode", "claudecode-legacy"])
+	};
+	if (toolTarget === "kiro" || toolTarget === "kiro-cli" || toolTarget === "kiro-ide") return {
+		blockKeys: ["kiro"],
+		acceptedTargetNames: /* @__PURE__ */ new Set([
+			"kiro",
+			"kiro-cli",
+			"kiro-ide"
+		])
+	};
+	if (toolTarget === "antigravity-ide" || toolTarget === "antigravity-cli") return {
+		blockKeys: ["antigravity-ide", "antigravity-cli"],
+		acceptedTargetNames: /* @__PURE__ */ new Set(["antigravity-ide", "antigravity-cli"])
+	};
+	return {
+		blockKeys: [toolTarget],
+		acceptedTargetNames: /* @__PURE__ */ new Set([toolTarget])
+	};
+}
+/**
+* Deduplication set for once-per-source-file warnings, keyed by
+* `<absolute file path>#<warning kind>`. Never cleared: rulesync CLI runs
+* are one-shot processes, and in a long-lived embedding (the rulesync MCP
+* server) repeating the same warning per generate would only add noise.
+*/
+const warnedOnceKeys = /* @__PURE__ */ new Set();
 //#endregion
 //#region src/features/mcp/tool-mcp.ts
 var ToolMcp = class extends ToolFile {
@@ -16714,10 +16960,14 @@ var McpProcessor = class extends FeatureProcessor {
 		if (!rulesyncMcp) throw new Error(`No ${RULESYNC_MCP_RELATIVE_FILE_PATH} found.`);
 		const factory = this.getFactory(this.toolTarget);
 		return await Promise.all([rulesyncMcp].map(async (mcp) => {
+			const targetedRulesyncMcp = mcp.forTarget({
+				toolTarget: this.toolTarget,
+				logger: this.logger
+			});
 			const fieldsToStrip = [];
 			if (!factory.meta.supportsEnabledTools) fieldsToStrip.push("enabledTools");
 			if (!factory.meta.supportsDisabledTools) fieldsToStrip.push("disabledTools");
-			const filteredRulesyncMcp = mcp.stripMcpServerFields(fieldsToStrip);
+			const filteredRulesyncMcp = targetedRulesyncMcp.stripMcpServerFields(fieldsToStrip);
 			return await factory.class.fromRulesyncMcp({
 				outputRoot: this.outputRoot,
 				rulesyncMcp: filteredRulesyncMcp,
@@ -16767,6 +17017,25 @@ const PermissionActionSchema = z.enum([
 */
 const PermissionRulesSchema = z.record(z.string(), PermissionActionSchema);
 /**
+* Tool-scoped canonical `permission` block: the same shape as the shared
+* top-level `permission` record, but applied only to the tool whose override
+* key it appears under. During generation the categories placed here are
+* merged over the shared `permission` block per category (the tool-scoped
+* category replaces the shared one wholesale), mirroring how
+* `.rulesync/hooks.json` merges `{toolname}.hooks` per event.
+*
+* @example
+* { "claudecode": { "permission": { "bash": { "git push *": "deny" } } } }
+*/
+const ToolScopedPermissionSchema = z.record(z.string(), PermissionRulesSchema);
+/**
+* Generic tool-scoped override block for tools that have no tool-specific
+* override keys of their own; it carries only the canonical tool-scoped
+* `permission` block. Kept `looseObject` so future tool-specific keys can be
+* added without a schema break.
+*/
+const CanonicalPermissionsOverrideSchema = z.looseObject({ permission: z.optional(ToolScopedPermissionSchema) });
+/**
 * OpenCode-specific permission value. Unlike the shared canonical block, which
 * only accepts a pattern-to-action map, OpenCode also allows a bare action
 * string that applies to the whole category (e.g. `"external_directory": "deny"`).
