rulesync 16.32.0 → 16.33.0

package/dist/{import-0wSuIchf.cjs → import-DVRU6cLB.cjs}

@@ -444,36 +444,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$340 } = node_path.posix;
+const { join: join$342 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$340(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$342(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$340(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$340(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$342(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$342(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$342(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -583,6 +583,7 @@ const mcpProcessorToolTargetTuple = [
 	"copilot",
 	"copilotcli",
 	"cortexcode",
+	"crush",
 	"cursor",
 	"deepagents",
 	"factorydroid",
@@ -719,6 +720,7 @@ const skillsProcessorToolTargetTuple = [
 	"musecode",
 	"opencode",
 	"pi",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"replit",
@@ -749,6 +751,7 @@ const hooksProcessorToolTargetTuple = [
 	"copilot",
 	"copilotcli",
 	"cortexcode",
+	"crush",
 	"opencode",
 	"pi",
 	"factorydroid",
@@ -781,6 +784,7 @@ const permissionsProcessorToolTargetTuple = [
 	"continue",
 	"copilot",
 	"copilotcli",
+	"crush",
 	"cursor",
 	"deepagents",
 	"devin",
@@ -3308,6 +3312,9 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	"reasonix.toml",
 	".vscode/settings.json",
 	".zed/settings.json",
+	"crush.json",
+	".crush.json",
+	".config/crush/crush.json",
 	"kilo.json",
 	"kilo.jsonc",
 	"opencode.json",
@@ -3512,6 +3519,27 @@ function omitPrototypePollutionKeys(record) {
 	}
 	return sanitized;
 }
+/**
+* Like {@link omitPrototypePollutionKeys}, but recursive: every plain object
+* reachable through the value (directly, or through an array) is copied with
+* its prototype-pollution keys dropped. Scalars and arrays of scalars come back
+* as they are.
+*
+* Use when passing an unknown, user-supplied value through unchanged — an MCP
+* server field a tool documents that rulesync does not model — so a
+* `__proto__` key nested anywhere inside it cannot ride into the generated
+* config, where the consuming tool may merge the object without the same care.
+*/
+function omitPrototypePollutionKeysDeep(value) {
+	if (Array.isArray(value)) return value.map((entry) => omitPrototypePollutionKeysDeep(entry));
+	if (value === null || typeof value !== "object") return value;
+	const sanitized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = omitPrototypePollutionKeysDeep(entry);
+	}
+	return sanitized;
+}
 //#endregion
 //#region src/utils/type-guards.ts
 /**
@@ -4579,6 +4607,14 @@ const VIBE_HOOK_EVENTS = [
 	"stop"
 ];
 /**
+* Hook events supported by Crush.
+*
+* Crush's `hooks` config block currently fires a single event, `PreToolUse`
+* (Claude Code-compatible payload; `matcher` is a regex on the tool name).
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+*/
+const CRUSH_HOOK_EVENTS = ["preToolUse"];
+/**
 * Hook events supported by JetBrains Junie CLI.
 *
 * Junie CLI exposes seven lifecycle events under the `"hooks"` key of
@@ -5121,6 +5157,7 @@ const HooksConfigSchema = zod_mini.z.looseObject({
 	grokcli: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	"kimi-code": zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	zcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
+	crush: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	bob: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	cortexcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	continue: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
@@ -5618,6 +5655,13 @@ const VIBE_TO_CANONICAL_EVENT_NAMES = {
 	post_agent_turn: "stop"
 };
 /**
+* Canonical -> Crush event names. Crush spells its events the Claude Code
+* way (`PreToolUse`).
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+*/
+const CANONICAL_TO_CRUSH_EVENT_NAMES = { preToolUse: "PreToolUse" };
+const CRUSH_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_EVENT_NAMES).map(([k, v]) => [v, k]));
+/**
 * Map canonical camelCase event names to Qwen Code PascalCase.
 *
 * Qwen Code reuses the same Claude-style PascalCase event names for the events
@@ -6057,6 +6101,11 @@ const McpServerSchema = zod_mini.z.looseObject({
 	kiroAutoBlock: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	musecodeMode: zod_mini.z.optional(zod_mini.z.enum(["required", "optional"])),
 	rovodevEnableInstructions: zod_mini.z.optional(zod_mini.z.boolean()),
+	crushOauth: zod_mini.z.optional(zod_mini.z.boolean()),
+	crushOauthClientId: zod_mini.z.optional(zod_mini.z.string()),
+	crushOauthClientSecret: zod_mini.z.optional(zod_mini.z.string()),
+	crushOauthCallbackPort: zod_mini.z.optional(zod_mini.z.int()),
+	crushSessionless: zod_mini.z.optional(zod_mini.z.boolean()),
 	headers: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
 	/**
 	* The canonical per-server tool allowlist.
@@ -6133,6 +6182,8 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	continue: zod_mini.z.optional(toolScopedMcpSchema),
 	copilot: zod_mini.z.optional(toolScopedMcpSchema),
 	copilotcli: zod_mini.z.optional(toolScopedMcpSchema),
+	cortexcode: zod_mini.z.optional(toolScopedMcpSchema),
+	crush: zod_mini.z.optional(toolScopedMcpSchema),
 	cursor: zod_mini.z.optional(toolScopedMcpSchema),
 	deepagents: zod_mini.z.optional(toolScopedMcpSchema),
 	devin: zod_mini.z.optional(toolScopedMcpSchema),
@@ -6149,7 +6200,6 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	reasonix: zod_mini.z.optional(toolScopedMcpSchema),
 	roo: zod_mini.z.optional(toolScopedMcpSchema),
 	rovodev: zod_mini.z.optional(toolScopedMcpSchema),
-	cortexcode: zod_mini.z.optional(toolScopedMcpSchema),
 	tabnine: zod_mini.z.optional(toolScopedMcpSchema),
 	takt: zod_mini.z.optional(toolScopedMcpSchema),
 	vibe: zod_mini.z.optional(toolScopedMcpSchema),
@@ -6481,6 +6531,15 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 				"musecodeMode",
 				"rovodevEnableInstructions",
 				"enable_instructions",
+				"crushOauth",
+				"crushOauthClientId",
+				"crushOauthClientSecret",
+				"crushOauthCallbackPort",
+				"crushSessionless",
+				"oauth_client_id",
+				"oauth_client_secret",
+				"oauth_callback_port",
+				"sessionless",
 				"enabled"
 			])];
 		}));
@@ -6929,7 +6988,7 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
 * `sandbox`, `sandboxImage`, `disabled`, `visible`, `eager`, `listDirectory`,
-* `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
+* `todoWrite`, `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
 * `allowPrivateNetworkHooks`, `allowedInsecureVoiceBaseUrls`). Qwen Code strips
 * `tools.workflowsEnabled`, `security.allowPrivateNetworkHooks` and
 * `security.allowedInsecureVoiceBaseUrls` out of workspace settings, so generate
@@ -6942,7 +7001,7 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * changes what the file said is reported in either scope, naming what that key
 * decides there — the autonomy and containment
 * controls (`approvalMode`, `autoAccept`, `sandbox`, `sandboxImage`), the
-* registry controls (`disabled`, `visible`, `listDirectory`, and `eager`, which
+* registry controls (`disabled`, `visible`, `listDirectory`, `todoWrite`, and `eager`, which
 * demotes an omitted tool to deferred rather than removing it, replacing rather
 * than merging with the list a higher scope set), the Auto Mode
 * classifier config, and, because these groups are loose objects, any key
@@ -6983,6 +7042,14 @@ const QwencodePermissionsOverrideSchema = zod_mini.z.looseObject({
 * `looseObject` (verbatim passthrough). Both project and global scope are
 * supported.
 *
+* Only `tools` and `general` are written; any other key is ignored with a
+* warning. Within them, the paths Tabnine CLI runs as a command or sends its
+* traffic to — `tools.discoveryCommand`, `tools.callCommand`,
+* `tools.shell.pager`, `tools.sandbox.command`, `general.tabnineHost` and
+* `general.preferredEditor` — are refused with a warning rather than written,
+* so a fetched permissions file cannot point the CLI at an executable or a
+* server of its choosing; set those by hand in `settings.json`.
+*
 * @example
 * { "tools": { "core": ["read_file", "run_shell_command(git)"] },
 *   "general": { "defaultApprovalMode": "plan" } }
@@ -7767,6 +7834,7 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	continue: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	crush: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
@@ -12792,6 +12860,26 @@ const ZCODE_USER_CONFIG_DECLARATION = {
 	}
 };
 /**
+* Crush's JSON config, shared by the project (`crush.json` / `.crush.json`)
+* and global (`~/.config/crush/crush.json`) spellings so a policy edit lands
+* on both. See the `SHARED_CONFIG_OWNERSHIP` entries for the key rationale.
+*/
+const CRUSH_CONFIG_DECLARATION = {
+	format: "json",
+	invalidRootPolicy: "error",
+	features: {
+		mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp"]
+		},
+		hooks: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["hooks"]
+		},
+		permissions: { kind: "deep-merge" }
+	}
+};
+/**
 * What the two Claude Code settings files have in common: both are plain JSON,
 * and both validate against the one published schema, which the gateway
 * points every file it writes at. `.claude/settings.local.json` is the same
@@ -13052,6 +13140,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 	},
 	".zcode/config.json": ZCODE_WORKSPACE_CONFIG_DECLARATION,
 	".zcode/cli/config.json": ZCODE_USER_CONFIG_DECLARATION,
+	"crush.json": CRUSH_CONFIG_DECLARATION,
+	".config/crush/crush.json": CRUSH_CONFIG_DECLARATION,
 	".bob/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -18901,15 +18991,12 @@ var TabnineCommand = class TabnineCommand extends ToolCommand {
 		return this.body;
 	}
 	getFrontmatter() {
-		return {
-			description: this.frontmatter.description,
-			prompt: this.frontmatter.prompt
-		};
+		return this.frontmatter;
 	}
 	toRulesyncCommand() {
 		const { description, prompt: _prompt, ...restFields } = this.frontmatter;
 		const rulesyncFrontmatter = {
-			targets: ["tabnine"],
+			targets: ["*"],
 			description,
 			...Object.keys(restFields).length > 0 && { tabnine: restFields }
 		};
@@ -20872,7 +20959,20 @@ function stableJson(value) {
 */
 function isSafeStringRecord(value) {
 	if (!isPlainObject$1(value) || !isStringRecord(value)) return false;
-	return Object.entries(value).every(([key, entry]) => key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || entry.includes(char)));
+	return Object.entries(value).every(([key, entry]) => isSafeEnvEntry({
+		key,
+		value: entry
+	}));
+}
+/**
+* Whether one `env` entry survives the rule {@link isSafeStringRecord} applies
+* to the whole map. Exported for the adapters that hand a tool an environment
+* block outside the shared converter (Tabnine, whose hook shape it does not
+* express) so they drop the same entries this one does.
+*/
+function isSafeEnvEntry(entry) {
+	const { key, value } = entry;
+	return typeof value === "string" && key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || value.includes(char));
 }
 /**
 * Control characters cannot ride from an existing tool config into a canonical
@@ -21763,135 +21863,6 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hooks/bob-hooks.ts
-const BOB_CONVERTER_CONFIG = {
-	supportedEvents: BOB_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_BOB_EVENT_NAMES,
-	toolToCanonicalEventNames: BOB_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "",
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"sessionStart",
-		"beforeSubmitPrompt",
-		"stop"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
-	wildcardMatcherMeansAll: true
-};
-/**
-* Single spelling of the settings.json codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Bob settings with
-* generated output.
-*/
-function parseBobSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
-* IBM Bob lifecycle hooks.
-*
-* Hooks live under the top-level `hooks` key of Bob's settings file —
-* `<project>/.bob/settings.json` (project scope) and
-* `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
-* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
-* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
-* settings rulesync does not own, so generation merges the `hooks` key into it
-* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
-*
-* @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
-*/
-var BobHooks = class BobHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
-	}
-	static getSettablePaths({ global = false } = {}) {
-		return {
-			relativeDirPath: global ? BOB_GLOBAL_SETTINGS_DIR_PATH : BOB_DIR,
-			relativeFilePath: BOB_SETTINGS_FILE_NAME
-		};
-	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = BobHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = BobHooks.getSettablePaths({ global });
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.bob?.hooks,
-			converterConfig: BOB_CONVERTER_CONFIG,
-			logger
-		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
-			logger
-		});
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseBobSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Bob hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: BOB_CONVERTER_CONFIG
-		});
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
-			hooks,
-			overrideKey: "bob"
-		}), null, 2) });
-	}
-	validate() {
-		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
-		});
-	}
-};
-//#endregion
 //#region src/features/hooks/preserve-unowned-hook-commands.ts
 /**
 * Read the `hooks` value from a destination JSON file.
