rulesync 16.32.1 → 16.34.0

package/dist/{import-NHZnMc--.cjs → import-9T9fnjNn.cjs}

@@ -444,36 +444,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$340 } = node_path.posix;
+const { join: join$350 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$340(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$350(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$340(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$340(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$350(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$350(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$340(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$350(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -503,6 +503,7 @@ const rulesProcessorToolTargetTuple = [
 	"cline",
 	"codebuddy",
 	"codexcli",
+	"commandcode",
 	"continue",
 	"copilot",
 	"copilotcli",
@@ -579,10 +580,12 @@ const mcpProcessorToolTargetTuple = [
 	"claudecode-legacy",
 	"cline",
 	"codexcli",
+	"commandcode",
 	"continue",
 	"copilot",
 	"copilotcli",
 	"cortexcode",
+	"crush",
 	"cursor",
 	"deepagents",
 	"factorydroid",
@@ -621,6 +624,7 @@ const commandsProcessorToolTargetTuple = [
 	"claudecode-legacy",
 	"cline",
 	"codexcli",
+	"commandcode",
 	"continue",
 	"copilot",
 	"cursor",
@@ -658,6 +662,7 @@ const subagentsProcessorToolTargetTuple = [
 	"claudecode-legacy",
 	"cline",
 	"codexcli",
+	"commandcode",
 	"copilot",
 	"copilotcli",
 	"cortexcode",
@@ -699,6 +704,7 @@ const skillsProcessorToolTargetTuple = [
 	"claudecode-legacy",
 	"cline",
 	"codexcli",
+	"commandcode",
 	"continue",
 	"copilot",
 	"copilotcli",
@@ -719,6 +725,7 @@ const skillsProcessorToolTargetTuple = [
 	"musecode",
 	"opencode",
 	"pi",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"replit",
@@ -745,10 +752,12 @@ const hooksProcessorToolTargetTuple = [
 	"claudecode",
 	"claudecode-plugin",
 	"codexcli",
+	"commandcode",
 	"continue",
 	"copilot",
 	"copilotcli",
 	"cortexcode",
+	"crush",
 	"opencode",
 	"pi",
 	"factorydroid",
@@ -778,9 +787,11 @@ const permissionsProcessorToolTargetTuple = [
 	"claudecode",
 	"cline",
 	"codexcli",
+	"commandcode",
 	"continue",
 	"copilot",
 	"copilotcli",
+	"crush",
 	"cursor",
 	"deepagents",
 	"devin",
@@ -3291,6 +3302,7 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".claude/settings.json",
 	".claude/settings.local.json",
 	".codex/config.toml",
+	".commandcode/settings.json",
 	".continue/settings.json",
 	".copilot/settings.json",
 	".github/copilot/settings.json",
@@ -3308,6 +3320,9 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	"reasonix.toml",
 	".vscode/settings.json",
 	".zed/settings.json",
+	"crush.json",
+	".crush.json",
+	".config/crush/crush.json",
 	"kilo.json",
 	"kilo.jsonc",
 	"opencode.json",
@@ -3512,6 +3527,27 @@ function omitPrototypePollutionKeys(record) {
 	}
 	return sanitized;
 }
+/**
+* Like {@link omitPrototypePollutionKeys}, but recursive: every plain object
+* reachable through the value (directly, or through an array) is copied with
+* its prototype-pollution keys dropped. Scalars and arrays of scalars come back
+* as they are.
+*
+* Use when passing an unknown, user-supplied value through unchanged — an MCP
+* server field a tool documents that rulesync does not model — so a
+* `__proto__` key nested anywhere inside it cannot ride into the generated
+* config, where the consuming tool may merge the object without the same care.
+*/
+function omitPrototypePollutionKeysDeep(value) {
+	if (Array.isArray(value)) return value.map((entry) => omitPrototypePollutionKeysDeep(entry));
+	if (value === null || typeof value !== "object") return value;
+	const sanitized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = omitPrototypePollutionKeysDeep(entry);
+	}
+	return sanitized;
+}
 //#endregion
 //#region src/utils/type-guards.ts
 /**
@@ -4579,6 +4615,14 @@ const VIBE_HOOK_EVENTS = [
 	"stop"
 ];
 /**
+* Hook events supported by Crush.