@@ -16796,7 +17065,7 @@ const OpencodePermissionsOverrideSchema = z.looseObject({ permission: z.optional
 * @example
 * { "approvals": { "mode": "smart" }, "security": { "allow_private_urls": false } }
 */
-const HermesPermissionsOverrideSchema = z.looseObject({});
+const HermesPermissionsOverrideSchema = z.looseObject({ permission: z.optional(ToolScopedPermissionSchema) });
 /**
 * Tool-scoped override block for Cline. Cline's `command-permissions.json`
 * carries a single global `allowRedirects` boolean (gates shell redirection
@@ -16808,7 +17077,10 @@ const HermesPermissionsOverrideSchema = z.looseObject({});
 * @example
 * { "allowRedirects": true }
 */
-const ClinePermissionsOverrideSchema = z.looseObject({ allowRedirects: z.optional(z.boolean()) });
+const ClinePermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	allowRedirects: z.optional(z.boolean())
+});
 /**
 * Tool-scoped override block for Kilo Code (an OpenCode fork). Kilo's permission
 * object is a free-form record with tool-specific keys that have no canonical
@@ -16838,7 +17110,10 @@ const KiloPermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.r
 * @example
 * { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
 */
-const ClaudecodePermissionsOverrideSchema = z.looseObject({ permissions: z.optional(z.looseObject({})) });
+const ClaudecodePermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	permissions: z.optional(z.looseObject({}))
+});
 /**
 * Tool-scoped override block for Mistral Vibe. Vibe's per-tool `BaseToolConfig`
 * carries a `sensitive_patterns` list — patterns that escalate to ASK even when
@@ -16870,6 +17145,7 @@ const VibePermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.r
 * { "approvalMode": "auto-review" }
 */
 const CursorPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	approvalMode: z.optional(z.string()),
 	sandbox: z.optional(z.looseObject({}))
 });
@@ -16895,6 +17171,7 @@ const CursorPermissionsOverrideSchema = z.looseObject({
 * }
 */
 const QwencodePermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	tools: z.optional(z.looseObject({})),
 	security: z.optional(z.looseObject({})),
 	autoMode: z.optional(z.looseObject({}))
@@ -16916,6 +17193,7 @@ const QwencodePermissionsOverrideSchema = z.looseObject({
 * { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
 */
 const ReasonixPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	sandbox: z.optional(z.looseObject({})),
 	agent: z.optional(z.looseObject({}))
 });
@@ -16935,7 +17213,10 @@ const ReasonixPermissionsOverrideSchema = z.looseObject({
 * @example
 * { "commandBlocklist": ["rm -rf /*"], "sandbox": { "enabled": true } }
 */
-const FactorydroidPermissionsOverrideSchema = z.looseObject({ commandBlocklist: z.optional(z.array(z.string())) });
+const FactorydroidPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	commandBlocklist: z.optional(z.array(z.string()))
+});
 /**
 * Tool-scoped override block for Warp. Warp's `[agents.profiles]` table exposes
 * file-read/read-only autonomy keys with no canonical per-command allow/ask/deny
@@ -16952,6 +17233,7 @@ const FactorydroidPermissionsOverrideSchema = z.looseObject({ commandBlocklist:
 * { "agent_mode_coding_permissions": "always_allow_reading", "agent_mode_execute_readonly_commands": true }
 */
 const WarpPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	agent_mode_coding_permissions: z.optional(z.string()),
 	agent_mode_coding_file_read_allowlist: z.optional(z.array(z.string())),
 	agent_mode_execute_readonly_commands: z.optional(z.boolean())
@@ -16969,6 +17251,7 @@ const WarpPermissionsOverrideSchema = z.looseObject({
 * { "allowReadonlyCommands": true, "defaultBehavior": "ask" }
 */
 const JuniePermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	allowReadonlyCommands: z.optional(z.boolean()),
 	defaultBehavior: z.optional(z.string())
 });
@@ -16996,6 +17279,7 @@ const JuniePermissionsOverrideSchema = z.looseObject({
