rulesync 16.32.0 → 16.33.0

package/dist/{import-D5n_V39C.js → import-C6R-lXFF.js}

@@ -558,6 +558,7 @@ const mcpProcessorToolTargetTuple = [
 	"copilot",
 	"copilotcli",
 	"cortexcode",
+	"crush",
 	"cursor",
 	"deepagents",
 	"factorydroid",
@@ -694,6 +695,7 @@ const skillsProcessorToolTargetTuple = [
 	"musecode",
 	"opencode",
 	"pi",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"replit",
@@ -724,6 +726,7 @@ const hooksProcessorToolTargetTuple = [
 	"copilot",
 	"copilotcli",
 	"cortexcode",
+	"crush",
 	"opencode",
 	"pi",
 	"factorydroid",
@@ -756,6 +759,7 @@ const permissionsProcessorToolTargetTuple = [
 	"continue",
 	"copilot",
 	"copilotcli",
+	"crush",
 	"cursor",
 	"deepagents",
 	"devin",
@@ -3283,6 +3287,9 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	"reasonix.toml",
 	".vscode/settings.json",
 	".zed/settings.json",
+	"crush.json",
+	".crush.json",
+	".config/crush/crush.json",
 	"kilo.json",
 	"kilo.jsonc",
 	"opencode.json",
@@ -3487,6 +3494,27 @@ function omitPrototypePollutionKeys(record) {
 	}
 	return sanitized;
 }
+/**
+* Like {@link omitPrototypePollutionKeys}, but recursive: every plain object
+* reachable through the value (directly, or through an array) is copied with
+* its prototype-pollution keys dropped. Scalars and arrays of scalars come back
+* as they are.
+*
+* Use when passing an unknown, user-supplied value through unchanged — an MCP
+* server field a tool documents that rulesync does not model — so a
+* `__proto__` key nested anywhere inside it cannot ride into the generated
+* config, where the consuming tool may merge the object without the same care.
+*/
+function omitPrototypePollutionKeysDeep(value) {
+	if (Array.isArray(value)) return value.map((entry) => omitPrototypePollutionKeysDeep(entry));
+	if (value === null || typeof value !== "object") return value;
+	const sanitized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = omitPrototypePollutionKeysDeep(entry);
+	}
+	return sanitized;
+}
 //#endregion
 //#region src/utils/type-guards.ts
 /**
@@ -4554,6 +4582,14 @@ const VIBE_HOOK_EVENTS = [
 	"stop"
 ];
 /**
+* Hook events supported by Crush.
+*
+* Crush's `hooks` config block currently fires a single event, `PreToolUse`
+* (Claude Code-compatible payload; `matcher` is a regex on the tool name).
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+*/
+const CRUSH_HOOK_EVENTS = ["preToolUse"];
+/**
 * Hook events supported by JetBrains Junie CLI.
 *
 * Junie CLI exposes seven lifecycle events under the `"hooks"` key of
@@ -5096,6 +5132,7 @@ const HooksConfigSchema = z.looseObject({
 	grokcli: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	"kimi-code": z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	zcode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
+	crush: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	bob: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	cortexcode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	continue: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
@@ -5593,6 +5630,13 @@ const VIBE_TO_CANONICAL_EVENT_NAMES = {
 	post_agent_turn: "stop"
 };
 /**
+* Canonical -> Crush event names. Crush spells its events the Claude Code
+* way (`PreToolUse`).
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+*/
+const CANONICAL_TO_CRUSH_EVENT_NAMES = { preToolUse: "PreToolUse" };
+const CRUSH_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_EVENT_NAMES).map(([k, v]) => [v, k]));
+/**
 * Map canonical camelCase event names to Qwen Code PascalCase.
 *
 * Qwen Code reuses the same Claude-style PascalCase event names for the events
@@ -6032,6 +6076,11 @@ const McpServerSchema = z.looseObject({
 	kiroAutoBlock: z.optional(z.array(z.string())),
 	musecodeMode: z.optional(z.enum(["required", "optional"])),
 	rovodevEnableInstructions: z.optional(z.boolean()),
+	crushOauth: z.optional(z.boolean()),
+	crushOauthClientId: z.optional(z.string()),
+	crushOauthClientSecret: z.optional(z.string()),
+	crushOauthCallbackPort: z.optional(z.int()),
+	crushSessionless: z.optional(z.boolean()),
 	headers: z.optional(z.record(z.string(), z.string())),
 	/**
 	* The canonical per-server tool allowlist.
@@ -6108,6 +6157,8 @@ const RulesyncMcpFileSchema = z.looseObject({
 	continue: z.optional(toolScopedMcpSchema),
 	copilot: z.optional(toolScopedMcpSchema),
 	copilotcli: z.optional(toolScopedMcpSchema),
+	cortexcode: z.optional(toolScopedMcpSchema),
+	crush: z.optional(toolScopedMcpSchema),
 	cursor: z.optional(toolScopedMcpSchema),
 	deepagents: z.optional(toolScopedMcpSchema),
 	devin: z.optional(toolScopedMcpSchema),
@@ -6124,7 +6175,6 @@ const RulesyncMcpFileSchema = z.looseObject({
 	reasonix: z.optional(toolScopedMcpSchema),
 	roo: z.optional(toolScopedMcpSchema),
 	rovodev: z.optional(toolScopedMcpSchema),
-	cortexcode: z.optional(toolScopedMcpSchema),
 	tabnine: z.optional(toolScopedMcpSchema),
 	takt: z.optional(toolScopedMcpSchema),
 	vibe: z.optional(toolScopedMcpSchema),
@@ -6456,6 +6506,15 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 				"musecodeMode",
 				"rovodevEnableInstructions",
 				"enable_instructions",
+				"crushOauth",
+				"crushOauthClientId",
+				"crushOauthClientSecret",
+				"crushOauthCallbackPort",
+				"crushSessionless",
+				"oauth_client_id",
+				"oauth_client_secret",
+				"oauth_callback_port",
+				"sessionless",
 				"enabled"
 			])];
 		}));
@@ -6904,7 +6963,7 @@ const CursorPermissionsOverrideSchema = z.looseObject({
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
 * `sandbox`, `sandboxImage`, `disabled`, `visible`, `eager`, `listDirectory`,
-* `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
+* `todoWrite`, `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
 * `allowPrivateNetworkHooks`, `allowedInsecureVoiceBaseUrls`). Qwen Code strips
 * `tools.workflowsEnabled`, `security.allowPrivateNetworkHooks` and
 * `security.allowedInsecureVoiceBaseUrls` out of workspace settings, so generate
@@ -6917,7 +6976,7 @@ const CursorPermissionsOverrideSchema = z.looseObject({
 * changes what the file said is reported in either scope, naming what that key
 * decides there — the autonomy and containment
 * controls (`approvalMode`, `autoAccept`, `sandbox`, `sandboxImage`), the
-* registry controls (`disabled`, `visible`, `listDirectory`, and `eager`, which
+* registry controls (`disabled`, `visible`, `listDirectory`, `todoWrite`, and `eager`, which
 * demotes an omitted tool to deferred rather than removing it, replacing rather
 * than merging with the list a higher scope set), the Auto Mode
 * classifier config, and, because these groups are loose objects, any key
@@ -6958,6 +7017,14 @@ const QwencodePermissionsOverrideSchema = z.looseObject({
 * `looseObject` (verbatim passthrough). Both project and global scope are
 * supported.
 *
+* Only `tools` and `general` are written; any other key is ignored with a
+* warning. Within them, the paths Tabnine CLI runs as a command or sends its
+* traffic to — `tools.discoveryCommand`, `tools.callCommand`,
+* `tools.shell.pager`, `tools.sandbox.command`, `general.tabnineHost` and
+* `general.preferredEditor` — are refused with a warning rather than written,
+* so a fetched permissions file cannot point the CLI at an executable or a
+* server of its choosing; set those by hand in `settings.json`.
+*
 * @example
 * { "tools": { "core": ["read_file", "run_shell_command(git)"] },
 *   "general": { "defaultApprovalMode": "plan" } }
@@ -7742,6 +7809,7 @@ const PermissionsConfigSchema = z.looseObject({
 	continue: z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: z.optional(CanonicalPermissionsOverrideSchema),
 	copilotcli: z.optional(CanonicalPermissionsOverrideSchema),
+	crush: z.optional(CanonicalPermissionsOverrideSchema),
 	goose: z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": z.optional(KimiCodePermissionsOverrideSchema),
@@ -12767,6 +12835,26 @@ const ZCODE_USER_CONFIG_DECLARATION = {
 	}
 };
 /**
+* Crush's JSON config, shared by the project (`crush.json` / `.crush.json`)
+* and global (`~/.config/crush/crush.json`) spellings so a policy edit lands
+* on both. See the `SHARED_CONFIG_OWNERSHIP` entries for the key rationale.
+*/
+const CRUSH_CONFIG_DECLARATION = {
+	format: "json",
+	invalidRootPolicy: "error",
+	features: {
+		mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp"]
+		},
+		hooks: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["hooks"]
+		},
+		permissions: { kind: "deep-merge" }
+	}
+};
+/**
 * What the two Claude Code settings files have in common: both are plain JSON,
 * and both validate against the one published schema, which the gateway
 * points every file it writes at. `.claude/settings.local.json` is the same
@@ -13027,6 +13115,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 	},
 	".zcode/config.json": ZCODE_WORKSPACE_CONFIG_DECLARATION,
 	".zcode/cli/config.json": ZCODE_USER_CONFIG_DECLARATION,
+	"crush.json": CRUSH_CONFIG_DECLARATION,
+	".config/crush/crush.json": CRUSH_CONFIG_DECLARATION,
 	".bob/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -18876,15 +18966,12 @@ var TabnineCommand = class TabnineCommand extends ToolCommand {
 		return this.body;
 	}
 	getFrontmatter() {
-		return {
-			description: this.frontmatter.description,
-			prompt: this.frontmatter.prompt
-		};
+		return this.frontmatter;
 	}
 	toRulesyncCommand() {
 		const { description, prompt: _prompt, ...restFields } = this.frontmatter;
 		const rulesyncFrontmatter = {
-			targets: ["tabnine"],
+			targets: ["*"],
 			description,
 			...Object.keys(restFields).length > 0 && { tabnine: restFields }
 		};
@@ -20847,7 +20934,20 @@ function stableJson(value) {
 */
 function isSafeStringRecord(value) {
 	if (!isPlainObject$1(value) || !isStringRecord(value)) return false;
-	return Object.entries(value).every(([key, entry]) => key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || entry.includes(char)));
+	return Object.entries(value).every(([key, entry]) => isSafeEnvEntry({
+		key,
+		value: entry
+	}));
+}
+/**
+* Whether one `env` entry survives the rule {@link isSafeStringRecord} applies
+* to the whole map. Exported for the adapters that hand a tool an environment
+* block outside the shared converter (Tabnine, whose hook shape it does not
+* express) so they drop the same entries this one does.
+*/
+function isSafeEnvEntry(entry) {
+	const { key, value } = entry;
+	return typeof value === "string" && key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || value.includes(char));
 }
 /**
 * Control characters cannot ride from an existing tool config into a canonical
@@ -21738,135 +21838,6 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hooks/bob-hooks.ts
-const BOB_CONVERTER_CONFIG = {
-	supportedEvents: BOB_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_BOB_EVENT_NAMES,
-	toolToCanonicalEventNames: BOB_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "",
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"sessionStart",
-		"beforeSubmitPrompt",
-		"stop"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
-	wildcardMatcherMeansAll: true
-};
-/**
-* Single spelling of the settings.json codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Bob settings with
-* generated output.
-*/
-function parseBobSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
-* IBM Bob lifecycle hooks.
-*
-* Hooks live under the top-level `hooks` key of Bob's settings file —
-* `<project>/.bob/settings.json` (project scope) and
-* `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
-* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
-* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
-* settings rulesync does not own, so generation merges the `hooks` key into it
-* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
-*
-* @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
-*/
-var BobHooks = class BobHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
-	}
-	static getSettablePaths({ global = false } = {}) {
-		return {
-			relativeDirPath: global ? BOB_GLOBAL_SETTINGS_DIR_PATH : BOB_DIR,
-			relativeFilePath: BOB_SETTINGS_FILE_NAME
-		};
-	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = BobHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = BobHooks.getSettablePaths({ global });
-		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.bob?.hooks,
-			converterConfig: BOB_CONVERTER_CONFIG,
-			logger
-		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
-			logger
-		});
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = join(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseBobSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Bob hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: BOB_CONVERTER_CONFIG
-		});
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
-			hooks,
-			overrideKey: "bob"
-		}), null, 2) });
-	}
-	validate() {
-		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
-		});
-	}
-};
-//#endregion
 //#region src/features/hooks/preserve-unowned-hook-commands.ts
 /**
 * Read the `hooks` value from a destination JSON file.
@@ -22153,75 +22124,22 @@ function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
 }
 //#endregion
-//#region src/features/hooks/claudecode-hooks.ts
-const CLAUDE_CONVERTER_CONFIG = {
-	supportedEvents: CLAUDE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CLAUDE_EVENT_NAMES,
-	toolToCanonicalEventNames: CLAUDE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CLAUDE_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"worktreeCreate",
-		"worktreeRemove",
-		"messageDisplay",
-		"postToolBatch",
-		"taskCreated",
-		"taskCompleted",
-		"teammateIdle",
-		"cwdChanged",
-		"beforeSubmitPrompt",
-		"stop"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set([
-		"command",
-		"prompt",
-		"http",
-		"mcp_tool",
-		"agent"
-	]),
-	emitsPromptModel: true,
-	stringPassthroughFields: [
-		{
-			canonical: "if",
-			tool: "if"
-		},
-		{
-			canonical: "statusMessage",
-			tool: "statusMessage"
-		},
-		{
-			canonical: "shell",
-			tool: "shell",
-			commandOnly: true
-		}
-	],
-	booleanPassthroughFields: [
-		{
-			canonical: "once",
-			tool: "once"
-		},
-		{
-			canonical: "async",
-			tool: "async",
-			commandOnly: true
-		},
-		{
-			canonical: "asyncRewake",
-			tool: "asyncRewake",
-			commandOnly: true
-		},
-		{
-			canonical: "continueOnBlock",
-			tool: "continueOnBlock"
-		}
-	],
-	arrayPassthroughFields: [{
-		canonical: "args",
-		tool: "args",
-		commandOnly: true
-	}]
-};
-var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
+//#region src/features/hooks/settings-json-hooks.ts
+/**
+* Shared implementation for the tools whose hooks live under the top-level
+* `hooks` key of a JSON settings file in Claude Code's shape —
+* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command", ... }] }] }`
+* — and whose file also holds settings rulesync does not own, so generation
+* merges the `hooks` key into it (see `SHARED_CONFIG_OWNERSHIP`) instead of
+* overwriting it, and `--delete` never removes the file wholesale.