+*
+* Crush's `hooks` config block currently fires a single event, `PreToolUse`
+* (Claude Code-compatible payload; `matcher` is a regex on the tool name).
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+*/
+const CRUSH_HOOK_EVENTS = ["preToolUse"];
+/**
 * Hook events supported by JetBrains Junie CLI.
 *
 * Junie CLI exposes seven lifecycle events under the `"hooks"` key of
@@ -4916,6 +4960,30 @@ const CANONICAL_TO_CORTEXCODE_EVENT_NAMES = {
 };
 const CORTEXCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CORTEXCODE_EVENT_NAMES).map(([k, v]) => [v, k]));
 /**
+* Hook events supported by Command Code.
+*
+* Command Code reads hooks from the `hooks` key of `.commandcode/settings.json`
+* (project) and `~/.commandcode/settings.json` (user) in the Claude-Code shape.
+* Four events are documented: PreToolUse, PostToolUse, Stop and SessionStart.
+* Only `command` hooks exist; `timeout` is in seconds (default 30, max 600)
+* and `$COMMANDCODE_PROJECT_DIR` resolves to the project root.
+*
+* @see https://commandcode.ai/docs/hooks
+*/
+const COMMANDCODE_HOOK_EVENTS = [
+	"preToolUse",
+	"postToolUse",
+	"stop",
+	"sessionStart"
+];
+const CANONICAL_TO_COMMANDCODE_EVENT_NAMES = {
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	stop: "Stop",
+	sessionStart: "SessionStart"
+};
+const COMMANDCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_COMMANDCODE_EVENT_NAMES).map(([k, v]) => [v, k]));
+/**
 * Hook events supported by the Continue CLI (`cn`).
 *
 * Continue reads a Claude-Code-compatible `hooks` key from
@@ -5121,8 +5189,10 @@ const HooksConfigSchema = zod_mini.z.looseObject({
 	grokcli: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	"kimi-code": zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	zcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
+	crush: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	bob: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	cortexcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
+	commandcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	continue: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	tabnine: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	qwencode: zod_mini.z.optional(zod_mini.z.looseObject({
@@ -5618,6 +5688,13 @@ const VIBE_TO_CANONICAL_EVENT_NAMES = {
 	post_agent_turn: "stop"
 };
 /**
+* Canonical -> Crush event names. Crush spells its events the Claude Code
+* way (`PreToolUse`).
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+*/
+const CANONICAL_TO_CRUSH_EVENT_NAMES = { preToolUse: "PreToolUse" };
+const CRUSH_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_EVENT_NAMES).map(([k, v]) => [v, k]));
+/**
 * Map canonical camelCase event names to Qwen Code PascalCase.
 *
 * Qwen Code reuses the same Claude-style PascalCase event names for the events
@@ -6057,6 +6134,11 @@ const McpServerSchema = zod_mini.z.looseObject({
 	kiroAutoBlock: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	musecodeMode: zod_mini.z.optional(zod_mini.z.enum(["required", "optional"])),
 	rovodevEnableInstructions: zod_mini.z.optional(zod_mini.z.boolean()),
+	crushOauth: zod_mini.z.optional(zod_mini.z.boolean()),
+	crushOauthClientId: zod_mini.z.optional(zod_mini.z.string()),
+	crushOauthClientSecret: zod_mini.z.optional(zod_mini.z.string()),
+	crushOauthCallbackPort: zod_mini.z.optional(zod_mini.z.int()),
+	crushSessionless: zod_mini.z.optional(zod_mini.z.boolean()),
 	headers: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
 	/**
 	* The canonical per-server tool allowlist.