 * { "step_permission_overrides": { "ai_review": "readonly" }, "provider_options": { "codex": { "network_access": true } } }
 */
 const TaktPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	step_permission_overrides: z.optional(z.record(z.string(), z.string())),
 	provider_options: z.optional(z.looseObject({}))
 });
@@ -17023,6 +17307,7 @@ const TaktPermissionsOverrideSchema = z.looseObject({
 *   "permissions": [{ "tool": "Bash", "action": "delegate", "to": "approve.sh" }] }
 */
 const AmpPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	permissions: z.optional(z.array(z.looseObject({
 		tool: z.string(),
 		action: z.string()
@@ -17051,6 +17336,7 @@ const AmpPermissionsOverrideSchema = z.looseObject({
 * { "toolPermission": "strict", "enableTerminalSandbox": true }
 */
 const AntigravityCliPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	toolPermission: z.optional(z.string()),
 	enableTerminalSandbox: z.optional(z.boolean())
 });
@@ -17076,10 +17362,13 @@ const AntigravityCliPermissionsOverrideSchema = z.looseObject({
 *       "permission": { "type": "webhook-policy", "webhookUrl": "https://api.example.com/validate" } },
 *     { "toolName": "view", "eventType": "tool-response", "permission": { "type": "allow" } } ] }
 */
-const AugmentcodePermissionsOverrideSchema = z.looseObject({ toolPermissions: z.optional(z.array(z.looseObject({
-	toolName: z.string(),
-	permission: z.looseObject({ type: z.string() })
-}))) });
+const AugmentcodePermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	toolPermissions: z.optional(z.array(z.looseObject({
+		toolName: z.string(),
+		permission: z.looseObject({ type: z.string() })
+	})))
+});
 /**
 * Tool-scoped override block for Kiro. Kiro's agent config (`.kiro/agents/<name>.json`)
 * exposes per-tool `toolsSettings` knobs with no canonical allow/ask/deny
@@ -17105,21 +17394,24 @@ const AugmentcodePermissionsOverrideSchema = z.looseObject({ toolPermissions: z.
 *     "aws": { "allowedServices": ["s3"], "deniedServices": ["eks"] },
 *     "web_fetch": { "trusted": [".*github\\.com.*"] } } }
 */
-const KiroPermissionsOverrideSchema = z.looseObject({ toolsSettings: z.optional(z.looseObject({
-	shell: z.optional(z.looseObject({
-		autoAllowReadonly: z.optional(z.boolean()),
-		denyByDefault: z.optional(z.boolean())
-	})),
-	aws: z.optional(z.looseObject({
-		allowedServices: z.optional(z.array(z.string())),
-		deniedServices: z.optional(z.array(z.string())),
-		autoAllowReadonly: z.optional(z.boolean())
-	})),
-	web_fetch: z.optional(z.looseObject({
-		trusted: z.optional(z.array(z.string())),
-		blocked: z.optional(z.array(z.string()))
+const KiroPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	toolsSettings: z.optional(z.looseObject({
+		shell: z.optional(z.looseObject({
+			autoAllowReadonly: z.optional(z.boolean()),
+			denyByDefault: z.optional(z.boolean())
+		})),
+		aws: z.optional(z.looseObject({
+			allowedServices: z.optional(z.array(z.string())),
+			deniedServices: z.optional(z.array(z.string())),
+			autoAllowReadonly: z.optional(z.boolean())
+		})),
+		web_fetch: z.optional(z.looseObject({
+			trusted: z.optional(z.array(z.string())),
+			blocked: z.optional(z.array(z.string()))
+		}))
 	}))
-})) });
+});
 /**
 * Codex CLI's approval-workflow policy. Serialized as a kebab-case string in
 * `.codex/config.toml`. `on-failure` is a legacy alias for `on-request` that
@@ -17191,6 +17483,7 @@ const CodexApprovalsReviewerSchema = z.enum([
 *   "sandbox_workspace_write": { "network_access": true } }
 */
 const CodexcliPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
 	approval_policy: z.optional(z.union([CodexApprovalPolicySchema, z.looseObject({})])),
 	sandbox_mode: z.optional(CodexSandboxModeSchema),
 	sandbox_workspace_write: z.optional(z.looseObject({})),
@@ -17209,6 +17502,15 @@ const CodexcliPermissionsOverrideSchema = z.looseObject({
 * `*PermissionsOverrideSchema`); every other tool reads the shared `permission`
 * block and ignores them.