@@ -22178,75 +22149,22 @@ function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
 }
 //#endregion
-//#region src/features/hooks/claudecode-hooks.ts
-const CLAUDE_CONVERTER_CONFIG = {
-	supportedEvents: CLAUDE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CLAUDE_EVENT_NAMES,
-	toolToCanonicalEventNames: CLAUDE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CLAUDE_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"worktreeCreate",
-		"worktreeRemove",
-		"messageDisplay",
-		"postToolBatch",
-		"taskCreated",
-		"taskCompleted",
-		"teammateIdle",
-		"cwdChanged",
-		"beforeSubmitPrompt",
-		"stop"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set([
-		"command",
-		"prompt",
-		"http",
-		"mcp_tool",
-		"agent"
-	]),
-	emitsPromptModel: true,
-	stringPassthroughFields: [
-		{
-			canonical: "if",
-			tool: "if"
-		},
-		{
-			canonical: "statusMessage",
-			tool: "statusMessage"
-		},
-		{
-			canonical: "shell",
-			tool: "shell",
-			commandOnly: true
-		}
-	],
-	booleanPassthroughFields: [
-		{
-			canonical: "once",
-			tool: "once"
-		},
-		{
-			canonical: "async",
-			tool: "async",
-			commandOnly: true
-		},
-		{
-			canonical: "asyncRewake",
-			tool: "asyncRewake",
-			commandOnly: true
-		},
-		{
-			canonical: "continueOnBlock",
-			tool: "continueOnBlock"
-		}
-	],
-	arrayPassthroughFields: [{
-		canonical: "args",
-		tool: "args",
-		commandOnly: true
-	}]
-};
-var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
+//#region src/features/hooks/settings-json-hooks.ts
+/**
+* Shared implementation for the tools whose hooks live under the top-level
+* `hooks` key of a JSON settings file in Claude Code's shape —
+* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command", ... }] }] }`
+* — and whose file also holds settings rulesync does not own, so generation
+* merges the `hooks` key into it (see `SHARED_CONFIG_OWNERSHIP`) instead of
+* overwriting it, and `--delete` never removes the file wholesale.
+*
+* A concrete adapter supplies its {@link SettingsJsonHooksSpec} and its
+* settable paths; the event mapping, the matcher rules and the per-hook
+* fields the tool documents are all expressed in the spec's converter config.
+* An adapter that also supports preserving unowned hooks (Claude Code) opts in
+* through {@link ToolHooks.supportsPreserveUnowned}.
+*/
+var SettingsJsonHooks = class extends ToolHooks {
 	constructor(params) {
 		super({
 			...params,
@@ -22256,24 +22174,42 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 	isDeletable() {
 		return false;
 	}
+	/** The tool-specific half of the adapter. Every concrete class overrides this. */
+	static getSpec() {
+		throw new Error(`${this.name} does not define getSpec()`);
+	}
 	/**
-	* The converter config used for both directions. Exposed as a static hook so
-	* plugin-scoped subclasses can swap tool-specific details (e.g. the project
-	* directory variable) without duplicating the rest of the config.
+	* The converter config used for both directions. A separate hook so a
+	* subclass can swap tool-specific details (e.g. the project directory
+	* variable) without redefining the whole spec.
 	*/
 	static getConverterConfig() {
-		return CLAUDE_CONVERTER_CONFIG;
+		return this.getSpec().converterConfig;
 	}
 	static getSettablePaths(_options = {}) {
-		return {
-			relativeDirPath: CLAUDECODE_DIR,
-			relativeFilePath: CLAUDECODE_SETTINGS_FILE_NAME
-		};
+		throw new Error(`${this.name} does not define getSettablePaths()`);
+	}
+	/**
+	* The `SHARED_CONFIG_OWNERSHIP` key the settings file is merged under. By
+	* default it is derived from the settable paths; an adapter whose file is
+	* declared under another tool's key (the Claude Code plugin bundle) overrides
+	* it.
+	*/
+	static getSharedFileKey(paths) {
+		return sharedConfigFileKey(paths);
+	}
+	/**
+	* `new this(params)` for the concrete adapter the static method was called
+	* on; the cast is what an abstract class needs to be constructed through
+	* `this`, and lives in one place.
+	*/
+	static instantiate(params) {
+		return new this(params);
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -22281,40 +22217,41 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 			validate
 		});
 	}
-	static supportsPreserveUnowned() {
-		return true;
-	}
 	static async getAuxiliaryFiles({ toolHooks } = {}) {
-		return toolHooks instanceof ClaudecodeHooks ? toolHooks.getOwnershipLockFiles() : [];
+		return toolHooks instanceof this ? toolHooks.getOwnershipLockFiles() : [];
 	}
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		const config = rulesyncHooks.getJson();
-		const claudeHooks = canonicalToToolHooks({
+		const generatedHooks = canonicalToToolHooks({
 			config,
-			toolOverrideHooks: config.claudecode?.hooks,
+			toolOverrideHooks: overrideHooksOf({
+				config,
+				overrideKey: this.getSpec().overrideKey
+			}),
 			converterConfig: this.getConverterConfig(),
 			logger
 		});
 		const preserving = preserveUnowned && this.supportsPreserveUnowned();
 		const merged = mergeGeneratedHookLists({
 			existingContent,
-			generatedHooks: claudeHooks,
+			generatedHooks,
 			shape: "matcher-groups",
 			preserveUnowned: preserving,
 			previouslyOwned: preserving ? parseHooksOwnershipLock(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0,
 			logger
 		});
 		const fileContent = applySharedConfigPatch({
-			fileKey: CLAUDE_SETTINGS_SHARED_FILE_KEY,
+			fileKey: this.getSharedFileKey(paths),
 			feature: "hooks",
 			existingContent,
 			patch: { hooks: merged.hooks },
-			filePath
+			filePath,
+			logger
 		});
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -22324,20 +22261,29 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		});
 	}
 	toRulesyncHooks({ logger } = {}) {
+		const ctor = this.constructor;
+		const spec = ctor.getSpec();
+		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
 		let settings;
 		try {
-			settings = JSON.parse(this.getFileContent());
+			settings = parseSharedConfig({
+				format: "json",
+				fileContent: this.getFileContent(),
+				filePath: configPath,
+				invalidRootPolicy: "error"
+			});
 		} catch (error) {
-			throw new Error(`Failed to parse Claude hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+			const reason = error instanceof Error && error.cause instanceof Error ? error.cause : error;
+			throw new Error(`Failed to parse ${spec.displayName} hooks content in ${configPath}: ${formatError(reason)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
+			logger,
 			hooks: settings.hooks,
-			converterConfig: this.constructor.getConverterConfig(),
-			logger
+			converterConfig: ctor.getConverterConfig()
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey: "claudecode"
+			overrideKey: spec.overrideKey
 		}), null, 2) });
 	}
 	validate() {
@@ -22347,7 +22293,7 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		};
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
@@ -22356,6 +22302,158 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		});
 	}
 };
+/**
+* The `hooks` map of a tool's override block (`config.<overrideKey>.hooks`),
+* or `undefined` when the block states none. The schema keeps every override
+* block loose, so the lookup goes through the record form.
+*/
+function overrideHooksOf({ config, overrideKey }) {
+	const override = lookupOwn({
+		record: config,
+		key: overrideKey
+	});
+	if (!isPlainObject$1(override)) return;
+	const hooks = override.hooks;
+	return isPlainObject$1(hooks) ? hooks : void 0;
+}
+//#endregion
+//#region src/features/hooks/bob-hooks.ts
+const BOB_SPEC = {
+	displayName: "Bob",
+	overrideKey: "bob",
+	converterConfig: {
+		supportedEvents: BOB_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_BOB_EVENT_NAMES,
+		toolToCanonicalEventNames: BOB_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "",
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"sessionStart",
+			"beforeSubmitPrompt",
+			"stop"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+		wildcardMatcherMeansAll: true
+	}
+};
+/**
+* IBM Bob lifecycle hooks.
+*
+* Hooks live under the top-level `hooks` key of Bob's settings file —
+* `<project>/.bob/settings.json` (project scope) and
+* `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
+* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
+* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
+* settings rulesync does not own, so generation merges the `hooks` key into it
+* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
+*
+* @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
+*/
+var BobHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return BOB_SPEC;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? BOB_GLOBAL_SETTINGS_DIR_PATH : BOB_DIR,
+			relativeFilePath: BOB_SETTINGS_FILE_NAME
+		};
+	}
+};
+//#endregion
+//#region src/features/hooks/claudecode-hooks.ts
+const CLAUDE_SPEC = {
+	displayName: "Claude",
+	overrideKey: "claudecode",
+	converterConfig: {
+		supportedEvents: CLAUDE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CLAUDE_EVENT_NAMES,
+		toolToCanonicalEventNames: CLAUDE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CLAUDE_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"worktreeCreate",
+			"worktreeRemove",
+			"messageDisplay",
+			"postToolBatch",
+			"taskCreated",
+			"taskCompleted",
+			"teammateIdle",
+			"cwdChanged",
+			"beforeSubmitPrompt",
+			"stop"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set([
+			"command",
+			"prompt",
+			"http",
+			"mcp_tool",
+			"agent"
+		]),
+		emitsPromptModel: true,
+		stringPassthroughFields: [
+			{
+				canonical: "if",
+				tool: "if"
+			},
+			{
+				canonical: "statusMessage",
+				tool: "statusMessage"
+			},
+			{
+				canonical: "shell",
+				tool: "shell",
+				commandOnly: true
+			}
+		],
+		booleanPassthroughFields: [
+			{
+				canonical: "once",
+				tool: "once"
+			},
+			{
+				canonical: "async",
+				tool: "async",
+				commandOnly: true
+			},
+			{
+				canonical: "asyncRewake",
+				tool: "asyncRewake",
+				commandOnly: true
+			},
+			{
+				canonical: "continueOnBlock",
+				tool: "continueOnBlock"
+			}
+		],
+		arrayPassthroughFields: [{
+			canonical: "args",
+			tool: "args",
+			commandOnly: true
+		}]
+	}
+};
+var ClaudecodeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CLAUDE_SPEC;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: CLAUDECODE_DIR,
+			relativeFilePath: CLAUDECODE_SETTINGS_FILE_NAME
+		};
+	}
+	/**
+	* Every Claude-shaped settings file rulesync writes for Claude Code — the
+	* project and user `settings.json` and the plugin bundle's `hooks.json` — is
+	* declared under the one Claude key in `SHARED_CONFIG_OWNERSHIP`.
+	*/
+	static getSharedFileKey(_paths) {
+		return CLAUDE_SETTINGS_SHARED_FILE_KEY;
+	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+};
 //#endregion
 //#region src/features/hooks/claudecode-plugin-hooks.ts
 var ClaudecodePluginHooks = class extends ClaudecodeHooks {
@@ -22883,54 +22981,45 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 };
 //#endregion
 //#region src/features/hooks/continue-hooks.ts
-const CONTINUE_CONVERTER_CONFIG = {
-	supportedEvents: CONTINUE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CONTINUE_EVENT_NAMES,
-	toolToCanonicalEventNames: CONTINUE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CONTINUE_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"beforeSubmitPrompt",
-		"stop",
-		"teammateIdle",
-		"taskCompleted",
-		"worktreeCreate",
-		"worktreeRemove"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set([
-		"command",
-		"prompt",
-		"http",
-		"agent"
-	]),
-	emitsPromptModel: true,
-	stringPassthroughFields: [{
-		canonical: "statusMessage",
-		tool: "statusMessage"
-	}],
-	booleanPassthroughFields: [{
-		canonical: "once",
-		tool: "once"
-	}, {
-		canonical: "async",
-		tool: "async",
-		commandOnly: true
-	}]
+const CONTINUE_SPEC = {
+	displayName: "Continue",
+	overrideKey: "continue",
+	converterConfig: {
+		supportedEvents: CONTINUE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CONTINUE_EVENT_NAMES,
+		toolToCanonicalEventNames: CONTINUE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CONTINUE_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"beforeSubmitPrompt",
+			"stop",
+			"teammateIdle",
+			"taskCompleted",
+			"worktreeCreate",
+			"worktreeRemove"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set([
+			"command",
+			"prompt",
+			"http",
+			"agent"
+		]),
+		emitsPromptModel: true,
+		stringPassthroughFields: [{
+			canonical: "statusMessage",
+			tool: "statusMessage"
+		}],
+		booleanPassthroughFields: [{
+			canonical: "once",
+			tool: "once"
+		}, {
+			canonical: "async",
+			tool: "async",
+			commandOnly: true
+		}]
+	}
 };
 /**
-* Single spelling of the settings/hooks codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Continue settings with
-* generated output.
-*/
-function parseContinueSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
 * Continue CLI hooks.