@@ -6130,9 +6212,12 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	claudecode: zod_mini.z.optional(toolScopedMcpSchema),
 	cline: zod_mini.z.optional(toolScopedMcpSchema),
 	codexcli: zod_mini.z.optional(toolScopedMcpSchema),
+	commandcode: zod_mini.z.optional(toolScopedMcpSchema),
 	continue: zod_mini.z.optional(toolScopedMcpSchema),
 	copilot: zod_mini.z.optional(toolScopedMcpSchema),
 	copilotcli: zod_mini.z.optional(toolScopedMcpSchema),
+	cortexcode: zod_mini.z.optional(toolScopedMcpSchema),
+	crush: zod_mini.z.optional(toolScopedMcpSchema),
 	cursor: zod_mini.z.optional(toolScopedMcpSchema),
 	deepagents: zod_mini.z.optional(toolScopedMcpSchema),
 	devin: zod_mini.z.optional(toolScopedMcpSchema),
@@ -6149,7 +6234,6 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	reasonix: zod_mini.z.optional(toolScopedMcpSchema),
 	roo: zod_mini.z.optional(toolScopedMcpSchema),
 	rovodev: zod_mini.z.optional(toolScopedMcpSchema),
-	cortexcode: zod_mini.z.optional(toolScopedMcpSchema),
 	tabnine: zod_mini.z.optional(toolScopedMcpSchema),
 	takt: zod_mini.z.optional(toolScopedMcpSchema),
 	vibe: zod_mini.z.optional(toolScopedMcpSchema),
@@ -6481,6 +6565,15 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 				"musecodeMode",
 				"rovodevEnableInstructions",
 				"enable_instructions",
+				"crushOauth",
+				"crushOauthClientId",
+				"crushOauthClientSecret",
+				"crushOauthCallbackPort",
+				"crushSessionless",
+				"oauth_client_id",
+				"oauth_client_secret",
+				"oauth_callback_port",
+				"sessionless",
 				"enabled"
 			])];
 		}));
@@ -6515,12 +6608,16 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	* Targets that share one output file resolve identically so the shared
 	* file's content never depends on which of them generates last — see
 	* `resolveMcpTarget` for the alias groups (kiro trio, claudecode/-legacy,
-	* and the Antigravity pair).
+	* the Antigravity pair, and the project-scope Claude Code / Command Code
+	* pair, which is why the scope is part of the resolution).
 	*
 	* Returns the same instance when neither mechanism is used.
 	*/
-	forTarget({ toolTarget, logger }) {
-		const { blockKeys, acceptedTargetNames } = resolveMcpTarget({ toolTarget });
+	forTarget({ toolTarget, global = false, logger }) {
+		const { blockKeys, acceptedTargetNames } = resolveMcpTarget({
+			toolTarget,
+			global
+		});
 		const json = this.json;
 		const sharedServers = this.json.mcpServers ?? {};
 		const serverNamesWithTargets = Object.entries(sharedServers).filter(([, serverConfig]) => serverConfig.targets !== void 0).map(([serverName]) => serverName);
@@ -6607,9 +6704,24 @@ const MCP_IGNORED_ALIAS_SOURCE_KEYS = Object.keys(MCP_BLOCK_KEY_ALIASES);
 *   `config`) — so both targets always apply both blocks in a fixed order
 *   (`antigravity-ide` first, `antigravity-cli` second — the CLI block wins
 *   per server on conflict).
-*/
-function resolveMcpTarget({ toolTarget }) {
-	if (toolTarget === "claudecode" || toolTarget === "claudecode-legacy") return {
+* - `claudecode` (and its legacy alias) and `commandcode` share the root
+*   `.mcp.json` in PROJECT mode only (their global files differ:
+*   `~/.claude.json` vs `~/.commandcode/mcp.json`), so in project mode the
+*   three apply the `claudecode` and `commandcode` blocks in that fixed order
+*   (the `commandcode` block wins per server on conflict); in global mode
+*   each reads its own block.