 *
+* Additionally, every permissions-capable tool accepts a canonical tool-scoped
+* `permission` block under its override key (`{toolname}.permission`, same
+* shape as the shared `permission` record). Its categories apply only to that
+* tool, merged over the shared block per category — see
+* `RulesyncPermissions.forTarget`. `kiro-cli`/`kiro-ide` alias to the `kiro`
+* key and `hermesagent` to `hermes` (matching the shared output file each
+* writes). OpenCode/Kilo/Vibe keep their existing tool-native `permission`
+* override semantics (handled by their translators, not the central merge).
+*
 * @example
 * {
 *   "bash": { "*": "ask", "git *": "allow", "rm *": "deny" },
@@ -17234,7 +17536,13 @@ const PermissionsConfigSchema = z.looseObject({
 	"antigravity-cli": z.optional(AntigravityCliPermissionsOverrideSchema),
 	augmentcode: z.optional(AugmentcodePermissionsOverrideSchema),
 	kiro: z.optional(KiroPermissionsOverrideSchema),
-	codexcli: z.optional(CodexcliPermissionsOverrideSchema)
+	codexcli: z.optional(CodexcliPermissionsOverrideSchema),
+	"antigravity-ide": z.optional(CanonicalPermissionsOverrideSchema),
+	devin: z.optional(CanonicalPermissionsOverrideSchema),
+	goose: z.optional(CanonicalPermissionsOverrideSchema),
+	grokcli: z.optional(CanonicalPermissionsOverrideSchema),
+	rovodev: z.optional(CanonicalPermissionsOverrideSchema),
+	zed: z.optional(CanonicalPermissionsOverrideSchema)
 });
 /**
 * Full permissions file schema including optional $schema field.
@@ -17249,7 +17557,7 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 	json;
 	constructor(params) {
 		super({ ...params });
-		this.json = JSON.parse(this.fileContent);
+		this.json = parseJsonc(this.fileContent);
 		if (params.validate) {
 			const result = this.validate();
 			if (!result.success) throw result.error;
@@ -17258,7 +17566,11 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 	static getSettablePaths() {
 		return {
 			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME
+			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
+			jsonc: {
+				relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
+				relativeFilePath: RULESYNC_PERMISSIONS_JSONC_FILE_NAME
+			}
 		};
 	}
 	validate() {
@@ -17274,20 +17586,85 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
 		const paths = RulesyncPermissions.getSettablePaths();
-		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		if (!await fileExists(filePath)) throw new Error(`No ${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH} found.`);
-		const fileContent = await readFileContent(filePath);
-		return new RulesyncPermissions({
-			outputRoot,
+		const candidates = [paths.jsonc, {
 			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
+			relativeFilePath: paths.relativeFilePath
+		}];
+		for (const candidate of candidates) {
+			const filePath = join(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			if (!await fileExists(filePath)) continue;
+			const fileContent = await readFileContent(filePath);
+			return new RulesyncPermissions({
+				outputRoot,
+				relativeDirPath: candidate.relativeDirPath,
+				relativeFilePath: candidate.relativeFilePath,
+				fileContent,
+				validate
+			});
+		}
+		throw new Error(`No ${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH} or ${RULESYNC_PERMISSIONS_JSONC_RELATIVE_FILE_PATH} found.`);
 	}
 	getJson() {
 		return this.json;
 	}
+	/**
+	* Build the effective permissions config for one tool target by merging the
+	* tool-scoped `{toolname}.permission` block over the shared `permission`
+	* block, per category (the tool-scoped category replaces the shared one
+	* wholesale — mirroring how `{toolname}.hooks` merges per event in
+	* `.rulesync/hooks.json`). The consumed `permission` key is stripped from
+	* the override block so verbatim-passthrough translators (e.g. the Hermes
+	* deep merge or the Codex CLI top-level key whitelist) never see it.
+	*
+	* Returns the same instance when the target has no tool-scoped canonical
+	* `permission` block, or when the target's translator natively consumes its
+	* own `permission` override shape (OpenCode / Kilo / Vibe).