 *
 * Hooks live under the top-level `hooks` key of `<project>/.continue/settings.json`
@@ -22946,15 +23035,9 @@ function parseContinueSettings(fileContent, filePath) {
 * @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/hookConfig.ts
 * @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/types.ts
 */
-var ContinueHooks = class ContinueHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
+var ContinueHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CONTINUE_SPEC;
 	}
 	static getSettablePaths(_options = {}) {
 		return {
@@ -22962,77 +23045,6 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 			relativeFilePath: CONTINUE_SETTINGS_FILE_NAME
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = ContinueHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new ContinueHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = ContinueHooks.getSettablePaths({ global });
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.continue?.hooks,
-			converterConfig: CONTINUE_CONVERTER_CONFIG,
-			logger
-		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
-			logger
-		});
-		return new ContinueHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseContinueSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Continue hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: CONTINUE_CONVERTER_CONFIG
-		});
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
-			hooks,
-			overrideKey: "continue"
-		}), null, 2) });
-	}
-	validate() {
-		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new ContinueHooks({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
-		});
-	}
 };
 //#endregion
 //#region src/features/hooks/copilot-hooks.ts
@@ -23623,33 +23635,24 @@ const CORTEXCODE_SKILLS_DIR_PATH = (0, node_path.join)(CORTEXCODE_DIR, "skills")
 const CORTEXCODE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(CORTEXCODE_GLOBAL_DIR_PATH, "skills");
 //#endregion
 //#region src/features/hooks/cortexcode-hooks.ts
-const CORTEXCODE_CONVERTER_CONFIG = {
-	supportedEvents: CORTEXCODE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CORTEXCODE_EVENT_NAMES,
-	toolToCanonicalEventNames: CORTEXCODE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CORTEX_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]),
-	supportedHookTypes: /* @__PURE__ */ new Set(["command", "prompt"]),
-	booleanPassthroughFields: [{
-		canonical: "enabled",
-		tool: "enabled"
-	}]
+const CORTEXCODE_SPEC = {
+	displayName: "Cortex Code",
+	overrideKey: "cortexcode",
+	converterConfig: {
+		supportedEvents: CORTEXCODE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CORTEXCODE_EVENT_NAMES,
+		toolToCanonicalEventNames: CORTEXCODE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CORTEX_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command", "prompt"]),
+		booleanPassthroughFields: [{
+			canonical: "enabled",
+			tool: "enabled"
+		}]
+	}
 };
 /**
-* Single spelling of the settings/hooks codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Cortex Code settings with
-* generated output.
-*/
-function parseCortexcodeSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
 * Snowflake Cortex Code hooks.
 *
 * Hooks live under the top-level `hooks` key of `<project>/.cortex/settings.json`
@@ -23658,20 +23661,16 @@ function parseCortexcodeSettings(fileContent, filePath) {
 * "<regex>", "hooks": [{ "type": "command" | "prompt", ..., "timeout"?:
 * <seconds>, "enabled"?: <boolean> }] }] }`. The project file also holds
 * settings rulesync does not own, so generation merges the `hooks` key into
-* either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
+* either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it, and
+* neither file is removed wholesale (hooks.json sits in the CLI-owned
+* `~/.snowflake/cortex/` tree).
 *
 * @see https://docs.snowflake.com/en/user-guide/cortex-code/extensibility
 * @see https://docs.snowflake.com/en/user-guide/cortex-code/settings
 */
-var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
+var CortexcodeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CORTEXCODE_SPEC;
 	}
 	static getSettablePaths({ global = false } = {}) {
 		return global ? {
@@ -23682,60 +23681,338 @@ var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
 			relativeFilePath: CORTEXCODE_SETTINGS_FILE_NAME
 		};
 	}
+};
+//#endregion
+//#region src/constants/crush-paths.ts
+const CRUSH_RULE_FILE_NAME = "CRUSH.md";
+const CRUSH_GLOBAL_DIR = (0, node_path.join)(".config", "crush");
+const CRUSH_LOCAL_RULE_FILE_NAME = "CRUSH.local.md";
+const CRUSH_IGNORE_FILE_NAME = ".crushignore";
+const CRUSH_SKILLS_PROJECT_DIR = (0, node_path.join)(".crush", "skills");
+const CRUSH_SKILLS_GLOBAL_DIR = (0, node_path.join)(CRUSH_GLOBAL_DIR, "skills");
+const CRUSH_CONFIG_FILE_NAME = "crush.json";
+const CRUSH_HIDDEN_CONFIG_FILE_NAME = ".crush.json";
+const CRUSH_PERMISSIONS_KEY = "permissions";
+const CRUSH_ALLOWED_TOOLS_KEY = "allowed_tools";
+const CRUSH_OPTIONS_KEY = "options";
+const CRUSH_DISABLED_TOOLS_KEY = "disabled_tools";
+const CRUSH_HOOKS_KEY = "hooks";
+//#endregion
+//#region src/features/crush-config.ts
+/**
+* Where Crush's JSON config lives for a scope, before the project-scope twin
+* is resolved: `<project>/crush.json` or `~/.config/crush/crush.json`. This is
+* also the key every adapter reports through `getSettablePaths`, so the
+* shared-config ownership declaration, the gitignore derivation and the
+* shared-write ordering all see one file per scope.
+*/
+function getCrushConfigSettablePaths({ global = false } = {}) {
+	return {
+		relativeDirPath: global ? CRUSH_GLOBAL_DIR : ".",
+		relativeFilePath: CRUSH_CONFIG_FILE_NAME
+	};
+}
+/**
+* Resolves which Crush config file an adapter should read and write.
+*
+* At project scope Crush discovers both `.crush.json` and `crush.json` in the
+* working directory and merges every file it finds with `.crush.json` on top
+* (objects merge recursively, lists are concatenated, scalars are overridden).
+* Neither file therefore hides the other: an entry left in `crush.json` stays
+* in effect next to whatever `.crush.json` says. An existing `.crush.json` is
+* preferred because the user chose that spelling; otherwise `crush.json` is
+* used (and created when neither exists). The global scope has a single
+* spelling.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+async function resolveCrushConfigFile({ outputRoot, global = false }) {
+	const paths = getCrushConfigSettablePaths({ global });
+	const configDir = (0, node_path.join)(outputRoot, paths.relativeDirPath);
+	const filePath = (0, node_path.join)(configDir, paths.relativeFilePath);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (!global) {
+		const hiddenPath = (0, node_path.join)(configDir, CRUSH_HIDDEN_CONFIG_FILE_NAME);
+		const hiddenContent = await readFileContentOrNull(hiddenPath);
+		if (hiddenContent !== null) return {
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: CRUSH_HIDDEN_CONFIG_FILE_NAME,
+			filePath: hiddenPath,
+			fileContent: hiddenContent,
+			...fileContent === null ? {} : { twin: {
+				filePath,
+				fileContent
+			} }
+		};
+	}
+	return {
+		relativeDirPath: paths.relativeDirPath,
+		relativeFilePath: paths.relativeFilePath,
+		filePath,
+		fileContent
+	};
+}
+/**
+* Single spelling of the crush.json codec/policy, matching the
+* `SHARED_CONFIG_OWNERSHIP` declaration for both scopes: fail closed on an
+* unparseable root rather than replacing the user's Crush config with
+* generated output.
+*/
+function parseCrushConfig(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "json",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Combine two Crush config documents the way Crush itself does
+* (`github.com/qjebbs/go-jsons`): objects merge recursively, arrays are
+* concatenated with `base` first, and any other value from `override` wins.
+*/
+function mergeCrushConfigs({ base, override }) {
+	const merged = { ...base };
+	for (const [key, value] of Object.entries(override)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const current = merged[key];
+		if (isRecord$1(current) && isRecord$1(value)) merged[key] = mergeCrushConfigs({
+			base: current,
+			override: value
+		});
+		else if (Array.isArray(current) && Array.isArray(value)) merged[key] = [...current, ...value];
+		else merged[key] = value;
+	}
+	return merged;
+}
+/**
+* The content an import should read for a resolved location: the chosen file
+* merged over its twin when both exist, so a server, hook or tool entry that
+* only the lower-priority `crush.json` declares is imported too — Crush sees
+* it, so rulesync should as well.
+*/
+function crushConfigImportContent(location) {
+	const own = location.fileContent ?? "{}";
+	if (location.twin === void 0) return own;
+	const merged = mergeCrushConfigs({
+		base: parseCrushConfig(location.twin.fileContent, location.twin.filePath),
+		override: parseCrushConfig(own, location.filePath)
+	});
+	return JSON.stringify(merged, null, 2);
+}
+function lookupPath(root, path) {
+	let current = root;
+	for (const segment of path) {
+		if (!isRecord$1(current) || !Object.hasOwn(current, segment)) return;
+		current = current[segment];
+	}
+	return current;
+}
+function isNonEmptyValue(value) {
+	if (Array.isArray(value)) return value.length > 0;
+	if (isRecord$1(value)) return Object.keys(value).length > 0;
+	return value !== void 0;
+}
+/**
+* Warn when the twin Crush merges beneath the written file still carries a
+* value at one of the paths this feature owns. Rulesync only rewrites the
+* chosen file, and because Crush concatenates lists and merges objects across
+* the pair, such an entry — typically one an earlier generate wrote to
+* `crush.json` before the user added a `.crush.json` — stays in effect until
+* removed by hand, and cannot be retracted from `.rulesync/`.
+*/
+function warnCrushTwinLeftovers({ location, ownedPaths, logger }) {
+	if (location.twin === void 0) return;
+	let twin;
+	try {
+		twin = parseCrushConfig(location.twin.fileContent, location.twin.filePath);
+	} catch {
+		return;
+	}
+	const leftovers = ownedPaths.filter((path) => isNonEmptyValue(lookupPath(twin, path))).map((path) => `"${path.join(".")}"`);
+	if (leftovers.length === 0) return;
+	logger?.warn(`Crush merges ${location.twin.filePath} beneath ${location.filePath} (objects recursively, lists concatenated), so the ${leftovers.join(", ")} entries it still carries stay in effect and are not managed by rulesync; remove them from that file by hand.`);
+}
+//#endregion
+//#region src/features/hooks/crush-hooks.ts
+const SUPPORTED_CRUSH_EVENTS = new Set(CRUSH_HOOK_EVENTS);
+/**
+* Crush matches an event key case-insensitively and ignores underscores
+* (`PreToolUse`, `pre_tool_use` and `PRE_TOOL_USE` all work), so an import
+* looks the canonical name up by that normalized spelling.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+const NORMALIZED_CRUSH_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CRUSH_TO_CANONICAL_EVENT_NAMES).map(([crushEvent, canonical]) => [normalizeCrushEventName(crushEvent), canonical]));
+function normalizeCrushEventName(event) {
+	return event.replaceAll("_", "").toLowerCase();
+}
+/**
+* Build the `hooks` block of `crush.json` from a canonical hooks config.
+* Crush keys a flat array of `{name, matcher, command, timeout}` entries by
+* event name; `matcher` is a regex tested against the (lower-case) Crush tool
+* name and `timeout` is in seconds. Only `type: "command"` canonical hooks are
+* emitted, since a Crush hook is a shell command. A shared canonical event
+* Crush does not fire is skipped (the HooksProcessor reports it), while an
+* event under the `crush.hooks` override — such as one an import filed there
+* — is written verbatim so it round-trips.
+*/
+function canonicalToCrushHooks({ config, toolOverride, logger }) {
+	const sharedHooks = {};
+	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_CRUSH_EVENTS.has(event)) sharedHooks[event] = defs;
+	const effective = {
+		...sharedHooks,
+		...toolOverride
+	};
+	const hooks = {};
+	for (const [event, defs] of Object.entries(effective)) {
+		if (isPrototypePollutionKey(event)) continue;
+		const crushEvent = lookupOwn({
+			record: CANONICAL_TO_CRUSH_EVENT_NAMES,
+			key: event
+		}) ?? event;
+		const entries = [];
+		for (const def of defs) {
+			const entry = canonicalDefToCrushEntry({
+				def,
+				event,
+				logger
+			});
+			if (entry !== null) entries.push(entry);
+		}
+		if (entries.length > 0) hooks[crushEvent] = entries;
+	}
+	return hooks;
+}
+/** Convert one canonical hook definition to a Crush entry, or null to skip. */
+function canonicalDefToCrushEntry({ def, event, logger }) {
+	if ((def.type ?? "command") !== "command") return null;
+	if (typeof def.command !== "string" || def.command === "") {
+		logger?.warn(`Crush hook ${quoteValueForWarning(def.name ?? "")} under "${event}" has no "command", which Crush would discard, so it was skipped.`);
+		return null;
+	}
+	const entry = { command: def.command };
+	if (typeof def.name === "string" && def.name !== "") entry.name = def.name;
+	if (typeof def.matcher === "string" && def.matcher !== "" && def.matcher !== "*") entry.matcher = def.matcher;
+	if (typeof def.timeout === "number") entry.timeout = Math.ceil(def.timeout);
+	return entry;
+}
+/** Convert one raw hook entry to a canonical definition, or null to skip. */
+function crushEntryToCanonicalDef(raw) {
+	if (!isRecord$1(raw) || typeof raw.command !== "string") return null;
+	const def = {
+		type: "command",
+		command: raw.command
+	};
+	if (typeof raw.name === "string" && raw.name !== "") def.name = raw.name;
+	if (typeof raw.matcher === "string" && raw.matcher !== "") def.matcher = raw.matcher;
+	if (typeof raw.timeout === "number") def.timeout = raw.timeout;
+	return def;
+}
+/**
+* Reverse {@link canonicalToCrushHooks}: parse the `hooks` block back into a
+* canonical event → definition[] record. An event Crush does not document is
+* carried under its own name so `buildImportedHooksConfig` files it under the
+* `crush.hooks` override.