+*/
+function resolveMcpTarget({ toolTarget, global }) {
+	const isClaudecode = toolTarget === "claudecode" || toolTarget === "claudecode-legacy";
+	if (!global && (isClaudecode || toolTarget === "commandcode")) return {
+		blockKeys: ["claudecode", "commandcode"],
+		acceptedTargetNames: /* @__PURE__ */ new Set([
+			"claudecode",
+			"claudecode-legacy",
+			"commandcode"
+		])
+	};
+	if (isClaudecode) return {
 		blockKeys: ["claudecode"],
 		acceptedTargetNames: /* @__PURE__ */ new Set(["claudecode", "claudecode-legacy"])
 	};
@@ -6929,7 +7041,7 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
 * `sandbox`, `sandboxImage`, `disabled`, `visible`, `eager`, `listDirectory`,
-* `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
+* `todoWrite`, `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
 * `allowPrivateNetworkHooks`, `allowedInsecureVoiceBaseUrls`). Qwen Code strips
 * `tools.workflowsEnabled`, `security.allowPrivateNetworkHooks` and
 * `security.allowedInsecureVoiceBaseUrls` out of workspace settings, so generate
@@ -6942,7 +7054,7 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * changes what the file said is reported in either scope, naming what that key
 * decides there — the autonomy and containment
 * controls (`approvalMode`, `autoAccept`, `sandbox`, `sandboxImage`), the
-* registry controls (`disabled`, `visible`, `listDirectory`, and `eager`, which
+* registry controls (`disabled`, `visible`, `listDirectory`, `todoWrite`, and `eager`, which
 * demotes an omitted tool to deferred rather than removing it, replacing rather
 * than merging with the list a higher scope set), the Auto Mode
 * classifier config, and, because these groups are loose objects, any key
@@ -6983,6 +7095,14 @@ const QwencodePermissionsOverrideSchema = zod_mini.z.looseObject({
 * `looseObject` (verbatim passthrough). Both project and global scope are
 * supported.
 *
+* Only `tools` and `general` are written; any other key is ignored with a
+* warning. Within them, the paths Tabnine CLI runs as a command or sends its
+* traffic to — `tools.discoveryCommand`, `tools.callCommand`,
+* `tools.shell.pager`, `tools.sandbox.command`, `general.tabnineHost` and
+* `general.preferredEditor` — are refused with a warning rather than written,
+* so a fetched permissions file cannot point the CLI at an executable or a
+* server of its choosing; set those by hand in `settings.json`.
+*
 * @example
 * { "tools": { "core": ["read_file", "run_shell_command(git)"] },
 *   "general": { "defaultApprovalMode": "plan" } }
@@ -7766,7 +7886,9 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	"antigravity-ide": zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	continue: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	commandcode: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	crush: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
@@ -9487,6 +9609,7 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
 	})),
+	commandcode: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	cortexcode: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	continue: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	tabnine: zod_mini.z.optional(zod_mini.z.looseObject({})),
@@ -12792,6 +12915,26 @@ const ZCODE_USER_CONFIG_DECLARATION = {
 	}
 };
 /**
+* Crush's JSON config, shared by the project (`crush.json` / `.crush.json`)
+* and global (`~/.config/crush/crush.json`) spellings so a policy edit lands
+* on both. See the `SHARED_CONFIG_OWNERSHIP` entries for the key rationale.
+*/
+const CRUSH_CONFIG_DECLARATION = {
+	format: "json",
+	invalidRootPolicy: "error",
+	features: {
+		mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp"]
+		},
+		hooks: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["hooks"]
+		},
+		permissions: { kind: "deep-merge" }
+	}
+};
+/**
 * What the two Claude Code settings files have in common: both are plain JSON,
 * and both validate against the one published schema, which the gateway
 * points every file it writes at. `.claude/settings.local.json` is the same
@@ -13052,6 +13195,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 	},
 	".zcode/config.json": ZCODE_WORKSPACE_CONFIG_DECLARATION,
 	".zcode/cli/config.json": ZCODE_USER_CONFIG_DECLARATION,
+	"crush.json": CRUSH_CONFIG_DECLARATION,
+	".config/crush/crush.json": CRUSH_CONFIG_DECLARATION,
 	".bob/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -13076,6 +13221,20 @@ const SHARED_CONFIG_OWNERSHIP = {
 			ownedKeys: ["hooks"]
 		} }
 	},
+	".commandcode/settings.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["permissions"]
+			}
+		}
+	},
 	".cortex/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -15277,6 +15436,94 @@ var CodexcliCommand = class CodexcliCommand extends ToolCommand {
 	}
 };
 //#endregion
+//#region src/constants/commandcode-paths.ts
+const COMMANDCODE_DIR = ".commandcode";
+const COMMANDCODE_RULE_FILE_NAME = "AGENTS.md";
+const COMMANDCODE_SETTINGS_FILE_NAME = "settings.json";
+const COMMANDCODE_PROJECT_MCP_FILE_NAME = ".mcp.json";
+const COMMANDCODE_GLOBAL_MCP_FILE_NAME = "mcp.json";
+const COMMANDCODE_COMMANDS_DIR_PATH = (0, node_path.join)(COMMANDCODE_DIR, "commands");
+const COMMANDCODE_AGENTS_DIR_PATH = (0, node_path.join)(COMMANDCODE_DIR, "agents");
+const COMMANDCODE_SKILLS_DIR_PATH = (0, node_path.join)(COMMANDCODE_DIR, "skills");
+//#endregion
+//#region src/features/commands/commandcode-command.ts
+/**
+* Custom slash command for Command Code.