+*
+* A concrete adapter supplies its {@link SettingsJsonHooksSpec} and its
+* settable paths; the event mapping, the matcher rules and the per-hook
+* fields the tool documents are all expressed in the spec's converter config.
+* An adapter that also supports preserving unowned hooks (Claude Code) opts in
+* through {@link ToolHooks.supportsPreserveUnowned}.
+*/
+var SettingsJsonHooks = class extends ToolHooks {
 	constructor(params) {
 		super({
 			...params,
@@ -22231,24 +22149,42 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 	isDeletable() {
 		return false;
 	}
+	/** The tool-specific half of the adapter. Every concrete class overrides this. */
+	static getSpec() {
+		throw new Error(`${this.name} does not define getSpec()`);
+	}
 	/**
-	* The converter config used for both directions. Exposed as a static hook so
-	* plugin-scoped subclasses can swap tool-specific details (e.g. the project
-	* directory variable) without duplicating the rest of the config.
+	* The converter config used for both directions. A separate hook so a
+	* subclass can swap tool-specific details (e.g. the project directory
+	* variable) without redefining the whole spec.
 	*/
 	static getConverterConfig() {
-		return CLAUDE_CONVERTER_CONFIG;
+		return this.getSpec().converterConfig;
 	}
 	static getSettablePaths(_options = {}) {
-		return {
-			relativeDirPath: CLAUDECODE_DIR,
-			relativeFilePath: CLAUDECODE_SETTINGS_FILE_NAME
-		};
+		throw new Error(`${this.name} does not define getSettablePaths()`);
+	}
+	/**
+	* The `SHARED_CONFIG_OWNERSHIP` key the settings file is merged under. By
+	* default it is derived from the settable paths; an adapter whose file is
+	* declared under another tool's key (the Claude Code plugin bundle) overrides
+	* it.
+	*/
+	static getSharedFileKey(paths) {
+		return sharedConfigFileKey(paths);
+	}
+	/**
+	* `new this(params)` for the concrete adapter the static method was called
+	* on; the cast is what an abstract class needs to be constructed through
+	* `this`, and lives in one place.
+	*/
+	static instantiate(params) {
+		return new this(params);
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -22256,40 +22192,41 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 			validate
 		});
 	}
-	static supportsPreserveUnowned() {
-		return true;
-	}
 	static async getAuxiliaryFiles({ toolHooks } = {}) {
-		return toolHooks instanceof ClaudecodeHooks ? toolHooks.getOwnershipLockFiles() : [];
+		return toolHooks instanceof this ? toolHooks.getOwnershipLockFiles() : [];
 	}
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		const config = rulesyncHooks.getJson();
-		const claudeHooks = canonicalToToolHooks({
+		const generatedHooks = canonicalToToolHooks({
 			config,
-			toolOverrideHooks: config.claudecode?.hooks,
+			toolOverrideHooks: overrideHooksOf({
+				config,
+				overrideKey: this.getSpec().overrideKey
+			}),
 			converterConfig: this.getConverterConfig(),
 			logger
 		});
 		const preserving = preserveUnowned && this.supportsPreserveUnowned();
 		const merged = mergeGeneratedHookLists({
 			existingContent,
-			generatedHooks: claudeHooks,
+			generatedHooks,
 			shape: "matcher-groups",
 			preserveUnowned: preserving,
 			previouslyOwned: preserving ? parseHooksOwnershipLock(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0,
 			logger
 		});
 		const fileContent = applySharedConfigPatch({
-			fileKey: CLAUDE_SETTINGS_SHARED_FILE_KEY,
+			fileKey: this.getSharedFileKey(paths),
 			feature: "hooks",
 			existingContent,
 			patch: { hooks: merged.hooks },
-			filePath
+			filePath,
+			logger
 		});
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -22299,20 +22236,29 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		});
 	}
 	toRulesyncHooks({ logger } = {}) {
+		const ctor = this.constructor;
+		const spec = ctor.getSpec();
+		const configPath = join(this.getRelativeDirPath(), this.getRelativeFilePath());
 		let settings;
 		try {
-			settings = JSON.parse(this.getFileContent());
+			settings = parseSharedConfig({
+				format: "json",
+				fileContent: this.getFileContent(),
+				filePath: configPath,
+				invalidRootPolicy: "error"
+			});
 		} catch (error) {
-			throw new Error(`Failed to parse Claude hooks content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+			const reason = error instanceof Error && error.cause instanceof Error ? error.cause : error;
+			throw new Error(`Failed to parse ${spec.displayName} hooks content in ${configPath}: ${formatError(reason)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
+			logger,
 			hooks: settings.hooks,
-			converterConfig: this.constructor.getConverterConfig(),
-			logger
+			converterConfig: ctor.getConverterConfig()
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey: "claudecode"
+			overrideKey: spec.overrideKey
 		}), null, 2) });
 	}
 	validate() {
@@ -22322,7 +22268,7 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		};
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
@@ -22331,6 +22277,158 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		});
 	}
 };
+/**
+* The `hooks` map of a tool's override block (`config.<overrideKey>.hooks`),
+* or `undefined` when the block states none. The schema keeps every override
+* block loose, so the lookup goes through the record form.
+*/
+function overrideHooksOf({ config, overrideKey }) {
+	const override = lookupOwn({
+		record: config,
+		key: overrideKey
+	});
+	if (!isPlainObject$1(override)) return;
+	const hooks = override.hooks;
+	return isPlainObject$1(hooks) ? hooks : void 0;
+}
+//#endregion
+//#region src/features/hooks/bob-hooks.ts
+const BOB_SPEC = {
+	displayName: "Bob",
+	overrideKey: "bob",
+	converterConfig: {
+		supportedEvents: BOB_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_BOB_EVENT_NAMES,
+		toolToCanonicalEventNames: BOB_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "",
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"sessionStart",
+			"beforeSubmitPrompt",
+			"stop"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+		wildcardMatcherMeansAll: true
+	}
+};
+/**
+* IBM Bob lifecycle hooks.
+*
+* Hooks live under the top-level `hooks` key of Bob's settings file —
+* `<project>/.bob/settings.json` (project scope) and
+* `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
+* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
+* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
+* settings rulesync does not own, so generation merges the `hooks` key into it
+* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
+*
+* @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
+*/
+var BobHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return BOB_SPEC;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? BOB_GLOBAL_SETTINGS_DIR_PATH : BOB_DIR,
+			relativeFilePath: BOB_SETTINGS_FILE_NAME
+		};
+	}
+};
+//#endregion
+//#region src/features/hooks/claudecode-hooks.ts
+const CLAUDE_SPEC = {
+	displayName: "Claude",
+	overrideKey: "claudecode",
+	converterConfig: {
+		supportedEvents: CLAUDE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CLAUDE_EVENT_NAMES,
+		toolToCanonicalEventNames: CLAUDE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CLAUDE_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"worktreeCreate",
+			"worktreeRemove",
+			"messageDisplay",
+			"postToolBatch",
+			"taskCreated",
+			"taskCompleted",
+			"teammateIdle",
+			"cwdChanged",
+			"beforeSubmitPrompt",
+			"stop"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set([
+			"command",
+			"prompt",
+			"http",
+			"mcp_tool",
+			"agent"
+		]),
+		emitsPromptModel: true,
+		stringPassthroughFields: [
+			{
+				canonical: "if",
+				tool: "if"
+			},
+			{
+				canonical: "statusMessage",
+				tool: "statusMessage"
+			},
+			{
+				canonical: "shell",
+				tool: "shell",
+				commandOnly: true
+			}
+		],
+		booleanPassthroughFields: [
+			{
+				canonical: "once",
+				tool: "once"
+			},
+			{
+				canonical: "async",
+				tool: "async",
+				commandOnly: true
+			},
+			{
+				canonical: "asyncRewake",
+				tool: "asyncRewake",
+				commandOnly: true
+			},
+			{
+				canonical: "continueOnBlock",
+				tool: "continueOnBlock"
+			}
+		],
+		arrayPassthroughFields: [{
+			canonical: "args",
+			tool: "args",
+			commandOnly: true
+		}]
+	}
+};
+var ClaudecodeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CLAUDE_SPEC;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: CLAUDECODE_DIR,
+			relativeFilePath: CLAUDECODE_SETTINGS_FILE_NAME
+		};
+	}
+	/**
+	* Every Claude-shaped settings file rulesync writes for Claude Code — the
+	* project and user `settings.json` and the plugin bundle's `hooks.json` — is
+	* declared under the one Claude key in `SHARED_CONFIG_OWNERSHIP`.
+	*/
+	static getSharedFileKey(_paths) {
+		return CLAUDE_SETTINGS_SHARED_FILE_KEY;
+	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+};
 //#endregion
 //#region src/features/hooks/claudecode-plugin-hooks.ts
 var ClaudecodePluginHooks = class extends ClaudecodeHooks {
@@ -22858,54 +22956,45 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 };
 //#endregion
 //#region src/features/hooks/continue-hooks.ts
-const CONTINUE_CONVERTER_CONFIG = {
-	supportedEvents: CONTINUE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CONTINUE_EVENT_NAMES,
-	toolToCanonicalEventNames: CONTINUE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CONTINUE_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"beforeSubmitPrompt",
-		"stop",
-		"teammateIdle",
-		"taskCompleted",
-		"worktreeCreate",
-		"worktreeRemove"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set([
-		"command",
-		"prompt",
-		"http",
-		"agent"
-	]),
-	emitsPromptModel: true,
-	stringPassthroughFields: [{
-		canonical: "statusMessage",
-		tool: "statusMessage"
-	}],
-	booleanPassthroughFields: [{
-		canonical: "once",
-		tool: "once"
-	}, {
-		canonical: "async",
-		tool: "async",
-		commandOnly: true
-	}]
+const CONTINUE_SPEC = {
+	displayName: "Continue",
+	overrideKey: "continue",
+	converterConfig: {
+		supportedEvents: CONTINUE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CONTINUE_EVENT_NAMES,
+		toolToCanonicalEventNames: CONTINUE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CONTINUE_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"beforeSubmitPrompt",
+			"stop",
+			"teammateIdle",
+			"taskCompleted",
+			"worktreeCreate",
+			"worktreeRemove"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set([
+			"command",
+			"prompt",
+			"http",
+			"agent"
+		]),
+		emitsPromptModel: true,
+		stringPassthroughFields: [{
+			canonical: "statusMessage",
+			tool: "statusMessage"
+		}],
+		booleanPassthroughFields: [{
+			canonical: "once",
+			tool: "once"
+		}, {
+			canonical: "async",
+			tool: "async",
+			commandOnly: true
+		}]
+	}
 };
 /**
-* Single spelling of the settings/hooks codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Continue settings with
-* generated output.
-*/
-function parseContinueSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
 * Continue CLI hooks.
 *
 * Hooks live under the top-level `hooks` key of `<project>/.continue/settings.json`
@@ -22921,15 +23010,9 @@ function parseContinueSettings(fileContent, filePath) {
 * @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/hookConfig.ts
 * @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/types.ts
 */
-var ContinueHooks = class ContinueHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
+var ContinueHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CONTINUE_SPEC;
 	}
 	static getSettablePaths(_options = {}) {
 		return {
@@ -22937,77 +23020,6 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 			relativeFilePath: CONTINUE_SETTINGS_FILE_NAME
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = ContinueHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new ContinueHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = ContinueHooks.getSettablePaths({ global });
-		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.continue?.hooks,
-			converterConfig: CONTINUE_CONVERTER_CONFIG,
-			logger
-		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
-			logger
-		});
-		return new ContinueHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = join(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseContinueSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Continue hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: CONTINUE_CONVERTER_CONFIG
-		});
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
-			hooks,
-			overrideKey: "continue"
-		}), null, 2) });
-	}
-	validate() {
-		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new ContinueHooks({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
-		});
-	}
 };
 //#endregion
 //#region src/features/hooks/copilot-hooks.ts
@@ -23598,33 +23610,24 @@ const CORTEXCODE_SKILLS_DIR_PATH = join(CORTEXCODE_DIR, "skills");
 const CORTEXCODE_GLOBAL_SKILLS_DIR_PATH = join(CORTEXCODE_GLOBAL_DIR_PATH, "skills");
 //#endregion
 //#region src/features/hooks/cortexcode-hooks.ts
-const CORTEXCODE_CONVERTER_CONFIG = {
-	supportedEvents: CORTEXCODE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CORTEXCODE_EVENT_NAMES,
-	toolToCanonicalEventNames: CORTEXCODE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CORTEX_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]),
-	supportedHookTypes: /* @__PURE__ */ new Set(["command", "prompt"]),
-	booleanPassthroughFields: [{
-		canonical: "enabled",
-		tool: "enabled"
-	}]
+const CORTEXCODE_SPEC = {
+	displayName: "Cortex Code",
+	overrideKey: "cortexcode",
+	converterConfig: {
+		supportedEvents: CORTEXCODE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CORTEXCODE_EVENT_NAMES,
+		toolToCanonicalEventNames: CORTEXCODE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CORTEX_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command", "prompt"]),
+		booleanPassthroughFields: [{
+			canonical: "enabled",
+			tool: "enabled"
+		}]
+	}
 };
 /**
-* Single spelling of the settings/hooks codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Cortex Code settings with
-* generated output.
-*/
-function parseCortexcodeSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
 * Snowflake Cortex Code hooks.
 *
 * Hooks live under the top-level `hooks` key of `<project>/.cortex/settings.json`
@@ -23633,20 +23636,16 @@ function parseCortexcodeSettings(fileContent, filePath) {
 * "<regex>", "hooks": [{ "type": "command" | "prompt", ..., "timeout"?:
 * <seconds>, "enabled"?: <boolean> }] }] }`. The project file also holds
 * settings rulesync does not own, so generation merges the `hooks` key into
-* either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
+* either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it, and
+* neither file is removed wholesale (hooks.json sits in the CLI-owned
+* `~/.snowflake/cortex/` tree).