+	*/
+	forTarget({ toolTarget, logger }) {
+		if (NATIVE_PERMISSION_OVERRIDE_TARGETS.has(toolTarget)) return this;
+		const overrideKey = PERMISSION_OVERRIDE_KEY_ALIASES[toolTarget] ?? toolTarget;
+		const json = this.json;
+		if (overrideKey !== toolTarget && isRecord(json[toolTarget])) logger?.warn(`The "${toolTarget}" block in ${join(this.relativeDirPath, this.relativeFilePath)} is ignored. Author it under the "${overrideKey}" key instead (the ${toolTarget} target reads that block).`);
+		const overrideBlock = json[overrideKey];
+		if (!isRecord(overrideBlock) || !isRecord(overrideBlock.permission)) return this;
+		const { permission: toolScopedPermission, ...restOverride } = overrideBlock;
+		const merged = {
+			...json,
+			permission: {
+				...this.json.permission,
+				...toolScopedPermission
+			}
+		};
+		if (Object.keys(restOverride).length > 0) merged[overrideKey] = restOverride;
+		else delete merged[overrideKey];
+		return new RulesyncPermissions({
+			outputRoot: this.outputRoot,
+			relativeDirPath: this.relativeDirPath,
+			relativeFilePath: this.relativeFilePath,
+			fileContent: JSON.stringify(merged, null, 2)
+		});
+	}
+};
+/**
+* Targets whose tool-scoped `permission` override uses tool-native semantics
+* consumed directly by their translator (bare action strings / tool-only
+* categories for OpenCode and Kilo, `sensitive_patterns` objects for Vibe).
+* The central canonical merge must not touch those blocks.
+*/
+const NATIVE_PERMISSION_OVERRIDE_TARGETS = /* @__PURE__ */ new Set([
+	"opencode",
+	"kilo",
+	"vibe"
+]);
+/**
+* Targets that read their tool-scoped override from a differently named key:
+* Kiro IDE/CLI share the `kiro` block (they write the same agent config) and
+* Hermes Agent's established override key is `hermes`.
+*/
+const PERMISSION_OVERRIDE_KEY_ALIASES = {
+	"kiro-cli": "kiro",
+	"kiro-ide": "kiro",
+	hermesagent: "hermes"
 };
 //#endregion
 //#region src/features/permissions/tool-permissions.ts
@@ -19127,10 +19504,15 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			existingDomainsHadUnknown,
 			logger
 		});
-		permissionsTable[RULESYNC_PROFILE_NAME] = mergeWithExistingProfile({
+		const profile = mergeWithExistingProfile({
 			newProfile,
 			existingProfile
 		});
+		permissionsTable[RULESYNC_PROFILE_NAME] = preserveUnmanagedProfileKeys({
+			rawExistingProfile: permissionsTable[RULESYNC_PROFILE_NAME],
+			profile,
+			logger
+		});
 		const overridePatch = computeCodexcliOverridePatch({
 			existing,
 			override: rulesyncPermissions.getJson().codexcli,
@@ -19326,6 +19708,43 @@ function warnAboutPreservedProfileState({ existingProfile, newProfile, existingD
 	if (existingProfile?.network?.mode !== void 0) logger?.warn(`Preserving existing "network.mode" from config. Review this value manually as it may grant broader network access than the Rulesync-managed domain rules.`);
 	if (existingDomainsHadUnknown) logger?.warn(`Existing "network.domains" contained unrecognized values. These entries were skipped and will not be imported.`);
 }
+const MANAGED_PROFILE_KEYS = /* @__PURE__ */ new Set([
+	"description",
+	"extends",
+	"filesystem",
+	"network"
+]);
+const MANAGED_NETWORK_KEYS = /* @__PURE__ */ new Set([
+	"enabled",
+	"mode",
+	"domains",
+	"unix_sockets"
+]);
+/**
+* Re-attach the keys of the existing rulesync profile that rulesync does not
+* manage. The managed keys always come from `profile` (the freshly computed
+* merge result); unmanaged siblings — at the profile level and inside the
+* `network` table — are preserved verbatim from the existing config so a
+* regeneration never deletes user-authored Codex settings.