+*/
+function crushHooksToCanonical(hooksBlock) {
+	const canonical = {};
+	if (!isRecord$1(hooksBlock)) return canonical;
+	for (const [crushEvent, rawEntries] of Object.entries(hooksBlock)) {
+		if (isPrototypePollutionKey(crushEvent) || !Array.isArray(rawEntries)) continue;
+		const canonicalEvent = lookupOwn({
+			record: NORMALIZED_CRUSH_TO_CANONICAL_EVENT_NAMES,
+			key: normalizeCrushEventName(crushEvent)
+		}) ?? crushEvent;
+		const defs = rawEntries.map((raw) => crushEntryToCanonicalDef(raw)).filter((def) => def !== null);
+		if (defs.length === 0) continue;
+		canonical[canonicalEvent] = [...lookupOwn({
+			record: canonical,
+			key: canonicalEvent
+		}) ?? [], ...defs];
+	}
+	return canonical;
+}
+/**
+* Crush hooks.
+*
+* Crush reads hooks from the `hooks` key of its JSON config —
+* `<project>/crush.json` (or an existing `.crush.json`; Crush merges the pair,
+* lists concatenated) at project scope and `~/.config/crush/crush.json` at
+* user scope — as
+* `hooks.<Event>: [{name?, matcher?, command, timeout?}]`. Only `PreToolUse`
+* fires today. The `hooks` key is owned outright; every other top-level key
+* of the file is preserved and the file is never deleted.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+var CrushHooks = class CrushHooks extends ToolHooks {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseCrushConfig(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = CortexcodeHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new CortexcodeHooks({
+		const location = await resolveCrushConfigFile({
 			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
+			global
+		});
+		return new CrushHooks({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
 		});
 	}
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = CortexcodeHooks.getSettablePaths({ global });
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.cortexcode?.hooks,
-			converterConfig: CORTEXCODE_CONVERTER_CONFIG,
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [[CRUSH_HOOKS_KEY]],
 			logger
 		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
+		const config = rulesyncHooks.getJson();
+		const hooks = canonicalToCrushHooks({
+			config,
+			toolOverride: config.crush?.hooks,
 			logger
 		});
-		return new CortexcodeHooks({
+		return new CrushHooks({
 			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(this.getSettablePaths({ global })),
+				feature: "hooks",
+				existingContent,
+				patch: { [CRUSH_HOOKS_KEY]: hooks },
+				filePath: location.filePath,
+				logger
+			}),
+			validate,
+			global
 		});
 	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseCortexcodeSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Cortex Code hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: CORTEXCODE_CONVERTER_CONFIG
-		});
+	toRulesyncHooks() {
+		const hooks = crushHooksToCanonical(this.json[CRUSH_HOOKS_KEY]);
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey: "cortexcode"
+			overrideKey: "crush"
 		}), null, 2) });
 	}
 	validate() {
@@ -23744,13 +24021,14 @@ var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
 			error: null
 		};
 	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new CortexcodeHooks({
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushHooks({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
+			fileContent: JSON.stringify({ [CRUSH_HOOKS_KEY]: {} }, null, 2),
+			validate: false,
+			global
 		});
 	}
 };
@@ -26984,19 +27262,22 @@ var ReasonixHooks = class ReasonixHooks extends ToolHooks {
 //#endregion
 //#region src/features/hooks/tabnine-hooks.ts
 /**
-* Environment block safe to hand Tabnine for a hook. A tool rebuilds each
-* entry into `KEY=VALUE` for the spawned process, so a key holding `=`, a
-* control character or nothing at all names a different variable than it
-* appears to; such entries are dropped in both directions (with a warning on
-* export, where the value came from an authored `.rulesync/hooks.*`).
+* Environment block safe to hand Tabnine for a hook. The shared converter
+* refuses a whole `env` map holding one bad entry; Tabnine's shape is authored
+* outside it, so the same per-entry rule (`isSafeEnvEntry`: a key holding `=`,
+* a control character or nothing at all names a different variable than it
+* appears to) is applied entry by entry and the bad ones are dropped in both
+* directions, with a warning on export, where the value came from an authored
+* `.rulesync/hooks.*`.
 */
 function sanitizeEnv({ env, warn }) {
 	if (env === null || env === void 0 || typeof env !== "object" || Array.isArray(env)) return;
 	const result = {};
 	for (const [key, value] of Object.entries(env)) {
-		const unsafeKey = key === "" || key.includes("=") || CONTROL_CHARS.some((char) => key.includes(char));
-		const unsafeValue = typeof value !== "string" || CONTROL_CHARS.some((char) => value.includes(char));
-		if (unsafeKey || unsafeValue) {
+		if (!isSafeEnvEntry({
+			key,
+			value
+		})) {
 			warn?.(`Tabnine CLI hook env entry ${JSON.stringify(key)} is not a safe KEY=VALUE pair; skipping it.`);
 			continue;
 		}
@@ -27097,7 +27378,7 @@ const TabnineMatcherEntrySchema = zod_mini.z.looseObject({
 });
 function tabnineMatcherEntryToCanonical(entry) {
 	const sequential = entry.sequential === true;
-	const matcher = entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "" ? entry.matcher : void 0;
+	const matcher = entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "" && entry.matcher !== ".*" ? entry.matcher : void 0;
 	const defs = [];
 	for (const hook of entry.hooks ?? []) {
 		if (hook.type !== "command" || typeof hook.command !== "string" || hook.command === "") continue;
@@ -28139,6 +28420,18 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command", "http"],
 		supportsMatcher: true
 	}],
+	["crush", {
+		class: CrushHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: CRUSH_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
+		supportsMatcher: true,
+		passthroughOverrideEvents: true
+	}],
 	["zcode", {
 		class: ZcodeHooks,
 		meta: {
@@ -28820,14 +29113,6 @@ var ContinueIgnore = class ContinueIgnore extends ToolIgnore {
 	}
 };
 //#endregion
-//#region src/constants/crush-paths.ts
-const CRUSH_RULE_FILE_NAME = "CRUSH.md";
-const CRUSH_GLOBAL_DIR = (0, node_path.join)(".config", "crush");
-const CRUSH_LOCAL_RULE_FILE_NAME = "CRUSH.local.md";
-const CRUSH_IGNORE_FILE_NAME = ".crushignore";
-const CRUSH_SKILLS_PROJECT_DIR = (0, node_path.join)(".crush", "skills");
-const CRUSH_SKILLS_GLOBAL_DIR = (0, node_path.join)(CRUSH_GLOBAL_DIR, "skills");
-//#endregion
 //#region src/features/ignore/crush-ignore.ts
 /**
 * Ignore generator for Crush.
@@ -30714,13 +30999,17 @@ function isRemoteMcpServer(serverConfig) {
 function resolveRemoteMcpUrl(serverConfig) {
 	return serverConfig.url || serverConfig.httpUrl || void 0;
 }
-/** The `command` array a `local` server is spawned with, `args` merged in. */
+/**
+* The `command` array a `local` server is spawned with, `args` merged in. An
+* entry carrying `args` but no `command` comes back empty rather than with
+* `args[0]` promoted to its program: every adapter writes element 0 back out
+* as the executable (or the whole array as the command line), so the caller
+* skips such an entry the same way as one with nothing to spawn at all.
+*/
 function resolveLocalMcpCommand(serverConfig) {
-	const commandArray = [];
-	if (serverConfig.command) {
-		if (Array.isArray(serverConfig.command)) commandArray.push(...serverConfig.command);
-		else commandArray.push(serverConfig.command);
-	}
+	const { command } = serverConfig;
+	const commandArray = Array.isArray(command) ? [...command] : command ? [command] : [];
+	if (commandArray.length === 0) return [];
 	if (serverConfig.args) commandArray.push(...serverConfig.args);
 	return commandArray;
 }
@@ -30730,9 +31019,13 @@ function resolveLocalMcpCommand(serverConfig) {
 * spells the transport out. Writing `{type: "local", command: []}` for it would
 * give the tool a server it cannot start and the importer a file it cannot read
 * back, so it is skipped out loud instead.
+*
+* The server name comes straight from the user's config, so it is quoted
+* through `quoteValueForWarning` rather than interpolated: a crafted name could
+* otherwise carry a line break or control characters into the log.
 */
 function warnAndSkipMcpServer({ toolName, serverName, reason, logger }) {
-	logger?.warn(`${toolName} MCP: skipping "${serverName}" because it declares ${reason}.`);
+	logger?.warn(`${toolName} MCP: skipping ${quoteValueForWarning(serverName)} because it declares ${reason}.`);
 	return null;
 }
 /**
@@ -30820,8 +31113,10 @@ function asBobRemoteType(stated, url) {
 * streamable HTTP server carries `type: "streamable-http"` and `url`, and an
 * SSE server carries a bare `url`. The canonical `transport` alias and the
 * Claude-style `httpUrl` alias are folded into `type`/`url`; `env`, `cwd`,
-* `headers`, `timeout`, `alwaysAllow` and `disabled` pass through unchanged,
-* as Bob documents all of them.
+* `headers`, `timeout`, `alwaysAllow` and `disabled` pass through, as Bob
+* documents all of them, with prototype-pollution keys dropped at every
+* nesting level (Bob spreads `env` and `headers` into the process environment
+* and the HTTP requests).
 *
 * Bob Shell documents the same file with an `httpURL` key instead of
 * `type` + `url` for streamable HTTP. rulesync writes the IDE spelling (the two
@@ -30889,7 +31184,7 @@ function convertToBobFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -30900,7 +31195,9 @@ function convertToBobFormat(mcpServers, logger) {
 * (`type: "streamable-http"` + `url`) is already canonical and passes through;
 * the Bob Shell spelling `httpURL` becomes `url` with `type: "http"`; a bare
 * `url` is an SSE server in Bob, so it gains `type: "sse"` to keep that reading
-* on the next generate.
+* on the next generate. Every other field passes through with its
+* prototype-pollution keys dropped at every nesting level, mirroring the
+* generate side's handling of `env` / `headers`.
 */
 function convertFromBobFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -30915,7 +31212,7 @@ function convertFromBobFormat(mcpServers) {
 				if (typeof value === "string") httpURL = value;
 				continue;
 			}
-			converted[key] = value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		if (httpURL !== void 0) {
 			converted.url = httpURL;
@@ -31763,7 +32060,7 @@ function convertRemoteServer({ serverName, serverConfig, logger }) {
 	return converted;
 }
 function convertStdioServer({ serverName, serverConfig, logger }) {
-	const [command, ...args] = (typeof serverConfig.command === "string" ? serverConfig.command !== "" : Array.isArray(serverConfig.command) && serverConfig.command.length > 0) ? resolveLocalMcpCommand(serverConfig) : [];
+	const [command, ...args] = resolveLocalMcpCommand(serverConfig);
 	if (!command) {
 		warnAndSkipMcpServer({
 			toolName: "Continue",
@@ -31779,7 +32076,7 @@ function convertStdioServer({ serverName, serverConfig, logger }) {
 	};
 	if (args.length > 0) converted.args = args;
 	if (isRecord$1(serverConfig.env)) converted.env = omitPrototypePollutionKeys(serverConfig.env);
-	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server "${serverName}" was not written; put the variables in "env" instead.`);
+	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server ${quoteValueForWarning(serverName)} was not written; put the variables in "env" instead.`);
 	return converted;
 }
 /**
@@ -32321,7 +32618,7 @@ function convertToCortexcodeFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -32330,14 +32627,15 @@ function convertToCortexcodeFormat(mcpServers, logger) {
 /**
 * Convert Cortex Code's server map back to the canonical shape. The
 * documented spelling (`type` + `command`/`url`) is already canonical, so
-* entries pass through with only prototype-pollution keys dropped.
+* entries pass through with only prototype-pollution keys dropped — at every
+* nesting level, mirroring the generate side.
 */
 function convertFromCortexcodeFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
 	const result = {};
 	for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(serverName) || !isRecord$1(serverConfig)) continue;
-		result[serverName] = omitPrototypePollutionKeys(serverConfig);
+		result[serverName] = omitPrototypePollutionKeysDeep(serverConfig);
 	}
 	return result;
 }
@@ -32376,19 +32674,12 @@ var CortexcodeMcp = class CortexcodeMcp extends ToolMcp {
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		if (!global) throw new Error(CORTEXCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const json = parseCortexcodeMcpConfig({
-			fileContent: await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}",
-			relativePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)
-		});
-		const newJson = {
-			...json,
-			mcpServers: json.mcpServers ?? {}
-		};
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}";
 		return new CortexcodeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent,
 			validate,
 			global
 		});
@@ -32436,6 +32727,319 @@ var CortexcodeMcp = class CortexcodeMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/crush-mcp.ts
+/**
+* Crush-only MCP fields with no canonical counterpart, authored under a
+* `crush`-prefixed key in `.rulesync/mcp.jsonc` and written under Crush's own
+* name: `oauth*` drive Crush's OAuth 2.1 flow for HTTP servers and
+* `sessionless` marks a server that issues no `Mcp-Session-Id`.