 *
 * @see https://docs.snowflake.com/en/user-guide/cortex-code/extensibility
 * @see https://docs.snowflake.com/en/user-guide/cortex-code/settings
 */
-var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
+var CortexcodeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CORTEXCODE_SPEC;
 	}
 	static getSettablePaths({ global = false } = {}) {
 		return global ? {
@@ -23657,60 +23656,338 @@ var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
 			relativeFilePath: CORTEXCODE_SETTINGS_FILE_NAME
 		};
 	}
+};
+//#endregion
+//#region src/constants/crush-paths.ts
+const CRUSH_RULE_FILE_NAME = "CRUSH.md";
+const CRUSH_GLOBAL_DIR = join(".config", "crush");
+const CRUSH_LOCAL_RULE_FILE_NAME = "CRUSH.local.md";
+const CRUSH_IGNORE_FILE_NAME = ".crushignore";
+const CRUSH_SKILLS_PROJECT_DIR = join(".crush", "skills");
+const CRUSH_SKILLS_GLOBAL_DIR = join(CRUSH_GLOBAL_DIR, "skills");
+const CRUSH_CONFIG_FILE_NAME = "crush.json";
+const CRUSH_HIDDEN_CONFIG_FILE_NAME = ".crush.json";
+const CRUSH_PERMISSIONS_KEY = "permissions";
+const CRUSH_ALLOWED_TOOLS_KEY = "allowed_tools";
+const CRUSH_OPTIONS_KEY = "options";
+const CRUSH_DISABLED_TOOLS_KEY = "disabled_tools";
+const CRUSH_HOOKS_KEY = "hooks";
+//#endregion
+//#region src/features/crush-config.ts
+/**
+* Where Crush's JSON config lives for a scope, before the project-scope twin
+* is resolved: `<project>/crush.json` or `~/.config/crush/crush.json`. This is
+* also the key every adapter reports through `getSettablePaths`, so the
+* shared-config ownership declaration, the gitignore derivation and the
+* shared-write ordering all see one file per scope.
+*/
+function getCrushConfigSettablePaths({ global = false } = {}) {
+	return {
+		relativeDirPath: global ? CRUSH_GLOBAL_DIR : ".",
+		relativeFilePath: CRUSH_CONFIG_FILE_NAME
+	};
+}
+/**
+* Resolves which Crush config file an adapter should read and write.
+*
+* At project scope Crush discovers both `.crush.json` and `crush.json` in the
+* working directory and merges every file it finds with `.crush.json` on top
+* (objects merge recursively, lists are concatenated, scalars are overridden).
+* Neither file therefore hides the other: an entry left in `crush.json` stays
+* in effect next to whatever `.crush.json` says. An existing `.crush.json` is
+* preferred because the user chose that spelling; otherwise `crush.json` is
+* used (and created when neither exists). The global scope has a single
+* spelling.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+async function resolveCrushConfigFile({ outputRoot, global = false }) {
+	const paths = getCrushConfigSettablePaths({ global });
+	const configDir = join(outputRoot, paths.relativeDirPath);
+	const filePath = join(configDir, paths.relativeFilePath);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (!global) {
+		const hiddenPath = join(configDir, CRUSH_HIDDEN_CONFIG_FILE_NAME);
+		const hiddenContent = await readFileContentOrNull(hiddenPath);
+		if (hiddenContent !== null) return {
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: CRUSH_HIDDEN_CONFIG_FILE_NAME,
+			filePath: hiddenPath,
+			fileContent: hiddenContent,
+			...fileContent === null ? {} : { twin: {
+				filePath,
+				fileContent
+			} }
+		};
+	}
+	return {
+		relativeDirPath: paths.relativeDirPath,
+		relativeFilePath: paths.relativeFilePath,
+		filePath,
+		fileContent
+	};
+}
+/**
+* Single spelling of the crush.json codec/policy, matching the
+* `SHARED_CONFIG_OWNERSHIP` declaration for both scopes: fail closed on an
+* unparseable root rather than replacing the user's Crush config with
+* generated output.
+*/
+function parseCrushConfig(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "json",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Combine two Crush config documents the way Crush itself does
+* (`github.com/qjebbs/go-jsons`): objects merge recursively, arrays are
+* concatenated with `base` first, and any other value from `override` wins.
+*/
+function mergeCrushConfigs({ base, override }) {
+	const merged = { ...base };
+	for (const [key, value] of Object.entries(override)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const current = merged[key];
+		if (isRecord$1(current) && isRecord$1(value)) merged[key] = mergeCrushConfigs({
+			base: current,
+			override: value
+		});
+		else if (Array.isArray(current) && Array.isArray(value)) merged[key] = [...current, ...value];
+		else merged[key] = value;
+	}
+	return merged;
+}
+/**
+* The content an import should read for a resolved location: the chosen file
+* merged over its twin when both exist, so a server, hook or tool entry that
+* only the lower-priority `crush.json` declares is imported too — Crush sees
+* it, so rulesync should as well.
+*/
+function crushConfigImportContent(location) {
+	const own = location.fileContent ?? "{}";
+	if (location.twin === void 0) return own;
+	const merged = mergeCrushConfigs({
+		base: parseCrushConfig(location.twin.fileContent, location.twin.filePath),
+		override: parseCrushConfig(own, location.filePath)
+	});
+	return JSON.stringify(merged, null, 2);
+}
+function lookupPath(root, path) {
+	let current = root;
+	for (const segment of path) {
+		if (!isRecord$1(current) || !Object.hasOwn(current, segment)) return;
+		current = current[segment];
+	}
+	return current;
+}
+function isNonEmptyValue(value) {
+	if (Array.isArray(value)) return value.length > 0;
+	if (isRecord$1(value)) return Object.keys(value).length > 0;
+	return value !== void 0;
+}
+/**
+* Warn when the twin Crush merges beneath the written file still carries a
+* value at one of the paths this feature owns. Rulesync only rewrites the
+* chosen file, and because Crush concatenates lists and merges objects across
+* the pair, such an entry — typically one an earlier generate wrote to
+* `crush.json` before the user added a `.crush.json` — stays in effect until
+* removed by hand, and cannot be retracted from `.rulesync/`.
+*/
+function warnCrushTwinLeftovers({ location, ownedPaths, logger }) {
+	if (location.twin === void 0) return;
+	let twin;
+	try {
+		twin = parseCrushConfig(location.twin.fileContent, location.twin.filePath);
+	} catch {
+		return;
+	}
+	const leftovers = ownedPaths.filter((path) => isNonEmptyValue(lookupPath(twin, path))).map((path) => `"${path.join(".")}"`);
+	if (leftovers.length === 0) return;
+	logger?.warn(`Crush merges ${location.twin.filePath} beneath ${location.filePath} (objects recursively, lists concatenated), so the ${leftovers.join(", ")} entries it still carries stay in effect and are not managed by rulesync; remove them from that file by hand.`);
+}
+//#endregion
+//#region src/features/hooks/crush-hooks.ts
+const SUPPORTED_CRUSH_EVENTS = new Set(CRUSH_HOOK_EVENTS);
+/**
+* Crush matches an event key case-insensitively and ignores underscores
+* (`PreToolUse`, `pre_tool_use` and `PRE_TOOL_USE` all work), so an import
+* looks the canonical name up by that normalized spelling.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+const NORMALIZED_CRUSH_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CRUSH_TO_CANONICAL_EVENT_NAMES).map(([crushEvent, canonical]) => [normalizeCrushEventName(crushEvent), canonical]));
+function normalizeCrushEventName(event) {
+	return event.replaceAll("_", "").toLowerCase();
+}
+/**
+* Build the `hooks` block of `crush.json` from a canonical hooks config.
+* Crush keys a flat array of `{name, matcher, command, timeout}` entries by
+* event name; `matcher` is a regex tested against the (lower-case) Crush tool
+* name and `timeout` is in seconds. Only `type: "command"` canonical hooks are
+* emitted, since a Crush hook is a shell command. A shared canonical event
+* Crush does not fire is skipped (the HooksProcessor reports it), while an
+* event under the `crush.hooks` override — such as one an import filed there
+* — is written verbatim so it round-trips.
+*/
+function canonicalToCrushHooks({ config, toolOverride, logger }) {
+	const sharedHooks = {};
+	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_CRUSH_EVENTS.has(event)) sharedHooks[event] = defs;
+	const effective = {
+		...sharedHooks,
+		...toolOverride
+	};
+	const hooks = {};
+	for (const [event, defs] of Object.entries(effective)) {
+		if (isPrototypePollutionKey(event)) continue;
+		const crushEvent = lookupOwn({
+			record: CANONICAL_TO_CRUSH_EVENT_NAMES,
+			key: event
+		}) ?? event;
+		const entries = [];
+		for (const def of defs) {
+			const entry = canonicalDefToCrushEntry({
+				def,
+				event,
+				logger
+			});
+			if (entry !== null) entries.push(entry);
+		}
+		if (entries.length > 0) hooks[crushEvent] = entries;
+	}
+	return hooks;
+}
+/** Convert one canonical hook definition to a Crush entry, or null to skip. */
+function canonicalDefToCrushEntry({ def, event, logger }) {
+	if ((def.type ?? "command") !== "command") return null;
+	if (typeof def.command !== "string" || def.command === "") {
+		logger?.warn(`Crush hook ${quoteValueForWarning(def.name ?? "")} under "${event}" has no "command", which Crush would discard, so it was skipped.`);
+		return null;
+	}
+	const entry = { command: def.command };
+	if (typeof def.name === "string" && def.name !== "") entry.name = def.name;
+	if (typeof def.matcher === "string" && def.matcher !== "" && def.matcher !== "*") entry.matcher = def.matcher;
+	if (typeof def.timeout === "number") entry.timeout = Math.ceil(def.timeout);
+	return entry;
+}
+/** Convert one raw hook entry to a canonical definition, or null to skip. */
+function crushEntryToCanonicalDef(raw) {
+	if (!isRecord$1(raw) || typeof raw.command !== "string") return null;
+	const def = {
+		type: "command",
+		command: raw.command
+	};
+	if (typeof raw.name === "string" && raw.name !== "") def.name = raw.name;
+	if (typeof raw.matcher === "string" && raw.matcher !== "") def.matcher = raw.matcher;
+	if (typeof raw.timeout === "number") def.timeout = raw.timeout;
+	return def;
+}
+/**
+* Reverse {@link canonicalToCrushHooks}: parse the `hooks` block back into a
+* canonical event → definition[] record. An event Crush does not document is
+* carried under its own name so `buildImportedHooksConfig` files it under the
+* `crush.hooks` override.
+*/
+function crushHooksToCanonical(hooksBlock) {
+	const canonical = {};
+	if (!isRecord$1(hooksBlock)) return canonical;
+	for (const [crushEvent, rawEntries] of Object.entries(hooksBlock)) {
+		if (isPrototypePollutionKey(crushEvent) || !Array.isArray(rawEntries)) continue;
+		const canonicalEvent = lookupOwn({
+			record: NORMALIZED_CRUSH_TO_CANONICAL_EVENT_NAMES,
+			key: normalizeCrushEventName(crushEvent)
+		}) ?? crushEvent;
+		const defs = rawEntries.map((raw) => crushEntryToCanonicalDef(raw)).filter((def) => def !== null);
+		if (defs.length === 0) continue;
+		canonical[canonicalEvent] = [...lookupOwn({
+			record: canonical,
+			key: canonicalEvent
+		}) ?? [], ...defs];
+	}
+	return canonical;
+}
+/**
+* Crush hooks.
+*
+* Crush reads hooks from the `hooks` key of its JSON config —
+* `<project>/crush.json` (or an existing `.crush.json`; Crush merges the pair,
+* lists concatenated) at project scope and `~/.config/crush/crush.json` at
+* user scope — as
+* `hooks.<Event>: [{name?, matcher?, command, timeout?}]`. Only `PreToolUse`
+* fires today. The `hooks` key is owned outright; every other top-level key
+* of the file is preserved and the file is never deleted.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+var CrushHooks = class CrushHooks extends ToolHooks {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseCrushConfig(this.fileContent ?? "", join(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = CortexcodeHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new CortexcodeHooks({
+		const location = await resolveCrushConfigFile({
 			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
+			global
+		});
+		return new CrushHooks({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
 		});
 	}
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = CortexcodeHooks.getSettablePaths({ global });
-		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.cortexcode?.hooks,
-			converterConfig: CORTEXCODE_CONVERTER_CONFIG,
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [[CRUSH_HOOKS_KEY]],
 			logger
 		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
+		const config = rulesyncHooks.getJson();
+		const hooks = canonicalToCrushHooks({
+			config,
+			toolOverride: config.crush?.hooks,
 			logger
 		});
-		return new CortexcodeHooks({
+		return new CrushHooks({
 			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(this.getSettablePaths({ global })),
+				feature: "hooks",
+				existingContent,
+				patch: { [CRUSH_HOOKS_KEY]: hooks },
+				filePath: location.filePath,
+				logger
+			}),
+			validate,
+			global
 		});
 	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = join(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseCortexcodeSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Cortex Code hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: CORTEXCODE_CONVERTER_CONFIG
-		});
+	toRulesyncHooks() {
+		const hooks = crushHooksToCanonical(this.json[CRUSH_HOOKS_KEY]);
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey: "cortexcode"
+			overrideKey: "crush"
 		}), null, 2) });
 	}
 	validate() {
@@ -23719,13 +23996,14 @@ var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
 			error: null
 		};
 	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new CortexcodeHooks({
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushHooks({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
+			fileContent: JSON.stringify({ [CRUSH_HOOKS_KEY]: {} }, null, 2),
+			validate: false,
+			global
 		});
 	}
 };
@@ -26959,19 +27237,22 @@ var ReasonixHooks = class ReasonixHooks extends ToolHooks {
 //#endregion
 //#region src/features/hooks/tabnine-hooks.ts
 /**
-* Environment block safe to hand Tabnine for a hook. A tool rebuilds each
-* entry into `KEY=VALUE` for the spawned process, so a key holding `=`, a
-* control character or nothing at all names a different variable than it
-* appears to; such entries are dropped in both directions (with a warning on
-* export, where the value came from an authored `.rulesync/hooks.*`).
+* Environment block safe to hand Tabnine for a hook. The shared converter
+* refuses a whole `env` map holding one bad entry; Tabnine's shape is authored
+* outside it, so the same per-entry rule (`isSafeEnvEntry`: a key holding `=`,
+* a control character or nothing at all names a different variable than it
+* appears to) is applied entry by entry and the bad ones are dropped in both
+* directions, with a warning on export, where the value came from an authored
+* `.rulesync/hooks.*`.
