dyoshikawa/rulesync v43.8.1 on GitHub

What's Changed

permissions (security): generated configs no longer auto-approve inputs that a stricter canonical rule restricts (canonical order is deny > ask > allow). by @dyoshikawa in #3802
- Tools that cannot express an ask tier, such as Cursor and Vibe, and the webfetch rules of Codex CLI, TRAE and Copilot CLI, now withhold every allow that a skipped ask covers, with a warning. A catch-all * allow falls back to the tool's prompt instead; for example, Vibe gets permission = "ask".
- In each JetBrains Junie group, every ask (including denies downgraded to ask) is now listed before every allow, because Junie applies the first match.
- All-tools * deny/ask restrictions are now honored in every category, not only bash. Allows the restriction covers are withheld. OpenCode and Kilo are last-match-wins, so the restriction is restated after the allows. Vibe, Codex CLI, Copilot in VS Code, CodeBuddy, Qoder, Command Code, Letta Code and Qwen Code write native deny/ask entries where they can.
- On Google Antigravity, a deny/ask it cannot represent is still skipped, and it now also withholds the allows of the same action that cover it, such as read_file beside a skipped **/.env deny.
permissions (Google Antigravity): a warning is now shown for targets that start with %VAR%, ~\ or ~user. Antigravity does not expand these, so a deny written with them may not block anything. by @beingmomen in #3793

security guide: updated the guidance on pinning the OpenCode GitHub action. The pinned wrapper already SHA-pins actions/cache, and Dependabot is set to keep it frozen. by @521Peter in #3805
security guide: clarified why the OpenCode action stays pinned to github-v1.2.28 and what the runtime trust boundaries are: the CLI installer, secrets in the composite step's env, and id-token: write. by @jdotc1 in #3823

Full Changelog: v43.8.0...v43.8.1