+* `RulesyncMcp.getMcpServers()` strips both spellings so the client secret
+* never reaches another tool's config; `fromRulesyncMcp` re-merges them from
+* the raw source JSON, honouring the raw Crush spelling as a fallback for an
+* entry copied straight out of a `crush.json` (the `experimental_environment`
+* precedent) — except `oauth`, whose canonical key is Claude Code's
+* `{ clientId }` object and which only `crushOauth` can set.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+const CRUSH_ONLY_KEYS = [
+	{
+		canonical: "crushOauth",
+		crush: "oauth",
+		accepts: (v) => typeof v === "boolean",
+		rawFallback: false
+	},
+	{
+		canonical: "crushOauthClientId",
+		crush: "oauth_client_id",
+		accepts: (v) => typeof v === "string",
+		rawFallback: true
+	},
+	{
+		canonical: "crushOauthClientSecret",
+		crush: "oauth_client_secret",
+		accepts: (v) => typeof v === "string",
+		rawFallback: true
+	},
+	{
+		canonical: "crushOauthCallbackPort",
+		crush: "oauth_callback_port",
+		accepts: (v) => Number.isInteger(v),
+		rawFallback: true
+	},
+	{
+		canonical: "crushSessionless",
+		crush: "sessionless",
+		accepts: (v) => typeof v === "boolean",
+		rawFallback: true
+	}
+];
+/**
+* The Crush-only keys of one raw canonical server entry, keyed by their
+* canonical name, so `convertToCrushFormat` sees them after the shared map
+* stripped them.
+*/
+function readCrushOnlyKeys(rawServer) {
+	const result = {};
+	if (!isRecord$1(rawServer)) return result;
+	for (const { canonical, crush, accepts, rawFallback } of CRUSH_ONLY_KEYS) {
+		const value = accepts(rawServer[canonical]) ? rawServer[canonical] : rawFallback && accepts(rawServer[crush]) ? rawServer[crush] : void 0;
+		if (value !== void 0) result[canonical] = value;
+	}
+	return result;
+}
+function copyCrushOnlyKeys({ from, to }) {
+	for (const { canonical, crush, accepts } of CRUSH_ONLY_KEYS) if (accepts(from[canonical])) to[crush] = from[canonical];
+}
+/**
+* The remote transports Crush's `MCPType` enum accepts, spelled the way it
+* reads them. `streamable-http` is the canonical rulesync name for what Crush
+* calls `http`; a WebSocket server has no Crush transport and is left to the
+* caller to reject.
+*/
+function asCrushRemoteType(stated, url) {
+	if (stated === "sse") return "sse";
+	if (stated === "http" || stated === "streamable-http") return "http";
+	if (stated === void 0) return /^wss?:\/\//i.test(url) ? void 0 : "http";
+}
+/**
+* The transport half of a remote server (`type`, `url`, `headers`), or null
+* when Crush could not reach it and the server was skipped with a warning.
+*/
+function convertRemoteTransport({ name, config, logger }) {
+	const url = resolveRemoteMcpUrl(config);
+	if (!url) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: "a remote transport without a url",
+			logger
+		});
+		return null;
+	}
+	const stated = config.type ?? config.transport;
+	const type = asCrushRemoteType(stated, url);
+	if (type === void 0) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: stated === void 0 ? "a WebSocket url, which Crush's remote transports (http and sse) cannot reach" : `the "${stated}" transport, which Crush does not offer for remote servers (only http and sse)`,
+			logger
+		});
+		return null;
+	}
+	const converted = {
+		type,
+		url
+	};
+	if (config.headers && Object.keys(config.headers).length > 0) converted.headers = config.headers;
+	return converted;
+}
+/**
+* The transport half of a stdio server (`type`, `command`, `args`, `env`), or
+* null when it has no command and was skipped with a warning.
+*/
+function convertStdioTransport({ name, config, logger }) {
+	const [command, ...args] = resolveLocalMcpCommand(config);
+	if (!command) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: "a stdio transport without a command",
+			logger
+		});
+		return null;
+	}
+	const converted = {
+		type: "stdio",
+		command
+	};
+	if (args.length > 0) converted.args = args;
+	if (config.env && Object.keys(config.env).length > 0) converted.env = config.env;
+	return converted;
+}
+/**
+* Convert canonical rulesync servers to the `mcp.<name>` shape of crush.json.
+* `type` is required by Crush's schema, so it is always written: stdio servers
+* carry `type: "stdio"` with `command`/`args`/`env`, remote servers `http` or
+* `sse` with `url` and optional `headers`. `disabled`, the per-server
+* `disabledTools`/`enabledTools` filters (`disabled_tools`/`enabled_tools`)
+* and `timeout` (which Crush reads in seconds) map onto their Crush fields.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+function convertToCrushFormat(mcpServers, logger) {
+	const result = {};
+	for (const [name, config] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!isRecord$1(config)) continue;
+		if (declaresNoTransport(config)) {
+			warnAndSkipMcpServer({
+				toolName: "Crush",
+				serverName: name,
+				reason: "no transport",
+				logger
+			});
+			continue;
+		}
+		const converted = isRemoteMcpServer(config) ? convertRemoteTransport({
+			name,
+			config,
+			logger
+		}) : convertStdioTransport({
+			name,
+			config,
+			logger
+		});
+		if (converted === null) continue;
+		if (config.disabled === true) converted.disabled = true;
+		if (config.disabledTools && config.disabledTools.length > 0) converted.disabled_tools = config.disabledTools;
+		if (config.enabledTools && config.enabledTools.length > 0) converted.enabled_tools = config.enabledTools;
+		if (typeof config.timeout === "number") converted.timeout = Math.ceil(config.timeout);
+		copyCrushOnlyKeys({
+			from: config,
+			to: converted
+		});
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Convert the `mcp.<name>` entries of crush.json back to canonical rulesync
+* servers. `stdio` is Crush's default `type`, so it is dropped (a canonical
+* server with a `command` is stdio already); `http` and `sse` are kept as the
+* canonical transport names; `disabled_tools`/`enabled_tools` become the
+* canonical `disabledTools`/`enabledTools`; the Crush-only OAuth and
+* `sessionless` fields are lifted into their `crush*` authoring keys (a value
+* of the wrong type is dropped, as Crush itself would refuse it), and any
+* other key is kept verbatim so an import preserves what a hand-authored
+* entry declared.
+*/
+function convertFromCrushFormat(crushServers) {
+	const result = {};
+	for (const [name, config] of Object.entries(crushServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const converted = {};
+		for (const [key, value] of Object.entries(config)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			switch (key) {
+				case "type":
+					if (value === "http" || value === "sse") converted.type = value;
+					break;
+				case "disabled_tools":
+					if (isStringArray$2(value)) converted.disabledTools = value;
+					break;
+				case "enabled_tools":
+					if (isStringArray$2(value)) converted.enabledTools = value;
+					break;
+				case "oauth_token": break;
+				default: {
+					const crushOnly = CRUSH_ONLY_KEYS.find((entry) => entry.crush === key);
+					if (crushOnly === void 0) converted[key] = value;
+					else if (crushOnly.accepts(value)) converted[crushOnly.canonical] = value;
+				}
+			}
+		}
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Crush MCP servers.
+*
+* Crush reads MCP servers from the `mcp` key of its JSON config:
+* `<project>/crush.json` (or an existing `.crush.json`; Crush merges the pair,
+* objects recursively) at project scope and `~/.config/crush/crush.json` at
+* user scope. The
+* `crushrc` Bash config that Crush now recommends compiles its `mcp add`
+* builtin into the same `mcp.<name>` entries and overrides the JSON key by
+* key, so a `crushrc` next to the generated file takes precedence. Every
+* other top-level key of the file is preserved; the file is never deleted.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/config/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+var CrushMcp = class CrushMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseCrushConfig(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [["mcp"]],
+			logger
+		});
+		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => [serverName, {
+			...serverConfig,
+			...readCrushOnlyKeys(rulesyncMcp.getRawMcpServer(serverName))
+		}])), logger);
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(this.getSettablePaths({ global })),
+				feature: "mcp",
+				existingContent,
+				patch: { ["mcp"]: converted },
+				filePath: location.filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const converted = convertFromCrushFormat(isRecord$1(this.json["mcp"]) ? this.json["mcp"] : {});
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: converted }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: JSON.stringify({ ["mcp"]: {} }, null, 2),
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/mcp-env-var-format.ts
 /**
 * Canonical rulesync env var reference pattern: `${VAR}` (but not `${env:VAR}`,
@@ -36480,7 +37084,7 @@ function convertToTabnineFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		if (enabledTools !== void 0) converted.includeTools = enabledTools;
 		if (disabledTools !== void 0) converted.excludeTools = disabledTools;
@@ -36491,7 +37095,9 @@ function convertToTabnineFormat(mcpServers, logger) {
 /**
 * Convert Tabnine's server map back to the canonical shape: `includeTools` /
 * `excludeTools` become `enabledTools` / `disabledTools`; `type` (`stdio`,
-* `sse`, `http`) and every other documented field are already canonical.
+* `sse`, `http`) and every other documented field are already canonical and
+* pass through with their prototype-pollution keys dropped at every nesting
+* level, mirroring the generate side.
 */
 function convertFromTabnineFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -36503,7 +37109,7 @@ function convertFromTabnineFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "includeTools") converted.enabledTools = value;
 			else if (key === "excludeTools") converted.disabledTools = value;
-			else converted[key] = value;
+			else converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -37651,6 +38257,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: false
 		}
 	}],
+	["crush", {
+		class: CrushMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: true,
+			supportsDisabledTools: true
+		}
+	}],
 	["cursor", {
 		class: CursorMcp,
 		meta: {
@@ -39082,7 +39697,7 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 function toAntigravityCliToolName(canonical) {
 	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$7(cliName) {
+function toCanonicalToolName$8(cliName) {
 	return ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES[cliName] ?? cliName;
 }
 /**
@@ -39298,7 +39913,7 @@ function convertAntigravityCliToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parsePermissionEntry$1(entry);
-			const canonical = toCanonicalToolName$7(toolName);
+			const canonical = toCanonicalToolName$8(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -39555,11 +40170,34 @@ const CANONICAL_TO_AUGMENT_TOOL_NAMES = {
 	websearch: "web-search"
 };
 const AUGMENT_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENT_TOOL_NAMES).map(([k, v]) => [v, k]));
+const CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES = {
+	terminal: "launch-process",
+	read: "view",
+	edit: "str-replace-editor",
+	write: "save-file"
+};
 function toAugmentToolName(canonical) {
-	return CANONICAL_TO_AUGMENT_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_AUGMENT_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
-function toCanonicalToolName$6(augmentName) {
-	return AUGMENT_TO_CANONICAL_TOOL_NAMES[augmentName] ?? augmentName;
+/**
+* Resolve an existing entry's `toolName` to the legacy spelling rulesync emits, so that the
+* current alias and the legacy name are treated as the same managed tool.
+*/
+function toLegacyAugmentToolName(augmentName) {
+	return lookupOwn({
+		record: CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES,
+		key: augmentName
+	}) ?? augmentName;
+}
+function toCanonicalToolName$7(augmentName) {
+	const legacyName = toLegacyAugmentToolName(augmentName);
+	return lookupOwn({
+		record: AUGMENT_TO_CANONICAL_TOOL_NAMES,
+		key: legacyName
+	}) ?? legacyName;
 }
 function actionToAugmentType(action) {
 	switch (action) {
@@ -39775,10 +40413,11 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 		const generatedKeys = new Set(generated.map((e) => `${e.toolName}|${e.shellInputRegex ?? ""}|${e.permission.type}`));
 		const preservedBasicEntries = basicExistingEntries.filter((entry) => {
 			if (entry.toolName === "*") return false;
-			if (!MANAGED_AUGMENT_TOOL_NAMES.has(entry.toolName)) return true;
+			const legacyToolName = toLegacyAugmentToolName(entry.toolName);
+			if (!MANAGED_AUGMENT_TOOL_NAMES.has(legacyToolName)) return true;
 			if (entry.permission.type === "deny") {
-				const key = `${entry.toolName}|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
-				return !generatedKeys.has(key);
+				const suffix = `|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
+				return !generatedKeys.has(`${entry.toolName}${suffix}`) && !generatedKeys.has(`${legacyToolName}${suffix}`);
 			}
 			return false;
 		});
@@ -40005,14 +40644,15 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 		if (isSpecialEntry(entry)) continue;
 		const type = entry.permission.type;
 		if (!isBasicAugmentType(type)) continue;
-		const canonical = toCanonicalToolName$6(entry.toolName);
+		const legacyToolName = toLegacyAugmentToolName(entry.toolName);
+		const canonical = toCanonicalToolName$7(entry.toolName);
 		if (forbiddenMapKeys.has(canonical)) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because it maps to the reserved object key '${canonical}', which cannot be used as a permission key.`);
 			continue;
 		}
 		const action = augmentTypeToAction(type);
 		let pattern;
-		if (entry.toolName === "launch-process" && entry.shellInputRegex) {
+		if (legacyToolName === "launch-process" && entry.shellInputRegex) {
 			const regex = entry.shellInputRegex;
 			if (isShellRegexRoundtrippable(regex)) pattern = shellRegexToGlob(regex);
 			else if (action === "deny") {
@@ -40027,9 +40667,19 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because its pattern resolves to the reserved object key '${pattern}'.`);
 			continue;
 		}
-		if (!permission[canonical]) permission[canonical] = {};
-		const existing = permission[canonical][pattern];
-		if (existing === void 0 || actionPriority[action] > actionPriority[existing]) permission[canonical][pattern] = action;
+		let bucket = lookupOwn({
+			record: permission,
+			key: canonical
+		});
+		if (bucket === void 0) {
+			bucket = {};
+			permission[canonical] = bucket;
+		}
+		const existing = lookupOwn({
+			record: bucket,
+			key: pattern
+		});
+		if (existing === void 0 || actionPriority[action] > actionPriority[existing]) bucket[pattern] = action;
 	}
 	return { permission };
 }
@@ -40240,7 +40890,7 @@ const CLAUDE_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONIC
 function toClaudeToolName(canonical) {
 	return CANONICAL_TO_CLAUDE_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$5(claudeName) {
+function toCanonicalToolName$6(claudeName) {
 	return CLAUDE_TO_CANONICAL_TOOL_NAMES[claudeName] ?? claudeName;
 }
 /**
@@ -41135,7 +41785,7 @@ function convertClaudeToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseClaudePermissionEntry(entry);
-			const canonical = toCanonicalToolName$5(toolName);
+			const canonical = toCanonicalToolName$6(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -41960,7 +42610,16 @@ function mapBashActionToDecision(action) {
 //#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$4 = "*";
+const CATCH_ALL_PATTERN$5 = "*";
+/**
+* A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
+* would match `Tool(**)` against every argument just as the bare tool name
+* does, so it is written — and, under the all-tools category, honored — as
+* the bare entry instead of being skipped as a pattern-specific rule.