 */
 function sanitizeEnv({ env, warn }) {
 	if (env === null || env === void 0 || typeof env !== "object" || Array.isArray(env)) return;
 	const result = {};
 	for (const [key, value] of Object.entries(env)) {
-		const unsafeKey = key === "" || key.includes("=") || CONTROL_CHARS.some((char) => key.includes(char));
-		const unsafeValue = typeof value !== "string" || CONTROL_CHARS.some((char) => value.includes(char));
-		if (unsafeKey || unsafeValue) {
+		if (!isSafeEnvEntry({
+			key,
+			value
+		})) {
 			warn?.(`Tabnine CLI hook env entry ${JSON.stringify(key)} is not a safe KEY=VALUE pair; skipping it.`);
 			continue;
 		}
@@ -27072,7 +27353,7 @@ const TabnineMatcherEntrySchema = z.looseObject({
 });
 function tabnineMatcherEntryToCanonical(entry) {
 	const sequential = entry.sequential === true;
-	const matcher = entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "" ? entry.matcher : void 0;
+	const matcher = entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "" && entry.matcher !== ".*" ? entry.matcher : void 0;
 	const defs = [];
 	for (const hook of entry.hooks ?? []) {
 		if (hook.type !== "command" || typeof hook.command !== "string" || hook.command === "") continue;
@@ -28114,6 +28395,18 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command", "http"],
 		supportsMatcher: true
 	}],
+	["crush", {
+		class: CrushHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: CRUSH_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
+		supportsMatcher: true,
+		passthroughOverrideEvents: true
+	}],
 	["zcode", {
 		class: ZcodeHooks,
 		meta: {
@@ -28795,14 +29088,6 @@ var ContinueIgnore = class ContinueIgnore extends ToolIgnore {
 	}
 };
 //#endregion
-//#region src/constants/crush-paths.ts
-const CRUSH_RULE_FILE_NAME = "CRUSH.md";
-const CRUSH_GLOBAL_DIR = join(".config", "crush");
-const CRUSH_LOCAL_RULE_FILE_NAME = "CRUSH.local.md";
-const CRUSH_IGNORE_FILE_NAME = ".crushignore";
-const CRUSH_SKILLS_PROJECT_DIR = join(".crush", "skills");
-const CRUSH_SKILLS_GLOBAL_DIR = join(CRUSH_GLOBAL_DIR, "skills");
-//#endregion
 //#region src/features/ignore/crush-ignore.ts
 /**
 * Ignore generator for Crush.
@@ -30689,13 +30974,17 @@ function isRemoteMcpServer(serverConfig) {
 function resolveRemoteMcpUrl(serverConfig) {
 	return serverConfig.url || serverConfig.httpUrl || void 0;
 }
-/** The `command` array a `local` server is spawned with, `args` merged in. */
+/**
+* The `command` array a `local` server is spawned with, `args` merged in. An
+* entry carrying `args` but no `command` comes back empty rather than with
+* `args[0]` promoted to its program: every adapter writes element 0 back out
+* as the executable (or the whole array as the command line), so the caller
+* skips such an entry the same way as one with nothing to spawn at all.
+*/
 function resolveLocalMcpCommand(serverConfig) {
-	const commandArray = [];
-	if (serverConfig.command) {
-		if (Array.isArray(serverConfig.command)) commandArray.push(...serverConfig.command);
-		else commandArray.push(serverConfig.command);
-	}
+	const { command } = serverConfig;
+	const commandArray = Array.isArray(command) ? [...command] : command ? [command] : [];
+	if (commandArray.length === 0) return [];
 	if (serverConfig.args) commandArray.push(...serverConfig.args);
 	return commandArray;
 }
@@ -30705,9 +30994,13 @@ function resolveLocalMcpCommand(serverConfig) {
 * spells the transport out. Writing `{type: "local", command: []}` for it would
 * give the tool a server it cannot start and the importer a file it cannot read
 * back, so it is skipped out loud instead.
+*
+* The server name comes straight from the user's config, so it is quoted
+* through `quoteValueForWarning` rather than interpolated: a crafted name could
+* otherwise carry a line break or control characters into the log.
 */
 function warnAndSkipMcpServer({ toolName, serverName, reason, logger }) {
-	logger?.warn(`${toolName} MCP: skipping "${serverName}" because it declares ${reason}.`);
+	logger?.warn(`${toolName} MCP: skipping ${quoteValueForWarning(serverName)} because it declares ${reason}.`);
 	return null;
 }
 /**
@@ -30795,8 +31088,10 @@ function asBobRemoteType(stated, url) {
 * streamable HTTP server carries `type: "streamable-http"` and `url`, and an
 * SSE server carries a bare `url`. The canonical `transport` alias and the
 * Claude-style `httpUrl` alias are folded into `type`/`url`; `env`, `cwd`,
-* `headers`, `timeout`, `alwaysAllow` and `disabled` pass through unchanged,
-* as Bob documents all of them.
+* `headers`, `timeout`, `alwaysAllow` and `disabled` pass through, as Bob
+* documents all of them, with prototype-pollution keys dropped at every
+* nesting level (Bob spreads `env` and `headers` into the process environment
+* and the HTTP requests).
 *
 * Bob Shell documents the same file with an `httpURL` key instead of
 * `type` + `url` for streamable HTTP. rulesync writes the IDE spelling (the two
@@ -30864,7 +31159,7 @@ function convertToBobFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -30875,7 +31170,9 @@ function convertToBobFormat(mcpServers, logger) {
 * (`type: "streamable-http"` + `url`) is already canonical and passes through;
 * the Bob Shell spelling `httpURL` becomes `url` with `type: "http"`; a bare
 * `url` is an SSE server in Bob, so it gains `type: "sse"` to keep that reading
-* on the next generate.
+* on the next generate. Every other field passes through with its
+* prototype-pollution keys dropped at every nesting level, mirroring the
+* generate side's handling of `env` / `headers`.
 */
 function convertFromBobFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -30890,7 +31187,7 @@ function convertFromBobFormat(mcpServers) {
 				if (typeof value === "string") httpURL = value;
 				continue;
 			}
-			converted[key] = value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		if (httpURL !== void 0) {
 			converted.url = httpURL;
@@ -31738,7 +32035,7 @@ function convertRemoteServer({ serverName, serverConfig, logger }) {
 	return converted;
 }
 function convertStdioServer({ serverName, serverConfig, logger }) {
-	const [command, ...args] = (typeof serverConfig.command === "string" ? serverConfig.command !== "" : Array.isArray(serverConfig.command) && serverConfig.command.length > 0) ? resolveLocalMcpCommand(serverConfig) : [];
+	const [command, ...args] = resolveLocalMcpCommand(serverConfig);
 	if (!command) {
 		warnAndSkipMcpServer({
 			toolName: "Continue",
@@ -31754,7 +32051,7 @@ function convertStdioServer({ serverName, serverConfig, logger }) {
 	};
 	if (args.length > 0) converted.args = args;
 	if (isRecord$1(serverConfig.env)) converted.env = omitPrototypePollutionKeys(serverConfig.env);
-	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server "${serverName}" was not written; put the variables in "env" instead.`);
+	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server ${quoteValueForWarning(serverName)} was not written; put the variables in "env" instead.`);
 	return converted;
 }
 /**
@@ -32296,7 +32593,7 @@ function convertToCortexcodeFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -32305,14 +32602,15 @@ function convertToCortexcodeFormat(mcpServers, logger) {
 /**
 * Convert Cortex Code's server map back to the canonical shape. The
 * documented spelling (`type` + `command`/`url`) is already canonical, so
-* entries pass through with only prototype-pollution keys dropped.
+* entries pass through with only prototype-pollution keys dropped — at every
+* nesting level, mirroring the generate side.
 */
 function convertFromCortexcodeFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
 	const result = {};
 	for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(serverName) || !isRecord$1(serverConfig)) continue;
-		result[serverName] = omitPrototypePollutionKeys(serverConfig);
+		result[serverName] = omitPrototypePollutionKeysDeep(serverConfig);
 	}
 	return result;
 }
@@ -32351,19 +32649,12 @@ var CortexcodeMcp = class CortexcodeMcp extends ToolMcp {
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		if (!global) throw new Error(CORTEXCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const json = parseCortexcodeMcpConfig({
-			fileContent: await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}",
-			relativePath: join(paths.relativeDirPath, paths.relativeFilePath)
-		});
-		const newJson = {
-			...json,
-			mcpServers: json.mcpServers ?? {}
-		};
+		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}";
 		return new CortexcodeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent,
 			validate,
 			global
 		});
@@ -32411,6 +32702,319 @@ var CortexcodeMcp = class CortexcodeMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/crush-mcp.ts
+/**
+* Crush-only MCP fields with no canonical counterpart, authored under a
+* `crush`-prefixed key in `.rulesync/mcp.jsonc` and written under Crush's own
+* name: `oauth*` drive Crush's OAuth 2.1 flow for HTTP servers and
+* `sessionless` marks a server that issues no `Mcp-Session-Id`.
+* `RulesyncMcp.getMcpServers()` strips both spellings so the client secret
+* never reaches another tool's config; `fromRulesyncMcp` re-merges them from
+* the raw source JSON, honouring the raw Crush spelling as a fallback for an
+* entry copied straight out of a `crush.json` (the `experimental_environment`
+* precedent) — except `oauth`, whose canonical key is Claude Code's
+* `{ clientId }` object and which only `crushOauth` can set.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+const CRUSH_ONLY_KEYS = [
+	{
+		canonical: "crushOauth",
+		crush: "oauth",
+		accepts: (v) => typeof v === "boolean",
+		rawFallback: false
+	},
+	{
+		canonical: "crushOauthClientId",
+		crush: "oauth_client_id",
+		accepts: (v) => typeof v === "string",
+		rawFallback: true
+	},
+	{
+		canonical: "crushOauthClientSecret",
+		crush: "oauth_client_secret",
+		accepts: (v) => typeof v === "string",
+		rawFallback: true
+	},
+	{
+		canonical: "crushOauthCallbackPort",
+		crush: "oauth_callback_port",
+		accepts: (v) => Number.isInteger(v),
+		rawFallback: true
+	},
+	{
+		canonical: "crushSessionless",
+		crush: "sessionless",
+		accepts: (v) => typeof v === "boolean",
+		rawFallback: true
+	}
+];
+/**
+* The Crush-only keys of one raw canonical server entry, keyed by their
+* canonical name, so `convertToCrushFormat` sees them after the shared map
+* stripped them.
+*/
+function readCrushOnlyKeys(rawServer) {
+	const result = {};
+	if (!isRecord$1(rawServer)) return result;
+	for (const { canonical, crush, accepts, rawFallback } of CRUSH_ONLY_KEYS) {
+		const value = accepts(rawServer[canonical]) ? rawServer[canonical] : rawFallback && accepts(rawServer[crush]) ? rawServer[crush] : void 0;
+		if (value !== void 0) result[canonical] = value;
+	}
+	return result;
+}
+function copyCrushOnlyKeys({ from, to }) {
+	for (const { canonical, crush, accepts } of CRUSH_ONLY_KEYS) if (accepts(from[canonical])) to[crush] = from[canonical];
+}
+/**
+* The remote transports Crush's `MCPType` enum accepts, spelled the way it
+* reads them. `streamable-http` is the canonical rulesync name for what Crush
+* calls `http`; a WebSocket server has no Crush transport and is left to the
+* caller to reject.
+*/
+function asCrushRemoteType(stated, url) {
+	if (stated === "sse") return "sse";
+	if (stated === "http" || stated === "streamable-http") return "http";
+	if (stated === void 0) return /^wss?:\/\//i.test(url) ? void 0 : "http";
+}
+/**
+* The transport half of a remote server (`type`, `url`, `headers`), or null
+* when Crush could not reach it and the server was skipped with a warning.
+*/
+function convertRemoteTransport({ name, config, logger }) {
+	const url = resolveRemoteMcpUrl(config);
+	if (!url) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: "a remote transport without a url",
+			logger
+		});
+		return null;
+	}
+	const stated = config.type ?? config.transport;
+	const type = asCrushRemoteType(stated, url);
+	if (type === void 0) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: stated === void 0 ? "a WebSocket url, which Crush's remote transports (http and sse) cannot reach" : `the "${stated}" transport, which Crush does not offer for remote servers (only http and sse)`,
+			logger
+		});
+		return null;
+	}
+	const converted = {
+		type,
+		url
+	};
+	if (config.headers && Object.keys(config.headers).length > 0) converted.headers = config.headers;
+	return converted;
+}
+/**
+* The transport half of a stdio server (`type`, `command`, `args`, `env`), or
+* null when it has no command and was skipped with a warning.
+*/
+function convertStdioTransport({ name, config, logger }) {
+	const [command, ...args] = resolveLocalMcpCommand(config);
+	if (!command) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: "a stdio transport without a command",
+			logger
+		});
+		return null;
+	}
+	const converted = {
+		type: "stdio",
+		command
+	};
+	if (args.length > 0) converted.args = args;
+	if (config.env && Object.keys(config.env).length > 0) converted.env = config.env;
+	return converted;
+}
+/**
+* Convert canonical rulesync servers to the `mcp.<name>` shape of crush.json.
+* `type` is required by Crush's schema, so it is always written: stdio servers
+* carry `type: "stdio"` with `command`/`args`/`env`, remote servers `http` or
+* `sse` with `url` and optional `headers`. `disabled`, the per-server
+* `disabledTools`/`enabledTools` filters (`disabled_tools`/`enabled_tools`)
+* and `timeout` (which Crush reads in seconds) map onto their Crush fields.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+function convertToCrushFormat(mcpServers, logger) {
+	const result = {};
+	for (const [name, config] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!isRecord$1(config)) continue;
+		if (declaresNoTransport(config)) {
+			warnAndSkipMcpServer({
+				toolName: "Crush",
+				serverName: name,
+				reason: "no transport",
+				logger
+			});
+			continue;
+		}
+		const converted = isRemoteMcpServer(config) ? convertRemoteTransport({
+			name,
+			config,
+			logger
+		}) : convertStdioTransport({
+			name,
+			config,
+			logger
+		});
+		if (converted === null) continue;
+		if (config.disabled === true) converted.disabled = true;
+		if (config.disabledTools && config.disabledTools.length > 0) converted.disabled_tools = config.disabledTools;
+		if (config.enabledTools && config.enabledTools.length > 0) converted.enabled_tools = config.enabledTools;
+		if (typeof config.timeout === "number") converted.timeout = Math.ceil(config.timeout);
+		copyCrushOnlyKeys({
+			from: config,
+			to: converted
+		});
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Convert the `mcp.<name>` entries of crush.json back to canonical rulesync
+* servers. `stdio` is Crush's default `type`, so it is dropped (a canonical
+* server with a `command` is stdio already); `http` and `sse` are kept as the
+* canonical transport names; `disabled_tools`/`enabled_tools` become the
+* canonical `disabledTools`/`enabledTools`; the Crush-only OAuth and
+* `sessionless` fields are lifted into their `crush*` authoring keys (a value
+* of the wrong type is dropped, as Crush itself would refuse it), and any
+* other key is kept verbatim so an import preserves what a hand-authored
+* entry declared.