+*
+* Command Code reads Markdown files from `.commandcode/commands/` (project)
+* and `~/.commandcode/commands/` (user), naming each command after the file's
+* basename; subdirectories only group the files. The file's full trimmed
+* body is the prompt that runs — YAML frontmatter is not stripped, only
+* skipped when the slash menu picks a summary line — so rulesync writes the
+* bare body. On import a hand-written file's frontmatter block is dropped
+* (Command Code would send it as prompt text; a rulesync command carries its
+* own frontmatter) and only the body is kept.
+*
+* @see https://commandcode.ai/docs/custom-slash-commands
+*/
+var CommandcodeCommand = class CommandcodeCommand extends ToolCommand {
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: COMMANDCODE_COMMANDS_DIR_PATH };
+	}
+	toRulesyncCommand() {
+		return new RulesyncCommand({
+			outputRoot: process.cwd(),
+			frontmatter: { targets: ["*"] },
+			body: this.getFileContent(),
+			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.relativeFilePath,
+			fileContent: this.getFileContent(),
+			validate: true
+		});
+	}
+	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true }) {
+		const paths = this.getSettablePaths();
+		return new CommandcodeCommand({
+			outputRoot,
+			fileContent: rulesyncCommand.getBody(),
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
+			validate
+		});
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	getBody() {
+		return this.getFileContent();
+	}
+	static isTargetedByRulesyncCommand(rulesyncCommand) {
+		return this.isTargetedByRulesyncCommandDefault({
+			rulesyncCommand,
+			toolTarget: "commandcode"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true }) {
+		const paths = this.getSettablePaths();
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const { body: content } = parseFrontmatter(await readFileContent(filePath), filePath);
+		return new CommandcodeCommand({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			fileContent: content.trim(),
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new CommandcodeCommand({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/constants/continue-paths.ts
 const CONTINUE_DIR = ".continue";
 const CONTINUE_ROOT_RULE_FILE_NAME = "AGENTS.md";
@@ -18901,15 +19148,12 @@ var TabnineCommand = class TabnineCommand extends ToolCommand {
 		return this.body;
 	}
 	getFrontmatter() {
-		return {
-			description: this.frontmatter.description,
-			prompt: this.frontmatter.prompt
-		};
+		return this.frontmatter;
 	}
 	toRulesyncCommand() {
 		const { description, prompt: _prompt, ...restFields } = this.frontmatter;
 		const rulesyncFrontmatter = {
-			targets: ["tabnine"],
+			targets: ["*"],
 			description,
 			...Object.keys(restFields).length > 0 && { tabnine: restFields }
 		};
@@ -19523,6 +19767,16 @@ const toolCommandFactories = /* @__PURE__ */ new Map([
 			supportsSubdirectory: false
 		}
 	}],
+	["commandcode", {
+		class: CommandcodeCommand,
+		meta: {
+			extension: "md",
+			supportsProject: true,
+			supportsGlobal: true,
+			isSimulated: false,
+			supportsSubdirectory: true
+		}
+	}],
 	["continue", {
 		class: ContinueCommand,
 		meta: {
@@ -20872,7 +21126,20 @@ function stableJson(value) {
 */
 function isSafeStringRecord(value) {
 	if (!isPlainObject$1(value) || !isStringRecord(value)) return false;
-	return Object.entries(value).every(([key, entry]) => key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || entry.includes(char)));
+	return Object.entries(value).every(([key, entry]) => isSafeEnvEntry({
+		key,
+		value: entry
+	}));
+}
+/**
+* Whether one `env` entry survives the rule {@link isSafeStringRecord} applies
+* to the whole map. Exported for the adapters that hand a tool an environment
+* block outside the shared converter (Tabnine, whose hook shape it does not
+* express) so they drop the same entries this one does.