+*/
+function normalizeCatchAllPattern$1(pattern) {
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$5 : pattern;
+}
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
 	read: "Read",
@@ -41988,7 +42647,7 @@ const CONTINUE_PATTERN_RE = /^([^(]+)(?:\(([^)]*)\))?$/;
 function toContinueToolName(canonical) {
 	return Object.hasOwn(CANONICAL_TO_CONTINUE_TOOL_NAMES, canonical) ? CANONICAL_TO_CONTINUE_TOOL_NAMES[canonical] ?? canonical : canonical;
 }
-function toCanonicalToolName$4(continueName) {
+function toCanonicalToolName$5(continueName) {
 	return Object.hasOwn(CONTINUE_TO_CANONICAL_TOOL_NAMES, continueName) ? CONTINUE_TO_CANONICAL_TOOL_NAMES[continueName] ?? continueName : continueName;
 }
 /**
@@ -41996,7 +42655,7 @@ function toCanonicalToolName$4(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$4 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$5 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -42010,7 +42669,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$4 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$5 : pattern
 	};
 }
 /**
@@ -42177,13 +42836,14 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		if (isPrototypePollutionKey(category)) continue;
 		const toolName = category === "*" ? "*" : toContinueToolName(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (isPrototypePollutionKey(pattern)) continue;
+		for (const [rawPattern, action] of Object.entries(rules)) {
+			if (isPrototypePollutionKey(rawPattern)) continue;
+			const pattern = normalizeCatchAllPattern$1(rawPattern);
 			if (pattern.includes("(") || pattern.includes(")")) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$4) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$5) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -42208,7 +42868,7 @@ function convertContinuePermissionsToRulesync(lists) {
 			const parsedEntry = parseContinuePermissionEntry(entry);
 			if (parsedEntry === void 0) continue;
 			if (isPrototypePollutionKey(parsedEntry.toolName) || isPrototypePollutionKey(parsedEntry.pattern)) continue;
-			const category = toCanonicalToolName$4(parsedEntry.toolName);
+			const category = toCanonicalToolName$5(parsedEntry.toolName);
 			permission[category] ??= {};
 			permission[category][parsedEntry.pattern] ??= action;
 		}
@@ -42531,6 +43191,295 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 	}
 };
 //#endregion
+//#region src/features/permissions/crush-permissions.ts
+const CATCH_ALL_PATTERN$4 = "*";
+/**
+* A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
+* argument patterns at all, so it is the only pattern a rule can carry and
+* still be written.
+*/
+function normalizeCatchAllPattern(pattern) {
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$4 : pattern;
+}
+const CANONICAL_TO_CRUSH_TOOL_NAMES = {
+	bash: "bash",
+	read: "view",
+	edit: "edit",
+	write: "write",
+	grep: "grep",
+	glob: "glob",
+	webfetch: "fetch"
+};
+const CRUSH_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_TOOL_NAMES).map(([k, v]) => [v, k]));
+const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const MCP_CRUSH_PREFIX = "mcp_";
+function toCrushToolName(canonical) {
+	if (Object.hasOwn(CANONICAL_TO_CRUSH_TOOL_NAMES, canonical)) return CANONICAL_TO_CRUSH_TOOL_NAMES[canonical] ?? canonical;
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX$4) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
+	return canonical;
+}
+function toCanonicalToolName$4(crushName) {
+	return Object.hasOwn(CRUSH_TO_CANONICAL_TOOL_NAMES, crushName) ? CRUSH_TO_CANONICAL_TOOL_NAMES[crushName] ?? crushName : crushName;
+}
+function isMcpToolName(crushName) {
+	return crushName.startsWith(MCP_CRUSH_PREFIX) && crushName.length > 4;
+}
+function uniq$9(values) {
+	return [...new Set(values)];
+}
+/**
+* Permissions adapter for Crush.
+*
+* Crush has no per-argument permission rules. Its JSON config carries two
+* tool-level lists instead:
+*   - `permissions.allowed_tools`: tools (or `tool:action` pairs) that run
+*     without a permission prompt; everything else prompts.
+*   - `options.disabled_tools`: built-in tools removed from the agent
+*     entirely.
+*
+* Mapping (rulesync canonical -> Crush), catch-all (`*`) rules only:
+*   - `allow` -> an `allowed_tools` entry.
+*   - `deny` -> a `disabled_tools` entry. Crush only filters its built-ins
+*     through that list, so a deny for an MCP tool is reported and skipped
+*     (disable the tool in the MCP server's `disabled_tools` instead).
+*   - `ask` -> nothing (prompting is Crush's default).
+*   - Tool name: `bash` -> `bash`, `read` -> `view`, `edit` -> `edit`,
+*     `write` -> `write`, `grep` -> `grep`, `glob` -> `glob`,
+*     `webfetch` -> `fetch`, `mcp__<server>__<tool>` -> `mcp_<server>_<tool>`;
+*     any other category passes through verbatim.
+*
+* A pattern-specific rule cannot be expressed and is reported and skipped.
+* Because Crush cannot narrow an allowed tool, a category's catch-all `allow`
+* is not written while the same category carries a pattern-specific `deny` or
+* `ask`: the tool keeps prompting (fail closed) rather than being widened to
+* everything. The all-tools `*` category is mirrored onto `bash` by
+* `honorAllToolsOnBash` and otherwise skipped, since Crush has no allow-all
+* or disable-all list.
+*
+* `crush.json` is Crush's main config: entries naming a tool the canonical
+* config does not manage, and every `tool:action` entry (a form rulesync
+* never derives), are preserved verbatim; the managed tools' bare entries
+* are rebuilt, every other key of `permissions` / `options` and of the file is
+* kept, and the file is never deleted. Project scope writes `crush.json`, or
+* an existing `.crush.json`; Crush merges the pair (lists concatenated), so an
+* entry left in the other file stays in effect and is reported.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/config/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+* @see https://github.com/charmbracelet/crush/blob/main/internal/permission/permission.go
+*/
+var CrushPermissions = class CrushPermissions extends ToolPermissions {
+	json;
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+		this.json = parseCrushConfig(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	/**
+	* `crush.json` is Crush's file: rulesync merges into it when it exists but
+	* does not create one that holds nothing of its own — an absent file and an
+	* absent `allowed_tools` both mean "prompt for everything".
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [[CRUSH_PERMISSIONS_KEY, CRUSH_ALLOWED_TOOLS_KEY], [CRUSH_OPTIONS_KEY, CRUSH_DISABLED_TOOLS_KEY]],
+			logger
+		});
+		const existing = parseCrushConfig(existingContent, location.filePath);
+		const existingPermissions = isRecord$1(existing["permissions"]) ? existing[CRUSH_PERMISSIONS_KEY] : void 0;
+		const existingOptions = isRecord$1(existing["options"]) ? existing[CRUSH_OPTIONS_KEY] : void 0;
+		const config = rulesyncPermissions.getJson();
+		const generated = convertRulesyncToCrushLists({
+			config,
+			logger
+		});
+		const managedToolNames = managedCrushToolNames(config);
+		const preservedAllowed = (isStringArray$2(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
+		const preservedDisabled = (isStringArray$2(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
+		const allowedList = uniq$9([...preservedAllowed, ...generated.allowed]);
+		const disabledList = uniq$9([...preservedDisabled, ...generated.disabled]);
+		const patch = {};
+		if (allowedList.length > 0 || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = { [CRUSH_ALLOWED_TOOLS_KEY]: allowedList.length > 0 ? allowedList : void 0 };
+		if (disabledList.length > 0 || existingOptions !== void 0) patch[CRUSH_OPTIONS_KEY] = { [CRUSH_DISABLED_TOOLS_KEY]: disabledList.length > 0 ? disabledList : void 0 };
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(CrushPermissions.getSettablePaths({ global })),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath: location.filePath,
+				logger
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const permissions = isRecord$1(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
+		const options = isRecord$1(this.json["options"]) ? this.json[CRUSH_OPTIONS_KEY] : {};
+		const rulesyncConfig = convertCrushListsToRulesync({
+			allowed: isStringArray$2(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
+			disabled: isStringArray$2(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+/**
+* The Crush tool names the canonical config manages, i.e. the names its
+* categories map to. Entries naming any other tool are the user's and survive
+* a generate. The all-tools `*` category names no Crush tool of its own.
+*/
+function managedCrushToolNames(config) {
+	return new Set(Object.keys(config.permission).filter((category) => category !== "*" && !isPrototypePollutionKey(category)).map((category) => toCrushToolName(category)));
+}
+/**
+* Reduce one category's rules to the single tool-wide action Crush can carry,
+* or undefined when nothing should be written for the tool: no catch-all rule,
+* a catch-all allow next to a narrower deny/ask (Crush cannot narrow an
+* allowed tool, so it keeps prompting instead), or a deny on an MCP tool
+* (`options.disabled_tools` only covers built-ins).
+*/
+function resolveCategoryAction({ category, toolName, rules, logger }) {
+	let catchAllAction;
+	let restricted = false;
+	for (const [rawPattern, action] of Object.entries(rules)) {
+		if (isPrototypePollutionKey(rawPattern)) continue;
+		const pattern = normalizeCatchAllPattern(rawPattern);
+		if (pattern === CATCH_ALL_PATTERN$4) {
+			catchAllAction = action;
+			continue;
+		}
+		logger?.warn(`Crush permissions are tool-wide (no argument patterns), so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
+		if (action !== "allow") restricted = true;
+	}
+	if (catchAllAction === "allow" && restricted) {
+		logger?.warn(`Crush cannot narrow an allowed tool, so "${category}" is not added to permissions.allowed_tools while it carries a pattern-specific deny/ask rule; Crush keeps prompting for "${toolName}".`);
+		return;
+	}
+	if (catchAllAction === "deny" && isMcpToolName(toolName)) {
+		logger?.warn(`Crush's options.disabled_tools only covers built-in tools, so the "deny" rule for "${category}" was skipped; disable the tool through the MCP server's "disabled_tools" instead.`);
+		return;
+	}
+	return catchAllAction;
+}
+/**
+* Convert a rulesync permissions config into Crush's two tool lists.
+*/
+function convertRulesyncToCrushLists({ config, logger }) {
+	const lists = {
+		allowed: [],
+		disabled: []
+	};
+	const actionByTool = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
+		if (isPrototypePollutionKey(category)) continue;
+		if (category === "*") {
+			for (const [rawPattern, action] of Object.entries(rules)) {
+				if (isPrototypePollutionKey(rawPattern)) continue;
+				logger?.warn(`Crush has no allow-all or disable-all tool list, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(rawPattern)}) was skipped.`);
+			}
+			continue;
+		}
+		const toolName = toCrushToolName(category);
+		const catchAllAction = resolveCategoryAction({
+			category,
+			toolName,
+			rules,
+			logger
+		});
+		if (catchAllAction === void 0) continue;
+		const previous = actionByTool.get(toolName);
+		if (previous !== void 0 && previous !== catchAllAction) logger?.warn(`Crush permissions: rules from different categories both resolve to ${quoteValueForWarning(toolName)} with conflicting actions (${previous} and ${catchAllAction}). Both are written; a disabled tool is hidden from the agent regardless of allowed_tools.`);
+		actionByTool.set(toolName, catchAllAction);
+		if (catchAllAction === "allow") lists.allowed.push(toolName);
+		else if (catchAllAction === "deny") lists.disabled.push(toolName);
+	}
+	return {
+		allowed: uniq$9(lists.allowed),
+		disabled: uniq$9(lists.disabled)
+	};
+}
+/**
+* Convert Crush's two tool lists back into a rulesync config. A `tool:action`
+* entry scopes an allow to one action of a tool, which the canonical model
+* cannot express, so it is left out rather than widened to the whole tool.