+*/
+function convertFromCrushFormat(crushServers) {
+	const result = {};
+	for (const [name, config] of Object.entries(crushServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const converted = {};
+		for (const [key, value] of Object.entries(config)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			switch (key) {
+				case "type":
+					if (value === "http" || value === "sse") converted.type = value;
+					break;
+				case "disabled_tools":
+					if (isStringArray$2(value)) converted.disabledTools = value;
+					break;
+				case "enabled_tools":
+					if (isStringArray$2(value)) converted.enabledTools = value;
+					break;
+				case "oauth_token": break;
+				default: {
+					const crushOnly = CRUSH_ONLY_KEYS.find((entry) => entry.crush === key);
+					if (crushOnly === void 0) converted[key] = value;
+					else if (crushOnly.accepts(value)) converted[crushOnly.canonical] = value;
+				}
+			}
+		}
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Crush MCP servers.
+*
+* Crush reads MCP servers from the `mcp` key of its JSON config:
+* `<project>/crush.json` (or an existing `.crush.json`; Crush merges the pair,
+* objects recursively) at project scope and `~/.config/crush/crush.json` at
+* user scope. The
+* `crushrc` Bash config that Crush now recommends compiles its `mcp add`
+* builtin into the same `mcp.<name>` entries and overrides the JSON key by
+* key, so a `crushrc` next to the generated file takes precedence. Every
+* other top-level key of the file is preserved; the file is never deleted.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/config/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+var CrushMcp = class CrushMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseCrushConfig(this.fileContent ?? "", join(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [["mcp"]],
+			logger
+		});
+		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => [serverName, {
+			...serverConfig,
+			...readCrushOnlyKeys(rulesyncMcp.getRawMcpServer(serverName))
+		}])), logger);
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(this.getSettablePaths({ global })),
+				feature: "mcp",
+				existingContent,
+				patch: { ["mcp"]: converted },
+				filePath: location.filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const converted = convertFromCrushFormat(isRecord$1(this.json["mcp"]) ? this.json["mcp"] : {});
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: converted }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: JSON.stringify({ ["mcp"]: {} }, null, 2),
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/mcp-env-var-format.ts
 /**
 * Canonical rulesync env var reference pattern: `${VAR}` (but not `${env:VAR}`,
@@ -36455,7 +37059,7 @@ function convertToTabnineFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		if (enabledTools !== void 0) converted.includeTools = enabledTools;
 		if (disabledTools !== void 0) converted.excludeTools = disabledTools;
@@ -36466,7 +37070,9 @@ function convertToTabnineFormat(mcpServers, logger) {
 /**
 * Convert Tabnine's server map back to the canonical shape: `includeTools` /
 * `excludeTools` become `enabledTools` / `disabledTools`; `type` (`stdio`,
-* `sse`, `http`) and every other documented field are already canonical.
+* `sse`, `http`) and every other documented field are already canonical and
+* pass through with their prototype-pollution keys dropped at every nesting
+* level, mirroring the generate side.
 */
 function convertFromTabnineFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -36478,7 +37084,7 @@ function convertFromTabnineFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "includeTools") converted.enabledTools = value;
 			else if (key === "excludeTools") converted.disabledTools = value;
-			else converted[key] = value;
+			else converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -37626,6 +38232,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: false
 		}
 	}],
+	["crush", {
+		class: CrushMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: true,
+			supportsDisabledTools: true
+		}
+	}],
 	["cursor", {
 		class: CursorMcp,
 		meta: {
@@ -39057,7 +39672,7 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 function toAntigravityCliToolName(canonical) {
 	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$7(cliName) {
+function toCanonicalToolName$8(cliName) {
 	return ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES[cliName] ?? cliName;
 }
 /**
@@ -39273,7 +39888,7 @@ function convertAntigravityCliToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parsePermissionEntry$1(entry);
-			const canonical = toCanonicalToolName$7(toolName);
+			const canonical = toCanonicalToolName$8(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -39530,11 +40145,34 @@ const CANONICAL_TO_AUGMENT_TOOL_NAMES = {
 	websearch: "web-search"
 };
 const AUGMENT_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENT_TOOL_NAMES).map(([k, v]) => [v, k]));
+const CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES = {
+	terminal: "launch-process",
+	read: "view",
+	edit: "str-replace-editor",
+	write: "save-file"
+};
 function toAugmentToolName(canonical) {
-	return CANONICAL_TO_AUGMENT_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_AUGMENT_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
-function toCanonicalToolName$6(augmentName) {
-	return AUGMENT_TO_CANONICAL_TOOL_NAMES[augmentName] ?? augmentName;
+/**
+* Resolve an existing entry's `toolName` to the legacy spelling rulesync emits, so that the
+* current alias and the legacy name are treated as the same managed tool.
+*/
+function toLegacyAugmentToolName(augmentName) {
+	return lookupOwn({
+		record: CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES,
+		key: augmentName
+	}) ?? augmentName;
+}
+function toCanonicalToolName$7(augmentName) {
+	const legacyName = toLegacyAugmentToolName(augmentName);
+	return lookupOwn({
+		record: AUGMENT_TO_CANONICAL_TOOL_NAMES,
+		key: legacyName
+	}) ?? legacyName;
 }
 function actionToAugmentType(action) {
 	switch (action) {
@@ -39750,10 +40388,11 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 		const generatedKeys = new Set(generated.map((e) => `${e.toolName}|${e.shellInputRegex ?? ""}|${e.permission.type}`));
 		const preservedBasicEntries = basicExistingEntries.filter((entry) => {
 			if (entry.toolName === "*") return false;
-			if (!MANAGED_AUGMENT_TOOL_NAMES.has(entry.toolName)) return true;
+			const legacyToolName = toLegacyAugmentToolName(entry.toolName);
+			if (!MANAGED_AUGMENT_TOOL_NAMES.has(legacyToolName)) return true;
 			if (entry.permission.type === "deny") {
-				const key = `${entry.toolName}|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
-				return !generatedKeys.has(key);
+				const suffix = `|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
+				return !generatedKeys.has(`${entry.toolName}${suffix}`) && !generatedKeys.has(`${legacyToolName}${suffix}`);
 			}
 			return false;
 		});
@@ -39980,14 +40619,15 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 		if (isSpecialEntry(entry)) continue;
 		const type = entry.permission.type;
 		if (!isBasicAugmentType(type)) continue;
-		const canonical = toCanonicalToolName$6(entry.toolName);
+		const legacyToolName = toLegacyAugmentToolName(entry.toolName);
+		const canonical = toCanonicalToolName$7(entry.toolName);
 		if (forbiddenMapKeys.has(canonical)) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because it maps to the reserved object key '${canonical}', which cannot be used as a permission key.`);
 			continue;
 		}
 		const action = augmentTypeToAction(type);
 		let pattern;
-		if (entry.toolName === "launch-process" && entry.shellInputRegex) {
+		if (legacyToolName === "launch-process" && entry.shellInputRegex) {
 			const regex = entry.shellInputRegex;
 			if (isShellRegexRoundtrippable(regex)) pattern = shellRegexToGlob(regex);
 			else if (action === "deny") {
@@ -40002,9 +40642,19 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because its pattern resolves to the reserved object key '${pattern}'.`);
 			continue;
 		}
-		if (!permission[canonical]) permission[canonical] = {};
-		const existing = permission[canonical][pattern];
-		if (existing === void 0 || actionPriority[action] > actionPriority[existing]) permission[canonical][pattern] = action;
+		let bucket = lookupOwn({
+			record: permission,
+			key: canonical
+		});
+		if (bucket === void 0) {
+			bucket = {};
+			permission[canonical] = bucket;
+		}
+		const existing = lookupOwn({
+			record: bucket,
+			key: pattern
+		});
+		if (existing === void 0 || actionPriority[action] > actionPriority[existing]) bucket[pattern] = action;
 	}
 	return { permission };
 }
@@ -40215,7 +40865,7 @@ const CLAUDE_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONIC
 function toClaudeToolName(canonical) {
 	return CANONICAL_TO_CLAUDE_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$5(claudeName) {
+function toCanonicalToolName$6(claudeName) {
 	return CLAUDE_TO_CANONICAL_TOOL_NAMES[claudeName] ?? claudeName;
 }
 /**
@@ -41110,7 +41760,7 @@ function convertClaudeToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseClaudePermissionEntry(entry);
-			const canonical = toCanonicalToolName$5(toolName);
+			const canonical = toCanonicalToolName$6(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -41935,7 +42585,16 @@ function mapBashActionToDecision(action) {
 //#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$4 = "*";
+const CATCH_ALL_PATTERN$5 = "*";
+/**
+* A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
+* would match `Tool(**)` against every argument just as the bare tool name
+* does, so it is written — and, under the all-tools category, honored — as
+* the bare entry instead of being skipped as a pattern-specific rule.
+*/
+function normalizeCatchAllPattern$1(pattern) {
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$5 : pattern;
+}
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
 	read: "Read",
@@ -41963,7 +42622,7 @@ const CONTINUE_PATTERN_RE = /^([^(]+)(?:\(([^)]*)\))?$/;
 function toContinueToolName(canonical) {
 	return Object.hasOwn(CANONICAL_TO_CONTINUE_TOOL_NAMES, canonical) ? CANONICAL_TO_CONTINUE_TOOL_NAMES[canonical] ?? canonical : canonical;
 }
-function toCanonicalToolName$4(continueName) {
+function toCanonicalToolName$5(continueName) {
 	return Object.hasOwn(CONTINUE_TO_CANONICAL_TOOL_NAMES, continueName) ? CONTINUE_TO_CANONICAL_TOOL_NAMES[continueName] ?? continueName : continueName;
 }
 /**
@@ -41971,7 +42630,7 @@ function toCanonicalToolName$4(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$4 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$5 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -41985,7 +42644,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$4 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$5 : pattern
 	};
 }
 /**
@@ -42152,13 +42811,14 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		if (isPrototypePollutionKey(category)) continue;
 		const toolName = category === "*" ? "*" : toContinueToolName(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (isPrototypePollutionKey(pattern)) continue;
+		for (const [rawPattern, action] of Object.entries(rules)) {
+			if (isPrototypePollutionKey(rawPattern)) continue;
+			const pattern = normalizeCatchAllPattern$1(rawPattern);
 			if (pattern.includes("(") || pattern.includes(")")) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$4) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$5) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -42183,7 +42843,7 @@ function convertContinuePermissionsToRulesync(lists) {
 			const parsedEntry = parseContinuePermissionEntry(entry);
 			if (parsedEntry === void 0) continue;
 			if (isPrototypePollutionKey(parsedEntry.toolName) || isPrototypePollutionKey(parsedEntry.pattern)) continue;
-			const category = toCanonicalToolName$4(parsedEntry.toolName);
+			const category = toCanonicalToolName$5(parsedEntry.toolName);
 			permission[category] ??= {};
 			permission[category][parsedEntry.pattern] ??= action;
 		}
@@ -42506,6 +43166,295 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 	}
 };
 //#endregion
+//#region src/features/permissions/crush-permissions.ts
+const CATCH_ALL_PATTERN$4 = "*";
+/**
+* A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
+* argument patterns at all, so it is the only pattern a rule can carry and
+* still be written.
+*/
+function normalizeCatchAllPattern(pattern) {
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$4 : pattern;
+}
+const CANONICAL_TO_CRUSH_TOOL_NAMES = {
+	bash: "bash",
+	read: "view",
+	edit: "edit",
+	write: "write",
+	grep: "grep",
+	glob: "glob",
+	webfetch: "fetch"
+};
+const CRUSH_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_TOOL_NAMES).map(([k, v]) => [v, k]));
+const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const MCP_CRUSH_PREFIX = "mcp_";
+function toCrushToolName(canonical) {
+	if (Object.hasOwn(CANONICAL_TO_CRUSH_TOOL_NAMES, canonical)) return CANONICAL_TO_CRUSH_TOOL_NAMES[canonical] ?? canonical;
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX$4) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
+	return canonical;
+}
+function toCanonicalToolName$4(crushName) {
+	return Object.hasOwn(CRUSH_TO_CANONICAL_TOOL_NAMES, crushName) ? CRUSH_TO_CANONICAL_TOOL_NAMES[crushName] ?? crushName : crushName;
+}
+function isMcpToolName(crushName) {
+	return crushName.startsWith(MCP_CRUSH_PREFIX) && crushName.length > 4;
+}
+function uniq$1(values) {
+	return [...new Set(values)];
+}
+/**
+* Permissions adapter for Crush.
+*
+* Crush has no per-argument permission rules. Its JSON config carries two
+* tool-level lists instead:
+*   - `permissions.allowed_tools`: tools (or `tool:action` pairs) that run
+*     without a permission prompt; everything else prompts.
+*   - `options.disabled_tools`: built-in tools removed from the agent
+*     entirely.
+*
+* Mapping (rulesync canonical -> Crush), catch-all (`*`) rules only:
+*   - `allow` -> an `allowed_tools` entry.
+*   - `deny` -> a `disabled_tools` entry. Crush only filters its built-ins
+*     through that list, so a deny for an MCP tool is reported and skipped
+*     (disable the tool in the MCP server's `disabled_tools` instead).
+*   - `ask` -> nothing (prompting is Crush's default).
+*   - Tool name: `bash` -> `bash`, `read` -> `view`, `edit` -> `edit`,
+*     `write` -> `write`, `grep` -> `grep`, `glob` -> `glob`,
+*     `webfetch` -> `fetch`, `mcp__<server>__<tool>` -> `mcp_<server>_<tool>`;
+*     any other category passes through verbatim.
+*
+* A pattern-specific rule cannot be expressed and is reported and skipped.
+* Because Crush cannot narrow an allowed tool, a category's catch-all `allow`
+* is not written while the same category carries a pattern-specific `deny` or
+* `ask`: the tool keeps prompting (fail closed) rather than being widened to
+* everything. The all-tools `*` category is mirrored onto `bash` by
+* `honorAllToolsOnBash` and otherwise skipped, since Crush has no allow-all
+* or disable-all list.