+*/
+function preserveUnmanagedProfileKeys({ rawExistingProfile, profile, logger }) {
+	const rawProfileTable = toMutableTable(rawExistingProfile);
+	const profileExtras = Object.fromEntries(Object.entries(rawProfileTable).filter(([key]) => !MANAGED_PROFILE_KEYS.has(key)));
+	const rawNetworkTable = toMutableTable(rawProfileTable.network);
+	const networkExtras = Object.fromEntries(Object.entries(rawNetworkTable).filter(([key]) => !MANAGED_NETWORK_KEYS.has(key)));
+	const preservedKeyNames = [...Object.keys(profileExtras), ...Object.keys(networkExtras).map((key) => `network.${key}`)];
+	if (preservedKeyNames.length > 0) logger?.warn(`Preserving unmanaged keys in the "${RULESYNC_PROFILE_NAME}" permissions profile: ${preservedKeyNames.join(", ")}. Review them manually; rulesync carries them forward verbatim.`);
+	const result = {
+		...profileExtras,
+		...profile
+	};
+	const mergedNetwork = {
+		...networkExtras,
+		...profile.network
+	};
+	if (Object.keys(mergedNetwork).length > 0) result.network = mergedNetwork;
+	return result;
+}
 function mergeWithExistingProfile({ newProfile, existingProfile }) {
 	if (!existingProfile) return newProfile;
 	const mergedNetwork = { ...newProfile.network };
@@ -23587,16 +24006,20 @@ var PermissionsProcessor = class extends FeatureProcessor {
 		if (!rulesyncPermissions) throw new Error(`No ${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH} found.`);
 		const factory = toolPermissionsFactories.get(this.toolTarget);
 		if (!factory) throw new Error(`Unsupported tool target: ${this.toolTarget}`);
+		const effectivePermissions = rulesyncPermissions.forTarget({
+			toolTarget: this.toolTarget,
+			logger: this.logger
+		});
 		const toolPermissions = await factory.class.fromRulesyncPermissions({
 			outputRoot: this.outputRoot,
-			rulesyncPermissions,
+			rulesyncPermissions: effectivePermissions,
 			logger: this.logger,
 			global: this.global
 		});
 		if (this.toolTarget !== "codexcli") return [toolPermissions];
 		return [toolPermissions, createCodexcliBashRulesFile({
 			outputRoot: this.outputRoot,
-			config: rulesyncPermissions.getJson()
+			config: effectivePermissions.getJson()
 		})];
 	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
@@ -39692,6 +40115,16 @@ async function generatePermissionsCore(params) {
 //#endregion
 //#region src/lib/import.ts
 /**
+* Import always writes the `.json` variant of a fixed-path source file, but a
+* sibling `.jsonc` variant takes precedence at read time — so an import into a
+* project that authors the `.jsonc` variant would be silently shadowed. Warn
+* so the user merges (or removes) one of the two by hand.
+*/
+async function warnIfShadowedByJsonc(params) {
+	const { outputRoot, jsonRelativePath, jsoncRelativePath, logger } = params;
+	if (await fileExists(join(outputRoot, jsoncRelativePath))) logger.warn(`${jsoncRelativePath} exists and takes precedence over the imported ${jsonRelativePath}. Merge the imported content into ${jsoncRelativePath} (or remove it) so the import takes effect.`);
+}
+/**
 * Import configuration files from AI tools.