+*/
+function convertCrushListsToRulesync({ allowed, disabled }) {
+	const permission = {};
+	const bucketFor = (category) => {
+		const own = lookupOwn({
+			record: permission,
+			key: category
+		});
+		if (own !== void 0) return own;
+		const created = {};
+		permission[category] = created;
+		return created;
+	};
+	for (const entry of disabled) {
+		if (entry === "" || isPrototypePollutionKey(entry)) continue;
+		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] = "deny";
+	}
+	for (const entry of allowed) {
+		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
+		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] ??= "allow";
+	}
+	return { permission };
+}
+//#endregion
 //#region src/features/permissions/cursor-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Cursor CLI
@@ -43685,6 +44634,40 @@ function convertDeepagentsToRulesyncPermissions({ allowList }) {
 	return Object.keys(bash).length > 0 ? { permission: { bash } } : { permission: {} };
 }
 //#endregion
+//#region src/features/permissions/single-action-collapse.ts
+/**
+* Strictness order shared by the tools whose permission model evaluates
+* `deny > ask > allow`. Used wherever several canonical rules have to fold
+* into one entry, so the strictest action always wins.
+*/
+const PERMISSION_ACTION_PRIORITY = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Collapse a pattern map to the single action a tool can hold for a scope
+* that has no pattern matcher, using deny > ask > allow precedence.
+*
+* A map without a catch-all grants nothing to unmatched inputs, so an
+* implicit `ask` joins the candidates and a narrow allowlist can never widen
+* into a blanket allow. Returns `undefined` for an empty map; each caller
+* decides what an empty map means for its tool (e.g. emit nothing, or fall
+* back to `deny` when the tool's own default is allow).
+*/
+function collapseRulesToSingleAction({ rules }) {
+	const actions = Object.values(rules);
+	if (actions.length === 0) return;
+	return (Object.hasOwn(rules, "*") ? actions : [...actions, "ask"]).reduce((current, candidate) => PERMISSION_ACTION_PRIORITY[candidate] > PERMISSION_ACTION_PRIORITY[current] ? candidate : current);
+}
+/**
+* Whether a pattern map carries anything beyond the `*` catch-all, i.e.
+* whether collapsing it to a single action loses information worth a warning.
+*/
+function hasPatternSpecificRules(rules) {
+	return Object.keys(rules).some((pattern) => pattern !== "*");
+}
+//#endregion
 //#region src/features/permissions/devin-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names to Devin Local permission
@@ -43694,17 +44677,21 @@ function convertDeepagentsToRulesyncPermissions({ allowList }) {
 * `Write(glob)`, `Exec(prefix)`, and `Fetch(pattern)` — plus MCP tool patterns
 * (`mcp__server__tool`). The canonical `edit` and `write` categories both map
 * onto Devin's single `Write` scope; on import `Write` maps back to `write`, so
-* `edit` rules round-trip as `write` (a lossy but documented collapse). Unknown
+* `edit` rules round-trip as `write` (a lossy but documented collapse). The
+* canonical `websearch` category maps onto the bare `web_search` tool name,
+* accepted in the permission lists since CLI v3000.10.21 (2026-09-10). Unknown
 * names (e.g. `mcp__github__list_issues`) pass through verbatim.
 *
 * @see https://docs.devin.ai/cli/reference/permissions
+* @see https://docs.devin.ai/cli/changelog/stable — v3000.10.21, `web_search`
 */
 const CANONICAL_TO_DEVIN_SCOPE = {
 	read: "Read",
 	write: "Write",
 	edit: "Write",
 	bash: "Exec",
-	webfetch: "Fetch"
+	webfetch: "Fetch",
+	websearch: "web_search"
 };
 /**
 * Reverse mapping from Devin scope matchers to rulesync canonical names.
@@ -43713,8 +44700,15 @@ const DEVIN_SCOPE_TO_CANONICAL = {
 	Read: "read",
 	Write: "write",
 	Exec: "bash",
-	Fetch: "webfetch"
+	Fetch: "webfetch",
+	web_search: "websearch"
 };
+/**
+* Devin scopes that exist only as a bare tool name: there is no
+* `web_search(pattern)` matcher, so a pattern-specific rule under the canonical
+* category cannot be expressed and is collapsed to one action instead.
+*/
+const DEVIN_BARE_ONLY_SCOPES = /* @__PURE__ */ new Set(["web_search"]);
 function toDevinScope(canonical) {
 	return CANONICAL_TO_DEVIN_SCOPE[canonical] ?? canonical;
 }
@@ -43899,7 +44893,10 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse existing Devin config at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
-		const { allow, ask, deny } = convertRulesyncToDevinPermissions(config);
+		const { allow, ask, deny } = convertRulesyncToDevinPermissions({
+			config,
+			logger
+		});
 		const managedScopes = new Set(Object.keys(config.permission).map((category) => toDevinScope(category)));
 		const existingPermissions = isRecord$1(settings.permissions) ? settings.permissions : {};
 		const preserve = (entries) => (entries ?? []).filter((entry) => !managedScopes.has(parseDevinPermissionEntry(entry).scope));
@@ -44003,26 +45000,50 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	}
 };
 /**
+* Collapse the pattern rules of a bare-only scope to the single action Devin
+* can hold for it, using deny > ask > allow precedence. A map without a
+* catch-all grants nothing to unmatched inputs, so an implicit `ask` joins the
+* candidates and a narrow allowlist can never widen into a blanket allow.
+* Returns `undefined` for an empty map: like any other empty category it
+* emits nothing, which leaves Devin's own auto-approve default in place.
+*/
+function collapseBareOnlyScopeRules({ category, scope, rules, logger }) {
+	const action = collapseRulesToSingleAction({ rules });
+	if (action === void 0) return;
+	if (hasPatternSpecificRules(rules)) logger?.warn(`Devin accepts "${scope}" only as a bare tool name, with no pattern matcher. Collapsed the "${category}" pattern rules to "${action}" using deny > ask > allow precedence.`);
+	return action;
+}
+/**
 * Convert rulesync permissions config to Devin allow/ask/deny arrays.
 */
-function convertRulesyncToDevinPermissions(config) {
+function convertRulesyncToDevinPermissions({ config, logger }) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
+	const push = (entry, action) => {
+		switch (action) {
+			case "allow":
+				allow.push(entry);
+				break;
+			case "ask":
+				ask.push(entry);
+				break;
+			case "deny": deny.push(entry);
+		}
+	};
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const scope = toDevinScope(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			const entry = buildDevinPermissionEntry(scope, pattern);
-			switch (action) {
-				case "allow":
-					allow.push(entry);
-					break;
-				case "ask":
-					ask.push(entry);
-					break;
-				case "deny": deny.push(entry);
-			}
+		if (DEVIN_BARE_ONLY_SCOPES.has(scope)) {
+			const action = collapseBareOnlyScopeRules({
+				category,
+				scope,
+				rules,
+				logger
+			});
+			if (action !== void 0) push(scope, action);
+			continue;
 		}
+		for (const [pattern, action] of Object.entries(rules)) push(buildDevinPermissionEntry(scope, pattern), action);
 	}
 	return {
 		allow,
@@ -46268,20 +47289,14 @@ const OPENCODE_ACTION_ONLY_PERMISSION_KEYS = /* @__PURE__ */ new Set([
 	"question",
 	"doom_loop"
 ]);
-const PERMISSION_ACTION_PRIORITY = {
-	allow: 0,
-	ask: 1,
-	deny: 2
-};
 function toOpencodePermission({ category, value, logger }) {
 	if (typeof value === "string" || !OPENCODE_ACTION_ONLY_PERMISSION_KEYS.has(category)) return value;
-	const actions = Object.values(value);
-	if (actions.length === 0) {
+	const action = collapseRulesToSingleAction({ rules: value });
+	if (action === void 0) {
 		logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its empty pattern map to "deny" to avoid falling back to OpenCode's default allow behavior.`);
 		return "deny";
 	}
-	const action = (Object.hasOwn(value, "*") ? actions : [...actions, "ask"]).reduce((current, candidate) => PERMISSION_ACTION_PRIORITY[candidate] > PERMISSION_ACTION_PRIORITY[current] ? candidate : current);
-	if (Object.keys(value).some((pattern) => pattern !== "*")) logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its pattern rules to "${action}" using deny > ask > allow precedence.`);
+	if (hasPatternSpecificRules(value)) logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its pattern rules to "${action}" using deny > ask > allow precedence.`);
 	return action;
 }
 /**
@@ -46659,6 +47674,7 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"visible",
 	"eager",
 	"listDirectory",
+	"todoWrite",
 	"workflowsEnabled"
 ];
 const QWEN_OVERRIDE_SECURITY_KEYS = [
@@ -46764,6 +47780,11 @@ const QWEN_OVERRIDE_GROUPS = [{
 			rule: "global-machine-wide",
 			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`list_directory\` tool is registered in this repository.`,
 			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `list_directory` tool is registered for every project on this machine."
+		},
+		todoWrite: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`todo_write\` tool is registered in this repository.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `todo_write` tool is registered for every project on this machine."
 		}
 	}
 }, {
@@ -48570,9 +49591,25 @@ function widenToPrefixGlob(pattern) {
 function toShellEntry(prefix) {
 	return prefix === "" ? SHELL_TOOL_NAME : `${SHELL_TOOL_NAME}(${prefix})`;
 }
-/** The `bash` pattern a `run_shell_command(<prefix>)` entry stands for. */
+/**
+* The `bash` pattern a `run_shell_command(<prefix>)` entry stands for. A
+* prefix Tabnine matches literally, so one an author spelled glob-like
+* (`git *`, `*`) is read as the glob it looks like rather than doubled into
+* `git * *`, which no comparison or warning could make sense of.
+*/
 function toShellPattern(prefix) {
-	return prefix === void 0 || prefix === "" ? "*" : `${prefix} *`;
+	if (prefix === void 0 || prefix === "" || prefix === "*") return "*";
+	return prefix.endsWith(" *") ? prefix : `${prefix} *`;
+}
+/**
+* Whether {@link toShellPattern} read the prefix as a glob: such an entry
+* would never fire on Tabnine as spelled (the prefix is matched literally, so
+* `run_shell_command(git *)` only matches a command line starting with the
+* two characters `git *`), and rulesync writes it back as the prefix the glob
+* denotes — a wider entry that the author is told about.
+*/
+function isGlobSpelledPrefix(prefix) {
+	return prefix !== void 0 && (prefix === "*" || prefix.endsWith(" *"));
 }
 /**
 * Split a `tools.allowed`/`tools.exclude` entry into its tool name and the
@@ -48698,7 +49735,7 @@ function collectTrustAffectingOverrideEntries({ tools, general }) {
 	const allowed = isStringArray$2(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
 	if (allowed.length > 0) entries.push({
 		label: `tools.allowed (${allowed.map(quoteValueForWarning).join(", ")})`,
-		reason: "auto-approves what it names as the override spells it; a non-shell entry has no canonical rule to be checked against"
+		reason: "auto-approves what it names as the override spells it; a non-shell entry is only checked against a whole-tool deny of its tool"
 	});
 	if (Object.hasOwn(tools, SANDBOX_KEY) && isNotTrue(tools[SANDBOX_KEY])) entries.push({
 		label: `tools.sandbox = ${quoteValueForWarning(tools[SANDBOX_KEY])}`,
@@ -48809,6 +49846,54 @@ function buildToolLists({ permission, overrideShellAllowPatterns, logger }) {
 	};
 }
 /**
+* Names the glob-spelled `run_shell_command(...)` override entries that were
+* written as the prefix their glob denotes. Said only for the entries that
+* made it into the list: one that a deny or ask overlaps is announced as
+* withheld by the comparison instead, and one whose glob names no prefix at
+* all is skipped by it.
+*/
+function warnAboutGlobSpelledOverrideEntries({ entries, allowed, logger }) {
+	for (const { entry, pattern } of entries) {
+		const prefix = toShellPrefix(pattern);
+		const written = prefix === void 0 ? void 0 : toShellEntry(prefix);
+		if (written === void 0 || !allowed.includes(written)) continue;
+		warnWithFallback(logger, `Tabnine CLI permissions: read tools.allowed entry ${quoteValueForWarning(entry)} of the tabnine override as the 'bash' allow rule ${quoteValueForWarning(pattern)}; Tabnine matches a prefix literally, so it is written as ${quoteValueForWarning(written)}, which auto-approves every command it covers.`);
+	}
+}
+/**
+* A verbatim override allow naming a tool the canonical block denies is
+* withheld the way a shadowed `bash` allow is: Tabnine never loads an excluded
+* tool whatever `allowed` says, so the entry would only ever contradict the
+* deny it sits beside — and an override is not a way around a canonical rule.
+* Returns the entries that may be written.