+*
+* `crush.json` is Crush's main config: entries naming a tool the canonical
+* config does not manage, and every `tool:action` entry (a form rulesync
+* never derives), are preserved verbatim; the managed tools' bare entries
+* are rebuilt, every other key of `permissions` / `options` and of the file is
+* kept, and the file is never deleted. Project scope writes `crush.json`, or
+* an existing `.crush.json`; Crush merges the pair (lists concatenated), so an
+* entry left in the other file stays in effect and is reported.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/config/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+* @see https://github.com/charmbracelet/crush/blob/main/internal/permission/permission.go
+*/
+var CrushPermissions = class CrushPermissions extends ToolPermissions {
+	json;
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+		this.json = parseCrushConfig(this.fileContent ?? "", join(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	/**
+	* `crush.json` is Crush's file: rulesync merges into it when it exists but
+	* does not create one that holds nothing of its own — an absent file and an
+	* absent `allowed_tools` both mean "prompt for everything".
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [[CRUSH_PERMISSIONS_KEY, CRUSH_ALLOWED_TOOLS_KEY], [CRUSH_OPTIONS_KEY, CRUSH_DISABLED_TOOLS_KEY]],
+			logger
+		});
+		const existing = parseCrushConfig(existingContent, location.filePath);
+		const existingPermissions = isRecord$1(existing["permissions"]) ? existing[CRUSH_PERMISSIONS_KEY] : void 0;
+		const existingOptions = isRecord$1(existing["options"]) ? existing[CRUSH_OPTIONS_KEY] : void 0;
+		const config = rulesyncPermissions.getJson();
+		const generated = convertRulesyncToCrushLists({
+			config,
+			logger
+		});
+		const managedToolNames = managedCrushToolNames(config);
+		const preservedAllowed = (isStringArray$2(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
+		const preservedDisabled = (isStringArray$2(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
+		const allowedList = uniq$1([...preservedAllowed, ...generated.allowed]);
+		const disabledList = uniq$1([...preservedDisabled, ...generated.disabled]);
+		const patch = {};
+		if (allowedList.length > 0 || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = { [CRUSH_ALLOWED_TOOLS_KEY]: allowedList.length > 0 ? allowedList : void 0 };
+		if (disabledList.length > 0 || existingOptions !== void 0) patch[CRUSH_OPTIONS_KEY] = { [CRUSH_DISABLED_TOOLS_KEY]: disabledList.length > 0 ? disabledList : void 0 };
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(CrushPermissions.getSettablePaths({ global })),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath: location.filePath,
+				logger
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const permissions = isRecord$1(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
+		const options = isRecord$1(this.json["options"]) ? this.json[CRUSH_OPTIONS_KEY] : {};
+		const rulesyncConfig = convertCrushListsToRulesync({
+			allowed: isStringArray$2(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
+			disabled: isStringArray$2(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+/**
+* The Crush tool names the canonical config manages, i.e. the names its
+* categories map to. Entries naming any other tool are the user's and survive
+* a generate. The all-tools `*` category names no Crush tool of its own.
+*/
+function managedCrushToolNames(config) {
+	return new Set(Object.keys(config.permission).filter((category) => category !== "*" && !isPrototypePollutionKey(category)).map((category) => toCrushToolName(category)));
+}
+/**
+* Reduce one category's rules to the single tool-wide action Crush can carry,
+* or undefined when nothing should be written for the tool: no catch-all rule,
+* a catch-all allow next to a narrower deny/ask (Crush cannot narrow an
+* allowed tool, so it keeps prompting instead), or a deny on an MCP tool
+* (`options.disabled_tools` only covers built-ins).
+*/
+function resolveCategoryAction({ category, toolName, rules, logger }) {
+	let catchAllAction;
+	let restricted = false;
+	for (const [rawPattern, action] of Object.entries(rules)) {
+		if (isPrototypePollutionKey(rawPattern)) continue;
+		const pattern = normalizeCatchAllPattern(rawPattern);
+		if (pattern === CATCH_ALL_PATTERN$4) {
+			catchAllAction = action;
+			continue;
+		}
+		logger?.warn(`Crush permissions are tool-wide (no argument patterns), so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
+		if (action !== "allow") restricted = true;
+	}
+	if (catchAllAction === "allow" && restricted) {
+		logger?.warn(`Crush cannot narrow an allowed tool, so "${category}" is not added to permissions.allowed_tools while it carries a pattern-specific deny/ask rule; Crush keeps prompting for "${toolName}".`);
+		return;
+	}
+	if (catchAllAction === "deny" && isMcpToolName(toolName)) {
+		logger?.warn(`Crush's options.disabled_tools only covers built-in tools, so the "deny" rule for "${category}" was skipped; disable the tool through the MCP server's "disabled_tools" instead.`);
+		return;
+	}
+	return catchAllAction;
+}
+/**
+* Convert a rulesync permissions config into Crush's two tool lists.
+*/
+function convertRulesyncToCrushLists({ config, logger }) {
+	const lists = {
+		allowed: [],
+		disabled: []
+	};
+	const actionByTool = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
+		if (isPrototypePollutionKey(category)) continue;
+		if (category === "*") {
+			for (const [rawPattern, action] of Object.entries(rules)) {
+				if (isPrototypePollutionKey(rawPattern)) continue;
+				logger?.warn(`Crush has no allow-all or disable-all tool list, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(rawPattern)}) was skipped.`);
+			}
+			continue;
+		}
+		const toolName = toCrushToolName(category);
+		const catchAllAction = resolveCategoryAction({
+			category,
+			toolName,
+			rules,
+			logger
+		});
+		if (catchAllAction === void 0) continue;
+		const previous = actionByTool.get(toolName);
+		if (previous !== void 0 && previous !== catchAllAction) logger?.warn(`Crush permissions: rules from different categories both resolve to ${quoteValueForWarning(toolName)} with conflicting actions (${previous} and ${catchAllAction}). Both are written; a disabled tool is hidden from the agent regardless of allowed_tools.`);
+		actionByTool.set(toolName, catchAllAction);
+		if (catchAllAction === "allow") lists.allowed.push(toolName);
+		else if (catchAllAction === "deny") lists.disabled.push(toolName);
+	}
+	return {
+		allowed: uniq$1(lists.allowed),
+		disabled: uniq$1(lists.disabled)
+	};
+}
+/**
+* Convert Crush's two tool lists back into a rulesync config. A `tool:action`
+* entry scopes an allow to one action of a tool, which the canonical model
+* cannot express, so it is left out rather than widened to the whole tool.
+*/
+function convertCrushListsToRulesync({ allowed, disabled }) {
+	const permission = {};
+	const bucketFor = (category) => {
+		const own = lookupOwn({
+			record: permission,
+			key: category
+		});
+		if (own !== void 0) return own;
+		const created = {};
+		permission[category] = created;
+		return created;
+	};
+	for (const entry of disabled) {
+		if (entry === "" || isPrototypePollutionKey(entry)) continue;
+		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] = "deny";
+	}
+	for (const entry of allowed) {
+		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
+		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] ??= "allow";
+	}
+	return { permission };
+}
+//#endregion
 //#region src/features/permissions/cursor-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Cursor CLI
@@ -43660,6 +44609,40 @@ function convertDeepagentsToRulesyncPermissions({ allowList }) {
 	return Object.keys(bash).length > 0 ? { permission: { bash } } : { permission: {} };
 }
 //#endregion
+//#region src/features/permissions/single-action-collapse.ts
+/**
+* Strictness order shared by the tools whose permission model evaluates
+* `deny > ask > allow`. Used wherever several canonical rules have to fold
+* into one entry, so the strictest action always wins.
+*/
+const PERMISSION_ACTION_PRIORITY = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Collapse a pattern map to the single action a tool can hold for a scope
+* that has no pattern matcher, using deny > ask > allow precedence.
+*
+* A map without a catch-all grants nothing to unmatched inputs, so an
+* implicit `ask` joins the candidates and a narrow allowlist can never widen
+* into a blanket allow. Returns `undefined` for an empty map; each caller
+* decides what an empty map means for its tool (e.g. emit nothing, or fall
+* back to `deny` when the tool's own default is allow).
+*/
+function collapseRulesToSingleAction({ rules }) {
+	const actions = Object.values(rules);
+	if (actions.length === 0) return;
+	return (Object.hasOwn(rules, "*") ? actions : [...actions, "ask"]).reduce((current, candidate) => PERMISSION_ACTION_PRIORITY[candidate] > PERMISSION_ACTION_PRIORITY[current] ? candidate : current);
+}
+/**
+* Whether a pattern map carries anything beyond the `*` catch-all, i.e.
+* whether collapsing it to a single action loses information worth a warning.
+*/
+function hasPatternSpecificRules(rules) {
+	return Object.keys(rules).some((pattern) => pattern !== "*");
+}
+//#endregion
 //#region src/features/permissions/devin-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names to Devin Local permission
@@ -43669,17 +44652,21 @@ function convertDeepagentsToRulesyncPermissions({ allowList }) {
 * `Write(glob)`, `Exec(prefix)`, and `Fetch(pattern)` — plus MCP tool patterns
 * (`mcp__server__tool`). The canonical `edit` and `write` categories both map
 * onto Devin's single `Write` scope; on import `Write` maps back to `write`, so
-* `edit` rules round-trip as `write` (a lossy but documented collapse). Unknown
+* `edit` rules round-trip as `write` (a lossy but documented collapse). The
+* canonical `websearch` category maps onto the bare `web_search` tool name,
+* accepted in the permission lists since CLI v3000.10.21 (2026-09-10). Unknown
 * names (e.g. `mcp__github__list_issues`) pass through verbatim.
 *
 * @see https://docs.devin.ai/cli/reference/permissions
+* @see https://docs.devin.ai/cli/changelog/stable — v3000.10.21, `web_search`
 */
 const CANONICAL_TO_DEVIN_SCOPE = {
 	read: "Read",
 	write: "Write",
 	edit: "Write",
 	bash: "Exec",
-	webfetch: "Fetch"
+	webfetch: "Fetch",
+	websearch: "web_search"
 };
 /**
 * Reverse mapping from Devin scope matchers to rulesync canonical names.
@@ -43688,8 +44675,15 @@ const DEVIN_SCOPE_TO_CANONICAL = {
 	Read: "read",
 	Write: "write",
 	Exec: "bash",
-	Fetch: "webfetch"
+	Fetch: "webfetch",
+	web_search: "websearch"
 };
+/**
+* Devin scopes that exist only as a bare tool name: there is no
+* `web_search(pattern)` matcher, so a pattern-specific rule under the canonical
+* category cannot be expressed and is collapsed to one action instead.
+*/
+const DEVIN_BARE_ONLY_SCOPES = /* @__PURE__ */ new Set(["web_search"]);
 function toDevinScope(canonical) {
 	return CANONICAL_TO_DEVIN_SCOPE[canonical] ?? canonical;
 }
@@ -43874,7 +44868,10 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse existing Devin config at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
-		const { allow, ask, deny } = convertRulesyncToDevinPermissions(config);
+		const { allow, ask, deny } = convertRulesyncToDevinPermissions({
+			config,
+			logger
+		});
 		const managedScopes = new Set(Object.keys(config.permission).map((category) => toDevinScope(category)));
 		const existingPermissions = isRecord$1(settings.permissions) ? settings.permissions : {};
 		const preserve = (entries) => (entries ?? []).filter((entry) => !managedScopes.has(parseDevinPermissionEntry(entry).scope));
@@ -43978,26 +44975,50 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	}
 };
 /**
+* Collapse the pattern rules of a bare-only scope to the single action Devin
+* can hold for it, using deny > ask > allow precedence. A map without a
+* catch-all grants nothing to unmatched inputs, so an implicit `ask` joins the
+* candidates and a narrow allowlist can never widen into a blanket allow.
+* Returns `undefined` for an empty map: like any other empty category it
+* emits nothing, which leaves Devin's own auto-approve default in place.
+*/
+function collapseBareOnlyScopeRules({ category, scope, rules, logger }) {
+	const action = collapseRulesToSingleAction({ rules });
+	if (action === void 0) return;
+	if (hasPatternSpecificRules(rules)) logger?.warn(`Devin accepts "${scope}" only as a bare tool name, with no pattern matcher. Collapsed the "${category}" pattern rules to "${action}" using deny > ask > allow precedence.`);
+	return action;
+}
+/**
 * Convert rulesync permissions config to Devin allow/ask/deny arrays.
 */
-function convertRulesyncToDevinPermissions(config) {
+function convertRulesyncToDevinPermissions({ config, logger }) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
+	const push = (entry, action) => {
+		switch (action) {
+			case "allow":
+				allow.push(entry);
+				break;
+			case "ask":
+				ask.push(entry);
+				break;
+			case "deny": deny.push(entry);
+		}
+	};
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const scope = toDevinScope(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			const entry = buildDevinPermissionEntry(scope, pattern);
-			switch (action) {
-				case "allow":
-					allow.push(entry);
-					break;
-				case "ask":
-					ask.push(entry);
-					break;
-				case "deny": deny.push(entry);
-			}
+		if (DEVIN_BARE_ONLY_SCOPES.has(scope)) {
+			const action = collapseBareOnlyScopeRules({
+				category,
+				scope,
+				rules,
+				logger
+			});
+			if (action !== void 0) push(scope, action);
+			continue;
 		}
+		for (const [pattern, action] of Object.entries(rules)) push(buildDevinPermissionEntry(scope, pattern), action);
 	}
 	return {
 		allow,
@@ -46243,20 +47264,14 @@ const OPENCODE_ACTION_ONLY_PERMISSION_KEYS = /* @__PURE__ */ new Set([
 	"question",
 	"doom_loop"
 ]);
-const PERMISSION_ACTION_PRIORITY = {
-	allow: 0,
-	ask: 1,
-	deny: 2
-};
 function toOpencodePermission({ category, value, logger }) {
 	if (typeof value === "string" || !OPENCODE_ACTION_ONLY_PERMISSION_KEYS.has(category)) return value;
-	const actions = Object.values(value);
-	if (actions.length === 0) {
+	const action = collapseRulesToSingleAction({ rules: value });
+	if (action === void 0) {
 		logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its empty pattern map to "deny" to avoid falling back to OpenCode's default allow behavior.`);
 		return "deny";
 	}
-	const action = (Object.hasOwn(value, "*") ? actions : [...actions, "ask"]).reduce((current, candidate) => PERMISSION_ACTION_PRIORITY[candidate] > PERMISSION_ACTION_PRIORITY[current] ? candidate : current);
-	if (Object.keys(value).some((pattern) => pattern !== "*")) logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its pattern rules to "${action}" using deny > ask > allow precedence.`);
+	if (hasPatternSpecificRules(value)) logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its pattern rules to "${action}" using deny > ask > allow precedence.`);
 	return action;
 }
 /**
@@ -46634,6 +47649,7 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"visible",
 	"eager",
 	"listDirectory",
+	"todoWrite",
 	"workflowsEnabled"
 ];
 const QWEN_OVERRIDE_SECURITY_KEYS = [
@@ -46739,6 +47755,11 @@ const QWEN_OVERRIDE_GROUPS = [{
 			rule: "global-machine-wide",
 			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`list_directory\` tool is registered in this repository.`,
 			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `list_directory` tool is registered for every project on this machine."