 */
 async function importFromTool(params) {
@@ -39803,6 +40236,12 @@ async function importMcpCore(params) {
 	}
 	const rulesyncFiles = await mcpProcessor.convertToolFilesToRulesyncFiles(toolFiles);
 	const { count: writtenCount } = await mcpProcessor.writeAiFiles(rulesyncFiles);
+	if (writtenCount > 0) await warnIfShadowedByJsonc({
+		outputRoot: config.getOutputRoots()[0] ?? ".",
+		jsonRelativePath: RULESYNC_MCP_RELATIVE_FILE_PATH,
+		jsoncRelativePath: RULESYNC_MCP_JSONC_RELATIVE_FILE_PATH,
+		logger
+	});
 	if (config.getVerbose() && writtenCount > 0) logger.success(`Created ${writtenCount} MCP files`);
 	return writtenCount;
 }
@@ -39902,6 +40341,12 @@ async function importHooksCore(params) {
 	}
 	const rulesyncFiles = await hooksProcessor.convertToolFilesToRulesyncFiles(toolFiles);
 	const { count: writtenCount } = await hooksProcessor.writeAiFiles(rulesyncFiles);
+	if (writtenCount > 0) await warnIfShadowedByJsonc({
+		outputRoot: config.getOutputRoots()[0] ?? ".",
+		jsonRelativePath: RULESYNC_HOOKS_RELATIVE_FILE_PATH,
+		jsoncRelativePath: RULESYNC_HOOKS_JSONC_RELATIVE_FILE_PATH,
+		logger
+	});
 	if (config.getVerbose() && writtenCount > 0) logger.success(`Created ${writtenCount} hooks file(s)`);
 	return writtenCount;
 }
@@ -39931,10 +40376,16 @@ async function importPermissionsCore(params) {
 	}
 	const rulesyncFiles = await permissionsProcessor.convertToolFilesToRulesyncFiles(toolFiles);
 	const { count: writtenCount } = await permissionsProcessor.writeAiFiles(rulesyncFiles);
+	if (writtenCount > 0) await warnIfShadowedByJsonc({
+		outputRoot: config.getOutputRoots()[0] ?? ".",
+		jsonRelativePath: RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH,
+		jsoncRelativePath: RULESYNC_PERMISSIONS_JSONC_RELATIVE_FILE_PATH,
+		logger
+	});
 	if (config.getVerbose() && writtenCount > 0) logger.success(`Created ${writtenCount} permissions file(s)`);
 	return writtenCount;
 }
 //#endregion
-export { removeTempDirectory as $, RulesyncCommand as A, checkPathTraversal as B, RulesyncHooks as C, RULESYNC_RULES_RELATIVE_DIR_PATH as Ct, CLAUDECODE_MEMORIES_DIR_NAME as D, formatError as Dt, CLAUDECODE_LOCAL_RULE_FILE_NAME as E, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Et, findControlCharacter as F, findFilesByGlobs as G, directoryExists as H, ConsoleLogger as I, isSymlink as J, getFileSize as K, JsonLogger as L, stringifyFrontmatter as M, loadYaml as N, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as O, ALL_FEATURES as Ot, ConfigResolver as P, removeFile as Q, CLIError as R, HooksProcessor as S, RULESYNC_RELATIVE_DIR_PATH as St, CLAUDECODE_DIR as T, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Tt, ensureDir as U, createTempDirectory as V, fileExists as W, readFileContent as X, listDirectoryFiles as Y, removeDirectory as Z, RulesyncPermissions as _, RULESYNC_MCP_RELATIVE_FILE_PATH as _t, convertFromTool as a, MAX_FILE_SIZE as at, IgnoreProcessor as b, RULESYNC_PERMISSIONS_FILE_NAME as bt, RulesyncRuleFrontmatterSchema as c, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as ct, RulesyncSubagentFrontmatterSchema as d, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as dt, toPosixPath as et, SkillsProcessor as f, RULESYNC_HOOKS_FILE_NAME as ft, SKILL_FILE_NAME as g, RULESYNC_MCP_FILE_NAME as gt, RulesyncSkillFrontmatterSchema as h, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as ht, getProcessorRegistryEntry as i, ToolTargetSchema as it, RulesyncCommandFrontmatterSchema as j, CLAUDECODE_SKILLS_DIR_PATH as k, ALL_FEATURES_WITH_WILDCARD as