+*/
+function withholdDeniedOverrideAllowed({ overrideVerbatimAllowed, exclude, logger }) {
+	const denied = overrideVerbatimAllowed.filter((entry) => {
+		const toolName = parseTabnineEntry(entry)?.toolName;
+		return toolName !== void 0 && exclude.includes(toolName);
+	});
+	if (denied.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: withheld ${denied.length} tools.allowed entry(ies) of the tabnine override (${denied.map(quoteValueForWarning).join(", ")}) that name a tool the canonical block denies; Tabnine never loads an excluded tool, so remove the deny rule from .rulesync/permissions.jsonc to allow it.`);
+	return overrideVerbatimAllowed.filter((entry) => !denied.includes(entry));
+}
+/**
+* The entries of a managed tool that the canonical block did not re-derive are
+* named rather than removed silently. Dropping an exclude loosens the policy,
+* so it is a warning; dropping an allow only brings back Tabnine's confirmation
+* prompt, so it is said at info level for the author who wonders where a
+* hand-written entry went.
+*/
+function reportDroppedManagedEntries({ existingTools, allowedList, excludeList, logger }) {
+	const dropped = (key, list) => (0, es_toolkit.uniq)(isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+		if (list.includes(entry)) return false;
+		const toolName = parseTabnineEntry(entry)?.toolName;
+		return toolName === void 0 || !list.includes(toolName);
+	});
+	const droppedExclude = dropped(EXCLUDE_KEY, excludeList);
+	if (droppedExclude.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: removed ${droppedExclude.length} existing tools.exclude entry(ies) (${droppedExclude.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add a deny rule to .rulesync/permissions.jsonc to keep them.`);
+	const droppedAllowed = dropped(ALLOWED_KEY, allowedList);
+	if (droppedAllowed.length > 0) (logger ?? moduleLogger$1).info(`Tabnine CLI permissions: removed ${droppedAllowed.length} existing tools.allowed entry(ies) (${droppedAllowed.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add an allow rule to .rulesync/permissions.jsonc to keep them.`);
+}
+/**
 * Permissions generator for the Tabnine CLI.
 *
 * Tabnine CLI keeps its tool policy in `.tabnine/agent/settings.json` (project)
@@ -48874,7 +49959,10 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		const config = rulesyncPermissions.getJson();
 		const override = isRecord$1(config.tabnine) ? config.tabnine : {};
 		const { tools: overrideTools, general: overrideGeneral, refused: refusedPaths } = stripRefusedOverridePaths(override);
-		if (refusedPaths.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: refused to write ${refusedPaths.join(", ")} from the tabnine override; Tabnine CLI runs that value as a command or sends its traffic to it, and a permissions file (one that came from 'rulesync fetch' included) must not be able to point it at an executable or a server of its choosing. Set it by hand in ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} if you need it.`);
+		if (refusedPaths.length > 0) {
+			const one = refusedPaths.length === 1;
+			warnWithFallback(logger, `Tabnine CLI permissions: refused to write ${refusedPaths.join(", ")} from the tabnine override; Tabnine CLI runs ${one ? "that value" : "those values"} as a command or sends its traffic there, and a permissions file (one that came from 'rulesync fetch' included) must not be able to point it at an executable or a server of its choosing. Set ${one ? "it" : "them"} by hand in ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} if you need ${one ? "it" : "them"}.`);
+		}
 		const overrideList = (key) => {
 			const value = overrideTools[key];
 			if (value === void 0 || isStringArray$2(value)) return value ?? [];
@@ -48883,10 +49971,17 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		};
 		const overrideShellAllowPatterns = [];
 		const overrideVerbatimAllowed = [];
+		const globSpelledOverrideEntries = [];
 		for (const entry of overrideList(ALLOWED_KEY)) {
 			const parsed = parseTabnineEntry(entry);
-			if (parsed?.toolName === SHELL_TOOL_NAME) overrideShellAllowPatterns.push(toShellPattern(parsed.prefix));
-			else overrideVerbatimAllowed.push(entry);
+			if (parsed?.toolName === SHELL_TOOL_NAME) {
+				const pattern = toShellPattern(parsed.prefix);
+				if (isGlobSpelledPrefix(parsed.prefix)) globSpelledOverrideEntries.push({
+					entry,
+					pattern
+				});
+				overrideShellAllowPatterns.push(pattern);
+			} else overrideVerbatimAllowed.push(entry);
 		}
 		const overrideExclude = overrideList(EXCLUDE_KEY);
 		const { allowed, exclude } = buildToolLists({
@@ -48894,6 +49989,16 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			overrideShellAllowPatterns,
 			logger
 		});
+		warnAboutGlobSpelledOverrideEntries({
+			entries: globSpelledOverrideEntries,
+			allowed,
+			logger
+		});
+		const writableOverrideAllowed = withholdDeniedOverrideAllowed({
+			overrideVerbatimAllowed,
+			exclude,
+			logger
+		});
 		const ignoredOverrideKeys = Object.keys(override).filter((key) => key !== TOOLS_KEY && key !== GENERAL_KEY);
 		if (ignoredOverrideKeys.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: ignored ${ignoredOverrideKeys.length} key(s) of the tabnine override (${ignoredOverrideKeys.map(quoteValueForWarning).join(", ")}); only 'tools' and 'general' are written through the permissions feature.`);
 		const existingTools = this.existingToolsGroup(existingContent);
@@ -48904,7 +50009,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		});
 		const allowedList = (0, es_toolkit.uniq)([
 			...allowed,
-			...overrideVerbatimAllowed,
+			...writableOverrideAllowed,
 			...preservedEntries(ALLOWED_KEY)
 		]);
 		const excludeList = (0, es_toolkit.uniq)([
@@ -48912,12 +50017,12 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			...overrideExclude,
 			...preservedEntries(EXCLUDE_KEY)
 		]);
-		const droppedExcludeEntries = (0, es_toolkit.uniq)(isStringArray$2(existingTools?.[EXCLUDE_KEY]) ? existingTools[EXCLUDE_KEY] : []).filter((entry) => {
-			if (excludeList.includes(entry)) return false;
-			const toolName = parseTabnineEntry(entry)?.toolName;
-			return toolName === void 0 || !excludeList.includes(toolName);
+		reportDroppedManagedEntries({
+			existingTools,
+			allowedList,
+			excludeList,
+			logger
 		});
-		if (droppedExcludeEntries.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: removed ${droppedExcludeEntries.length} existing tools.exclude entry(ies) (${droppedExcludeEntries.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add a deny rule to .rulesync/permissions.jsonc to keep them.`);
 		const tools = {
 			...overrideTools,
 			[ALLOWED_KEY]: allowedList.length > 0 ? allowedList : void 0,
@@ -48931,7 +50036,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			entries: collectTrustAffectingOverrideEntries({
 				tools: {
 					...overrideTools,
-					[ALLOWED_KEY]: overrideVerbatimAllowed
+					[ALLOWED_KEY]: writableOverrideAllowed
 				},
 				general: overrideGeneral
 			}),
@@ -52288,6 +53393,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["crush", {
+		class: CrushPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["cursor", {
 		class: CursorPermissions,
 		meta: {
@@ -58309,6 +59422,183 @@ var PiSkill = class PiSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/constants/pool-paths.ts
+/**
+* Pool (Poolside's coding agent CLI) configuration-layout conventions.
+*
+* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
+* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
+* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
+* path), the project-root `AGENTS.md`, and nested per-directory
+* `AGENTS.md` files from the repository root down through the working
+* directory, deeper files taking precedence. It skips ignored directories
+* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
+*
+* Skills follow the Agent Skills format (`<name>/SKILL.md` bundles). Pool
+* scans `.poolside/skills/` (project) and `~/.config/poolside/skills/`
+* (global) plus the shared `.agents/skills/` / `~/.agents/skills/` roots and
+* the skill directories of other Agent Skills tools; rulesync writes only the
+* Pool-specific roots and leaves the shared ones to their own targets.
+*
+* @see https://docs.poolside.ai/agent-instructions
+* @see https://docs.poolside.ai/skills
+* @see https://github.com/poolsideai/pool
+*/
+/** Project-scoped `.poolside/` directory at the project root. */
+const POOL_DIR = ".poolside";
+/** Global config directory for Pool, relative to the home directory. */
+const POOL_GLOBAL_DIR = (0, node_path.join)(".config", "poolside");
+/** Project skills root, relative to the project root. */
+const POOL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_DIR, "skills");
+/** Global skills root, relative to the home directory. */
+const POOL_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_GLOBAL_DIR, "skills");
+//#endregion
+//#region src/features/skills/pool-skill.ts
+const PoolSkillFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.string()
+});
+/**
+* Represents a Pool (Poolside) skill directory.
+*
+* Pool discovers Agent Skills (`<name>/SKILL.md` bundles, optionally with
+* supporting files) from `.poolside/skills/` (project) and
+* `~/.config/poolside/skills/` (global). It also scans the shared
+* `.agents/skills/` / `~/.agents/skills/` roots and the skill directories of
+* other Agent Skills tools; those belong to their own targets, so this class
+* writes only the two Pool-specific roots and a skill is written exactly once.
+* Pool requires the directory name to equal the frontmatter `name`, otherwise
+* it skips the skill. Unlike adapters that reject such a skill outright, this
+* one warns and still writes it: the directory name is the canonical identity
+* shared with every other target, and Pool merely skips the skill rather than
+* failing, so a hard error here would block the other targets for a
+* Pool-only concern. Import is lenient for the same reason.
+* @see https://docs.poolside.ai/skills
+*/
+var PoolSkill = class PoolSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = POOL_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? POOL_GLOBAL_SKILLS_DIR_PATH : POOL_SKILLS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return PoolSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (!this.mainFile) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = PoolSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const frontmatter = this.getFrontmatter();
+		const rulesyncFrontmatter = {
+			name: frontmatter.name,
+			description: frontmatter.description,
+			targets: ["*"]
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
+		const settablePaths = PoolSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
+		const poolFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description
+		};
+		if (poolFrontmatter.name !== dirName) warnWithFallback(logger, `${stripControlCharacters(toPosixPath((0, node_path.join)(outputRoot, settablePaths.relativeDirPath, dirName, SKILL_FILE_NAME)))}: \`name\` ${quoteForLog(poolFrontmatter.name)} does not match its directory name ${quoteForLog(dirName)}; Pool only loads a skill whose directory name equals its \`name\``);
+		return new PoolSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: poolFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("pool");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: PoolSkill.getSettablePaths
+		});
+		const result = PoolSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${(0, node_path.join)(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		return new PoolSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		const settablePaths = PoolSkill.getSettablePaths({ global });
+		return new PoolSkill({
+			outputRoot,
+			relativeDirPath: relativeDirPath ?? settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/qwencode-skill.ts
 const QwencodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -60195,6 +61485,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["pool", {
+		class: PoolSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodeSkill,
 		meta: {
@@ -65029,7 +66327,7 @@ var RooSubagent = class extends ToolSubagent {
 //#region src/features/subagents/tabnine-subagent.ts
 const TabnineSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
-	description: zod_mini.z.optional(zod_mini.z.string()),
+	description: zod_mini.z.string(),
 	/** "local" (default) runs inside the CLI; "remote" delegates to a Tabnine cloud agent. */
 	kind: zod_mini.z.optional(zod_mini.z.string()),
 	/** Built-in tool names the subagent may use; omitted = every tool. */
@@ -65088,14 +66386,23 @@ var TabnineSubagent = class TabnineSubagent extends ToolSubagent {
 			validate: true
 		});
 	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
 		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
 		const tabnineSection = rulesyncFrontmatter.tabnine ?? {};
-		const tabnineSubagentFrontmatter = {
+		const merged = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...tabnineSection
 		};
+		let description = merged.description;
+		if (description === void 0 || description === "") {
+			description = rulesyncFrontmatter.name ? `${rulesyncFrontmatter.name} subagent` : "subagent";
+			logger?.warn(`Tabnine CLI subagent ${rulesyncSubagent.getRelativeFilePath()} has no description, which Tabnine requires; wrote ${JSON.stringify(description)} as a placeholder.`);
+		}
+		const tabnineSubagentFrontmatter = {
+			...merged,
+			description
+		};
 		const body = rulesyncSubagent.getBody();
 		const fileContent = stringifyFrontmatter(body, tabnineSubagentFrontmatter, { avoidBlockScalars: true });
 		const paths = this.getSettablePaths({ global });
@@ -71358,24 +72665,6 @@ var PiRule = class PiRule extends ToolRule {
 	}
 };
 //#endregion
-//#region src/constants/pool-paths.ts
-/**
-* Pool (Poolside's coding agent CLI) configuration-layout conventions.
-*
-* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
-* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
-* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
-* path), the project-root `AGENTS.md`, and nested per-directory
-* `AGENTS.md` files from the repository root down through the working
-* directory, deeper files taking precedence. It skips ignored directories
-* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
-*
-* @see https://docs.poolside.ai/agent-instructions
-* @see https://github.com/poolsideai/pool
-*/
-/** Global config directory for Pool, relative to the home directory. */
-const POOL_GLOBAL_DIR = (0, node_path.join)(".config", "poolside");
-//#endregion
 //#region src/features/rules/pool-rule.ts
 var PoolRule = class PoolRule extends ToolRule {
 	static getSettablePaths({ global = false } = {}) {