+		},
+		todoWrite: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`todo_write\` tool is registered in this repository.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `todo_write` tool is registered for every project on this machine."
 		}
 	}
 }, {
@@ -48545,9 +49566,25 @@ function widenToPrefixGlob(pattern) {
 function toShellEntry(prefix) {
 	return prefix === "" ? SHELL_TOOL_NAME : `${SHELL_TOOL_NAME}(${prefix})`;
 }
-/** The `bash` pattern a `run_shell_command(<prefix>)` entry stands for. */
+/**
+* The `bash` pattern a `run_shell_command(<prefix>)` entry stands for. A
+* prefix Tabnine matches literally, so one an author spelled glob-like
+* (`git *`, `*`) is read as the glob it looks like rather than doubled into
+* `git * *`, which no comparison or warning could make sense of.
+*/
 function toShellPattern(prefix) {
-	return prefix === void 0 || prefix === "" ? "*" : `${prefix} *`;
+	if (prefix === void 0 || prefix === "" || prefix === "*") return "*";
+	return prefix.endsWith(" *") ? prefix : `${prefix} *`;
+}
+/**
+* Whether {@link toShellPattern} read the prefix as a glob: such an entry
+* would never fire on Tabnine as spelled (the prefix is matched literally, so
+* `run_shell_command(git *)` only matches a command line starting with the
+* two characters `git *`), and rulesync writes it back as the prefix the glob
+* denotes — a wider entry that the author is told about.
+*/
+function isGlobSpelledPrefix(prefix) {
+	return prefix !== void 0 && (prefix === "*" || prefix.endsWith(" *"));
 }
 /**
 * Split a `tools.allowed`/`tools.exclude` entry into its tool name and the
@@ -48673,7 +49710,7 @@ function collectTrustAffectingOverrideEntries({ tools, general }) {
 	const allowed = isStringArray$2(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
 	if (allowed.length > 0) entries.push({
 		label: `tools.allowed (${allowed.map(quoteValueForWarning).join(", ")})`,
-		reason: "auto-approves what it names as the override spells it; a non-shell entry has no canonical rule to be checked against"
+		reason: "auto-approves what it names as the override spells it; a non-shell entry is only checked against a whole-tool deny of its tool"
 	});
 	if (Object.hasOwn(tools, SANDBOX_KEY) && isNotTrue(tools[SANDBOX_KEY])) entries.push({
 		label: `tools.sandbox = ${quoteValueForWarning(tools[SANDBOX_KEY])}`,
@@ -48784,6 +49821,54 @@ function buildToolLists({ permission, overrideShellAllowPatterns, logger }) {
 	};
 }
 /**
+* Names the glob-spelled `run_shell_command(...)` override entries that were
+* written as the prefix their glob denotes. Said only for the entries that
+* made it into the list: one that a deny or ask overlaps is announced as
+* withheld by the comparison instead, and one whose glob names no prefix at
+* all is skipped by it.
+*/
+function warnAboutGlobSpelledOverrideEntries({ entries, allowed, logger }) {
+	for (const { entry, pattern } of entries) {
+		const prefix = toShellPrefix(pattern);
+		const written = prefix === void 0 ? void 0 : toShellEntry(prefix);
+		if (written === void 0 || !allowed.includes(written)) continue;
+		warnWithFallback(logger, `Tabnine CLI permissions: read tools.allowed entry ${quoteValueForWarning(entry)} of the tabnine override as the 'bash' allow rule ${quoteValueForWarning(pattern)}; Tabnine matches a prefix literally, so it is written as ${quoteValueForWarning(written)}, which auto-approves every command it covers.`);
+	}
+}
+/**
+* A verbatim override allow naming a tool the canonical block denies is
+* withheld the way a shadowed `bash` allow is: Tabnine never loads an excluded
+* tool whatever `allowed` says, so the entry would only ever contradict the
+* deny it sits beside — and an override is not a way around a canonical rule.
+* Returns the entries that may be written.
+*/
+function withholdDeniedOverrideAllowed({ overrideVerbatimAllowed, exclude, logger }) {
+	const denied = overrideVerbatimAllowed.filter((entry) => {
+		const toolName = parseTabnineEntry(entry)?.toolName;
+		return toolName !== void 0 && exclude.includes(toolName);
+	});
+	if (denied.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: withheld ${denied.length} tools.allowed entry(ies) of the tabnine override (${denied.map(quoteValueForWarning).join(", ")}) that name a tool the canonical block denies; Tabnine never loads an excluded tool, so remove the deny rule from .rulesync/permissions.jsonc to allow it.`);
+	return overrideVerbatimAllowed.filter((entry) => !denied.includes(entry));
+}
+/**
+* The entries of a managed tool that the canonical block did not re-derive are
+* named rather than removed silently. Dropping an exclude loosens the policy,
+* so it is a warning; dropping an allow only brings back Tabnine's confirmation
+* prompt, so it is said at info level for the author who wonders where a
+* hand-written entry went.
+*/
+function reportDroppedManagedEntries({ existingTools, allowedList, excludeList, logger }) {
+	const dropped = (key, list) => uniq(isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+		if (list.includes(entry)) return false;
+		const toolName = parseTabnineEntry(entry)?.toolName;
+		return toolName === void 0 || !list.includes(toolName);
+	});
+	const droppedExclude = dropped(EXCLUDE_KEY, excludeList);
+	if (droppedExclude.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: removed ${droppedExclude.length} existing tools.exclude entry(ies) (${droppedExclude.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add a deny rule to .rulesync/permissions.jsonc to keep them.`);
+	const droppedAllowed = dropped(ALLOWED_KEY, allowedList);
+	if (droppedAllowed.length > 0) (logger ?? moduleLogger$1).info(`Tabnine CLI permissions: removed ${droppedAllowed.length} existing tools.allowed entry(ies) (${droppedAllowed.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add an allow rule to .rulesync/permissions.jsonc to keep them.`);
+}
+/**
 * Permissions generator for the Tabnine CLI.
 *
 * Tabnine CLI keeps its tool policy in `.tabnine/agent/settings.json` (project)
@@ -48849,7 +49934,10 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		const config = rulesyncPermissions.getJson();
 		const override = isRecord$1(config.tabnine) ? config.tabnine : {};
 		const { tools: overrideTools, general: overrideGeneral, refused: refusedPaths } = stripRefusedOverridePaths(override);
-		if (refusedPaths.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: refused to write ${refusedPaths.join(", ")} from the tabnine override; Tabnine CLI runs that value as a command or sends its traffic to it, and a permissions file (one that came from 'rulesync fetch' included) must not be able to point it at an executable or a server of its choosing. Set it by hand in ${join(paths.relativeDirPath, paths.relativeFilePath)} if you need it.`);
+		if (refusedPaths.length > 0) {
+			const one = refusedPaths.length === 1;
+			warnWithFallback(logger, `Tabnine CLI permissions: refused to write ${refusedPaths.join(", ")} from the tabnine override; Tabnine CLI runs ${one ? "that value" : "those values"} as a command or sends its traffic there, and a permissions file (one that came from 'rulesync fetch' included) must not be able to point it at an executable or a server of its choosing. Set ${one ? "it" : "them"} by hand in ${join(paths.relativeDirPath, paths.relativeFilePath)} if you need ${one ? "it" : "them"}.`);
+		}
 		const overrideList = (key) => {
 			const value = overrideTools[key];
 			if (value === void 0 || isStringArray$2(value)) return value ?? [];
@@ -48858,10 +49946,17 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		};
 		const overrideShellAllowPatterns = [];
 		const overrideVerbatimAllowed = [];
+		const globSpelledOverrideEntries = [];
 		for (const entry of overrideList(ALLOWED_KEY)) {
 			const parsed = parseTabnineEntry(entry);
-			if (parsed?.toolName === SHELL_TOOL_NAME) overrideShellAllowPatterns.push(toShellPattern(parsed.prefix));
-			else overrideVerbatimAllowed.push(entry);
+			if (parsed?.toolName === SHELL_TOOL_NAME) {
+				const pattern = toShellPattern(parsed.prefix);
+				if (isGlobSpelledPrefix(parsed.prefix)) globSpelledOverrideEntries.push({
+					entry,
+					pattern
+				});
+				overrideShellAllowPatterns.push(pattern);
+			} else overrideVerbatimAllowed.push(entry);
 		}
 		const overrideExclude = overrideList(EXCLUDE_KEY);
 		const { allowed, exclude } = buildToolLists({
@@ -48869,6 +49964,16 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			overrideShellAllowPatterns,
 			logger
 		});
+		warnAboutGlobSpelledOverrideEntries({
+			entries: globSpelledOverrideEntries,
+			allowed,
+			logger
+		});
+		const writableOverrideAllowed = withholdDeniedOverrideAllowed({
+			overrideVerbatimAllowed,
+			exclude,
+			logger
+		});
 		const ignoredOverrideKeys = Object.keys(override).filter((key) => key !== TOOLS_KEY && key !== GENERAL_KEY);
 		if (ignoredOverrideKeys.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: ignored ${ignoredOverrideKeys.length} key(s) of the tabnine override (${ignoredOverrideKeys.map(quoteValueForWarning).join(", ")}); only 'tools' and 'general' are written through the permissions feature.`);
 		const existingTools = this.existingToolsGroup(existingContent);
@@ -48879,7 +49984,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		});
 		const allowedList = uniq([
 			...allowed,
-			...overrideVerbatimAllowed,
+			...writableOverrideAllowed,
 			...preservedEntries(ALLOWED_KEY)
 		]);
 		const excludeList = uniq([
@@ -48887,12 +49992,12 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			...overrideExclude,
 			...preservedEntries(EXCLUDE_KEY)
 		]);
-		const droppedExcludeEntries = uniq(isStringArray$2(existingTools?.[EXCLUDE_KEY]) ? existingTools[EXCLUDE_KEY] : []).filter((entry) => {
-			if (excludeList.includes(entry)) return false;
-			const toolName = parseTabnineEntry(entry)?.toolName;
-			return toolName === void 0 || !excludeList.includes(toolName);
+		reportDroppedManagedEntries({
+			existingTools,
+			allowedList,
+			excludeList,
+			logger
 		});
-		if (droppedExcludeEntries.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: removed ${droppedExcludeEntries.length} existing tools.exclude entry(ies) (${droppedExcludeEntries.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add a deny rule to .rulesync/permissions.jsonc to keep them.`);
 		const tools = {
 			...overrideTools,
 			[ALLOWED_KEY]: allowedList.length > 0 ? allowedList : void 0,
@@ -48906,7 +50011,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			entries: collectTrustAffectingOverrideEntries({
 				tools: {
 					...overrideTools,
-					[ALLOWED_KEY]: overrideVerbatimAllowed
+					[ALLOWED_KEY]: writableOverrideAllowed
 				},
 				general: overrideGeneral
 			}),
@@ -52263,6 +53368,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["crush", {
+		class: CrushPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["cursor", {
 		class: CursorPermissions,
 		meta: {
@@ -58284,6 +59397,183 @@ var PiSkill = class PiSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/constants/pool-paths.ts
+/**
+* Pool (Poolside's coding agent CLI) configuration-layout conventions.
+*
+* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
+* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
+* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
+* path), the project-root `AGENTS.md`, and nested per-directory
+* `AGENTS.md` files from the repository root down through the working
+* directory, deeper files taking precedence. It skips ignored directories
+* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
+*
+* Skills follow the Agent Skills format (`<name>/SKILL.md` bundles). Pool
+* scans `.poolside/skills/` (project) and `~/.config/poolside/skills/`
+* (global) plus the shared `.agents/skills/` / `~/.agents/skills/` roots and
+* the skill directories of other Agent Skills tools; rulesync writes only the
+* Pool-specific roots and leaves the shared ones to their own targets.
+*
+* @see https://docs.poolside.ai/agent-instructions
+* @see https://docs.poolside.ai/skills
+* @see https://github.com/poolsideai/pool
+*/
+/** Project-scoped `.poolside/` directory at the project root. */
+const POOL_DIR = ".poolside";
+/** Global config directory for Pool, relative to the home directory. */
+const POOL_GLOBAL_DIR = join(".config", "poolside");
+/** Project skills root, relative to the project root. */
+const POOL_SKILLS_DIR_PATH = join(POOL_DIR, "skills");
+/** Global skills root, relative to the home directory. */
+const POOL_GLOBAL_SKILLS_DIR_PATH = join(POOL_GLOBAL_DIR, "skills");
+//#endregion
+//#region src/features/skills/pool-skill.ts
+const PoolSkillFrontmatterSchema = z.looseObject({
+	name: z.string(),
+	description: z.string()
+});
+/**
+* Represents a Pool (Poolside) skill directory.
+*
+* Pool discovers Agent Skills (`<name>/SKILL.md` bundles, optionally with
+* supporting files) from `.poolside/skills/` (project) and
+* `~/.config/poolside/skills/` (global). It also scans the shared
+* `.agents/skills/` / `~/.agents/skills/` roots and the skill directories of
+* other Agent Skills tools; those belong to their own targets, so this class
+* writes only the two Pool-specific roots and a skill is written exactly once.
+* Pool requires the directory name to equal the frontmatter `name`, otherwise
+* it skips the skill. Unlike adapters that reject such a skill outright, this
+* one warns and still writes it: the directory name is the canonical identity
+* shared with every other target, and Pool merely skips the skill rather than
+* failing, so a hard error here would block the other targets for a
+* Pool-only concern. Import is lenient for the same reason.