kt, SubagentsProcessor as l, RULESYNC_CONFIG_RELATIVE_FILE_PATH as lt, RulesyncSkill as m, RULESYNC_IGNORE_RELATIVE_FILE_PATH as mt, checkRulesyncDirExists as n, ALL_TOOL_TARGETS as nt, RulesProcessor as o, RULESYNC_AIIGNORE_FILE_NAME as ot, getLocalSkillDirNames as p, RULESYNC_HOOKS_RELATIVE_FILE_PATH as pt, getHomeDirectory as q, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rt, RulesyncRule as s, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as st, importFromTool as t, writeFileContent as tt, RulesyncSubagent as u, RULESYNC_CONFIG_SCHEMA_URL as ut, McpProcessor as v, RULESYNC_MCP_SCHEMA_URL as vt, CommandsProcessor as w, RULESYNC_SKILLS_RELATIVE_DIR_PATH as wt, RulesyncIgnore as x, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as xt, RulesyncMcp as y, RULESYNC_OVERVIEW_FILE_NAME as yt, ErrorCodes as z };
+export { removeFile as $, CLAUDECODE_SKILLS_DIR_PATH as A, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as At, ErrorCodes as B, RulesyncHooks as C, RULESYNC_PERMISSIONS_FILE_NAME as Ct, CLAUDECODE_LOCAL_RULE_FILE_NAME as D, RULESYNC_RELATIVE_DIR_PATH as Dt, CLAUDECODE_DIR as E, RULESYNC_PERMISSIONS_SCHEMA_URL as Et, ConfigResolver as F, fileExists as G, createTempDirectory as H, findControlCharacter as I, getHomeDirectory as J, findFilesByGlobs as K, ConsoleLogger as L, RulesyncCommandFrontmatterSchema as M, formatError as Mt, stringifyFrontmatter as N, ALL_FEATURES as Nt, CLAUDECODE_MEMORIES_DIR_NAME as O, RULESYNC_RULES_RELATIVE_DIR_PATH as Ot, loadYaml as P, ALL_FEATURES_WITH_WILDCARD as Pt, removeDirectory as Q, JsonLogger as R, HooksProcessor as S, RULESYNC_OVERVIEW_FILE_NAME as St, CODEXCLI_DIR as T, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Tt, directoryExists as U, checkPathTraversal as V, ensureDir as W, listDirectoryFiles as X, isSymlink as Y, readFileContent as Z, RulesyncPermissions as _, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as _t, convertFromTool as a, ToolTargetSchema as at, IgnoreProcessor as b, RULESYNC_MCP_RELATIVE_FILE_PATH as bt, RulesyncRuleFrontmatterSchema as c, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ct, RulesyncSubagentFrontmatterSchema as d, RULESYNC_CONFIG_SCHEMA_URL as dt, removeTempDirectory as et, SkillsProcessor as f, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as ft, SKILL_FILE_NAME as g, RULESYNC_IGNORE_RELATIVE_FILE_PATH as gt, RulesyncSkillFrontmatterSchema as h, RULESYNC_HOOKS_RELATIVE_FILE_PATH as ht, getProcessorRegistryEntry as i, ALL_TOOL_TARGETS_WITH_WILDCARD as it, RulesyncCommand as j, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as jt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as k, RULESYNC_SKILLS_RELATIVE_DIR_PATH as kt, SubagentsProcessor as l, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as lt, RulesyncSkill as m, RULESYNC_HOOKS_JSONC_FILE_NAME as mt, checkRulesyncDirExists as n, writeFileContent as nt, RulesProcessor as o, MAX_FILE_SIZE as ot, getLocalSkillDirNames as p, RULESYNC_HOOKS_FILE_NAME as pt, getFileSize as q, generate as r, ALL_TOOL_TARGETS as rt, RulesyncRule as s, RULESYNC_AIIGNORE_FILE_NAME as st, importFromTool as t, toPosixPath as tt, RulesyncSubagent as u, RULESYNC_CONFIG_RELATIVE_FILE_PATH as ut, McpProcessor as v, RULESYNC_MCP_FILE_NAME as vt, CommandsProcessor as w, RULESYNC_PERMISSIONS_JSONC_FILE_NAME as wt, RulesyncIgnore as x, RULESYNC_MCP_SCHEMA_URL as xt, RulesyncMcp as y, RULESYNC_MCP_JSONC_FILE_NAME as yt, CLIError as z };
 
-//# sourceMappingURL=import-Dioh9ca8.js.map
+//# sourceMappingURL=import-B02AyWkQ.js.map