+* @see https://docs.poolside.ai/skills
+*/
+var PoolSkill = class PoolSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = POOL_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? POOL_GLOBAL_SKILLS_DIR_PATH : POOL_SKILLS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return PoolSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (!this.mainFile) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = PoolSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const frontmatter = this.getFrontmatter();
+		const rulesyncFrontmatter = {
+			name: frontmatter.name,
+			description: frontmatter.description,
+			targets: ["*"]
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
+		const settablePaths = PoolSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
+		const poolFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description
+		};
+		if (poolFrontmatter.name !== dirName) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(join(outputRoot, settablePaths.relativeDirPath, dirName, SKILL_FILE_NAME)))}: \`name\` ${quoteForLog(poolFrontmatter.name)} does not match its directory name ${quoteForLog(dirName)}; Pool only loads a skill whose directory name equals its \`name\``);
+		return new PoolSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: poolFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("pool");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: PoolSkill.getSettablePaths
+		});
+		const result = PoolSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = join(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${join(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		return new PoolSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		const settablePaths = PoolSkill.getSettablePaths({ global });
+		return new PoolSkill({
+			outputRoot,
+			relativeDirPath: relativeDirPath ?? settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/qwencode-skill.ts
 const QwencodeSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -60170,6 +61460,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["pool", {
+		class: PoolSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodeSkill,
 		meta: {
@@ -65004,7 +66302,7 @@ var RooSubagent = class extends ToolSubagent {
 //#region src/features/subagents/tabnine-subagent.ts
 const TabnineSubagentFrontmatterSchema = z.looseObject({
 	name: z.string(),
-	description: z.optional(z.string()),
+	description: z.string(),
 	/** "local" (default) runs inside the CLI; "remote" delegates to a Tabnine cloud agent. */
 	kind: z.optional(z.string()),
 	/** Built-in tool names the subagent may use; omitted = every tool. */
@@ -65063,14 +66361,23 @@ var TabnineSubagent = class TabnineSubagent extends ToolSubagent {
 			validate: true
 		});
 	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
 		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
 		const tabnineSection = rulesyncFrontmatter.tabnine ?? {};
-		const tabnineSubagentFrontmatter = {
+		const merged = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...tabnineSection
 		};
+		let description = merged.description;
+		if (description === void 0 || description === "") {
+			description = rulesyncFrontmatter.name ? `${rulesyncFrontmatter.name} subagent` : "subagent";
+			logger?.warn(`Tabnine CLI subagent ${rulesyncSubagent.getRelativeFilePath()} has no description, which Tabnine requires; wrote ${JSON.stringify(description)} as a placeholder.`);
+		}
+		const tabnineSubagentFrontmatter = {
+			...merged,
+			description
+		};
 		const body = rulesyncSubagent.getBody();
 		const fileContent = stringifyFrontmatter(body, tabnineSubagentFrontmatter, { avoidBlockScalars: true });
 		const paths = this.getSettablePaths({ global });
@@ -71333,24 +72640,6 @@ var PiRule = class PiRule extends ToolRule {
 	}
 };
 //#endregion
-//#region src/constants/pool-paths.ts
-/**
-* Pool (Poolside's coding agent CLI) configuration-layout conventions.
-*
-* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
-* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
-* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
-* path), the project-root `AGENTS.md`, and nested per-directory
-* `AGENTS.md` files from the repository root down through the working
-* directory, deeper files taking precedence. It skips ignored directories
-* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
-*
-* @see https://docs.poolside.ai/agent-instructions
-* @see https://github.com/poolsideai/pool
-*/
-/** Global config directory for Pool, relative to the home directory. */
-const POOL_GLOBAL_DIR = join(".config", "poolside");
-//#endregion
 //#region src/features/rules/pool-rule.ts
 var PoolRule = class PoolRule extends ToolRule {
 	static getSettablePaths({ global = false } = {}) {
@@ -76417,6 +77706,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { RulesyncCheck as $, writeFileContent as $t, CLAUDECODE_SKILLS_DIR_PATH as A, RULESYNC_SKILLS_RELATIVE_DIR_PATH as An, directoryExists as At, RulesyncSkill as B, truncateText as Bn, listSubdirectoryNames as Bt, ChecksProcessor as C, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Cn, ErrorCodes as Ct, CLAUDECODE_LOCAL_RULE_FILE_NAME as D, RULESYNC_PERMISSIONS_SCHEMA_URL as Dn, assertWritablePathInsideRoot as Dt, CLAUDECODE_DIR as E, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as En, assertTreeContainsNoSymlinks as Et, AUGMENTCODE_DIR as F, parseCommaSeparatedList as Fn, isFileNotFoundError as Ft, RulesyncMcp as G, stripControlCharactersKeepingLineFeeds as Gn, removeDirectoryStrict as Gt, RulesyncRule as H, hasEnclosingMarkOutsideKeycap as Hn, readFileContent as Ht, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as I, ALL_FEATURES as In, isFileSystemError as It, getRulesyncSourceCandidates as J, removeTempDirectory as Jt, RulesyncIgnore as K, stripHiddenCharacters as Kn, removeFile as Kt, getLocalSkillDirNames as L, ALL_FEATURES_WITH_WILDCARD as Ln, isSymlink as Lt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as M, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Mn, fileExists as Mt, caseFoldIdentity as N, RULESYNC_USER_CONFIG_DIR_NAME as Nn, getFileSize as Nt, CLAUDECODE_MEMORIES_DIR_NAME as O, RULESYNC_RELATIVE_DIR_PATH as On, checkPathTraversal as Ot, groupSpellingsByCaseFoldedIdentity as P, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Pn, getHomeDirectory as Pt, RulesyncCommandFrontmatterSchema as Q, writeFileBuffer as Qt, RulesyncSubagent as R, DEPRECATED_FEATURE_REPLACEMENTS as Rn, listDirectoryEntryNames as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_MCP_SCHEMA_URL as Sn, CLIError as St, CODEXCLI_DIR as T, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as Tn, assertDirectoryIfExists as Tt, RulesyncRuleFrontmatterSchema as U, quoteForLog as Un, readFileContentOrNull as Ut, RulesyncSkillFrontmatterSchema as V, hasDeceptiveHiddenCharacters as Vn, pathEscapesRoot as Vt, RulesyncPermissions as W, stripControlCharacters as Wn, removeDirectory as Wt, parseJsonc as X, runWithDirectoryRollback as Xt, resolveRulesyncSourceWritePath as Y, resolvePath as Yt, RulesyncCommand as Z, toPosixPath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, fallbackLogger as _t, getProcessorRegistryEntry as a, MAX_FILE_SIZE as an, ConfigResolver as at, CommandsProcessor as b, RULESYNC_MCP_LEGACY_FILE_NAME as bn, resetRunWarningState as bt, RulesProcessor as c, RULESYNC_CHECKS_RELATIVE_DIR_PATH as cn, CONFLICTING_TARGET_PAIRS as ct, CODEBUDDY_DIR as d, RULESYNC_CONFIG_SCHEMA_URL as dn, SourceEntrySchema as dt, ALL_TOOL_TARGETS as en, RulesyncCheckFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as fn, assertTargetsFeaturesExclusive as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, WarningCollectingLogger as gt, shortenToWidth as h, RULESYNC_HOOKS_LEGACY_FILE_NAME as hn, JsonLogger as ht, inspectInputRoots as i, CURATED_RULES_FEATURE_SUBDIR as in, SKILL_FILE_NAME as it, FACTORYDROID_DIR as j, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as jn, ensureDir as jt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as k, RULESYNC_RULES_RELATIVE_DIR_PATH as kn, createTempDirectory as kt, SubagentsProcessor as l, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as ln, ConfigFileSchema as lt, displayWidthOf as m, RULESYNC_HOOKS_FILE_NAME as mn, ConsoleLogger as mt, formatSourceLoadFailure as n, PACKAGING_TOOL_TARGETS as nn, loadYaml as nt, convertFromTool as o, RULESYNC_AIIGNORE_FILE_NAME as on, mergeInputRootConfigs as ot, ELLIPSIS_WIDTH as p, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as pn, findControlCharacter as pt, RulesyncHooks as q, removeFileStrict as qt, generate as r, ToolTargetSchema as rn, SHARED_USER_MANAGED_CONFIG_PATHS as rt, isPackagingToolTarget as s, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as sn, resolveEffectiveInputRoots as st, importFromTool as t, ALL_TOOL_TARGETS_WITH_WILDCARD as tn, stringifyFrontmatter as tt, SkillsProcessor as u, RULESYNC_CONFIG_RELATIVE_FILE_PATH as un, GITIGNORE_DESTINATION_KEY as ut, CRUSH_LOCAL_RULE_FILE_NAME as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, warnOnConflictingFlags as vt, CODEXCLI_BASH_RULES_FILE_NAME as w, RULESYNC_PERMISSIONS_FILE_NAME as wn, applyFileMode as wt, QWENCODE_DIR as x, RULESYNC_MCP_RELATIVE_FILE_PATH as xn, withWarnOnceScope as xt, HooksProcessor as y, RULESYNC_MCP_FILE_NAME as yn, withFallbackLoggerTarget as yt, RulesyncSubagentFrontmatterSchema as z, formatError as zn, listFilePathsRecursively as zt };
+export { RulesyncCheck as $, writeFileContent as $t, CLAUDECODE_SKILLS_DIR_PATH as A, RULESYNC_SKILLS_RELATIVE_DIR_PATH as An, directoryExists as At, RulesyncSkill as B, truncateText as Bn, listSubdirectoryNames as Bt, ChecksProcessor as C, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Cn, ErrorCodes as Ct, CLAUDECODE_LOCAL_RULE_FILE_NAME as D, RULESYNC_PERMISSIONS_SCHEMA_URL as Dn, assertWritablePathInsideRoot as Dt, CLAUDECODE_DIR as E, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as En, assertTreeContainsNoSymlinks as Et, AUGMENTCODE_DIR as F, parseCommaSeparatedList as Fn, isFileNotFoundError as Ft, RulesyncMcp as G, stripControlCharactersKeepingLineFeeds as Gn, removeDirectoryStrict as Gt, RulesyncRule as H, hasEnclosingMarkOutsideKeycap as Hn, readFileContent as Ht, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as I, ALL_FEATURES as In, isFileSystemError as It, getRulesyncSourceCandidates as J, removeTempDirectory as Jt, RulesyncIgnore as K, stripHiddenCharacters as Kn, removeFile as Kt, getLocalSkillDirNames as L, ALL_FEATURES_WITH_WILDCARD as Ln, isSymlink as Lt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as M, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Mn, fileExists as Mt, caseFoldIdentity as N, RULESYNC_USER_CONFIG_DIR_NAME as Nn, getFileSize as Nt, CLAUDECODE_MEMORIES_DIR_NAME as O, RULESYNC_RELATIVE_DIR_PATH as On, checkPathTraversal as Ot, groupSpellingsByCaseFoldedIdentity as P, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Pn, getHomeDirectory as Pt, RulesyncCommandFrontmatterSchema as Q, writeFileBuffer as Qt, RulesyncSubagent as R, DEPRECATED_FEATURE_REPLACEMENTS as Rn, listDirectoryEntryNames as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_MCP_SCHEMA_URL as Sn, CLIError as St, CODEXCLI_DIR as T, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as Tn, assertDirectoryIfExists as Tt, RulesyncRuleFrontmatterSchema as U, quoteForLog as Un, readFileContentOrNull as Ut, RulesyncSkillFrontmatterSchema as V, hasDeceptiveHiddenCharacters as Vn, pathEscapesRoot as Vt, RulesyncPermissions as W, stripControlCharacters as Wn, removeDirectory as Wt, parseJsonc as X, runWithDirectoryRollback as Xt, resolveRulesyncSourceWritePath as Y, resolvePath as Yt, RulesyncCommand as Z, toPosixPath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, fallbackLogger as _t, getProcessorRegistryEntry as a, MAX_FILE_SIZE as an, ConfigResolver as at, CommandsProcessor as b, RULESYNC_MCP_LEGACY_FILE_NAME as bn, resetRunWarningState as bt, RulesProcessor as c, RULESYNC_CHECKS_RELATIVE_DIR_PATH as cn, CONFLICTING_TARGET_PAIRS as ct, CODEBUDDY_DIR as d, RULESYNC_CONFIG_SCHEMA_URL as dn, SourceEntrySchema as dt, ALL_TOOL_TARGETS as en, RulesyncCheckFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as fn, assertTargetsFeaturesExclusive as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, WarningCollectingLogger as gt, shortenToWidth as h, RULESYNC_HOOKS_LEGACY_FILE_NAME as hn, JsonLogger as ht, inspectInputRoots as i, CURATED_RULES_FEATURE_SUBDIR as in, SKILL_FILE_NAME as it, FACTORYDROID_DIR as j, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as jn, ensureDir as jt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as k, RULESYNC_RULES_RELATIVE_DIR_PATH as kn, createTempDirectory as kt, SubagentsProcessor as l, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as ln, ConfigFileSchema as lt, displayWidthOf as m, RULESYNC_HOOKS_FILE_NAME as mn, ConsoleLogger as mt, formatSourceLoadFailure as n, PACKAGING_TOOL_TARGETS as nn, loadYaml as nt, convertFromTool as o, RULESYNC_AIIGNORE_FILE_NAME as on, mergeInputRootConfigs as ot, ELLIPSIS_WIDTH as p, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as pn, findControlCharacter as pt, RulesyncHooks as q, removeFileStrict as qt, generate as r, ToolTargetSchema as rn, SHARED_USER_MANAGED_CONFIG_PATHS as rt, isPackagingToolTarget as s, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as sn, resolveEffectiveInputRoots as st, importFromTool as t, ALL_TOOL_TARGETS_WITH_WILDCARD as tn, stringifyFrontmatter as tt, SkillsProcessor as u, RULESYNC_CONFIG_RELATIVE_FILE_PATH as un, GITIGNORE_DESTINATION_KEY as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, warnOnConflictingFlags as vt, CODEXCLI_BASH_RULES_FILE_NAME as w, RULESYNC_PERMISSIONS_FILE_NAME as wn, applyFileMode as wt, QWENCODE_DIR as x, RULESYNC_MCP_RELATIVE_FILE_PATH as xn, withWarnOnceScope as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_FILE_NAME as yn, withFallbackLoggerTarget as yt, RulesyncSubagentFrontmatterSchema as z, formatError as zn, listFilePathsRecursively as zt };
 
-//# sourceMappingURL=import-D5n_V39C.js.map
+//# sourceMappingURL=import-C6R-lXFF.js.map