+*/
+function isSafeEnvEntry(entry) {
+	const { key, value } = entry;
+	return typeof value === "string" && key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || value.includes(char));
 }
 /**
 * Control characters cannot ride from an existing tool config into a canonical
@@ -21763,135 +22030,6 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hooks/bob-hooks.ts
-const BOB_CONVERTER_CONFIG = {
-	supportedEvents: BOB_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_BOB_EVENT_NAMES,
-	toolToCanonicalEventNames: BOB_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "",
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"sessionStart",
-		"beforeSubmitPrompt",
-		"stop"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
-	wildcardMatcherMeansAll: true
-};
-/**
-* Single spelling of the settings.json codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Bob settings with
-* generated output.
-*/
-function parseBobSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
-* IBM Bob lifecycle hooks.
-*
-* Hooks live under the top-level `hooks` key of Bob's settings file —
-* `<project>/.bob/settings.json` (project scope) and
-* `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
-* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
-* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
-* settings rulesync does not own, so generation merges the `hooks` key into it
-* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
-*
-* @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
-*/
-var BobHooks = class BobHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
-	}
-	static getSettablePaths({ global = false } = {}) {
-		return {
-			relativeDirPath: global ? BOB_GLOBAL_SETTINGS_DIR_PATH : BOB_DIR,
-			relativeFilePath: BOB_SETTINGS_FILE_NAME
-		};
-	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = BobHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = BobHooks.getSettablePaths({ global });
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.bob?.hooks,
-			converterConfig: BOB_CONVERTER_CONFIG,
-			logger
-		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
-			logger
-		});
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseBobSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Bob hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: BOB_CONVERTER_CONFIG
-		});
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
-			hooks,
-			overrideKey: "bob"
-		}), null, 2) });
-	}
-	validate() {
-		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new BobHooks({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
-		});
-	}
-};
-//#endregion
 //#region src/features/hooks/preserve-unowned-hook-commands.ts
 /**
 * Read the `hooks` value from a destination JSON file.
@@ -22178,75 +22316,22 @@ function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
 }
 //#endregion
-//#region src/features/hooks/claudecode-hooks.ts
-const CLAUDE_CONVERTER_CONFIG = {
-	supportedEvents: CLAUDE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CLAUDE_EVENT_NAMES,
-	toolToCanonicalEventNames: CLAUDE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CLAUDE_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"worktreeCreate",
-		"worktreeRemove",
-		"messageDisplay",
-		"postToolBatch",
-		"taskCreated",
-		"taskCompleted",
-		"teammateIdle",
-		"cwdChanged",
-		"beforeSubmitPrompt",
-		"stop"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set([
-		"command",
-		"prompt",
-		"http",
-		"mcp_tool",
-		"agent"
-	]),
-	emitsPromptModel: true,
-	stringPassthroughFields: [
-		{
-			canonical: "if",
-			tool: "if"
-		},
-		{
-			canonical: "statusMessage",
-			tool: "statusMessage"
-		},
-		{
-			canonical: "shell",
-			tool: "shell",
-			commandOnly: true
-		}
-	],
-	booleanPassthroughFields: [
-		{
-			canonical: "once",
-			tool: "once"
-		},
-		{
-			canonical: "async",
-			tool: "async",
-			commandOnly: true
-		},
-		{
-			canonical: "asyncRewake",
-			tool: "asyncRewake",
-			commandOnly: true
-		},
-		{
-			canonical: "continueOnBlock",
-			tool: "continueOnBlock"
-		}
-	],
-	arrayPassthroughFields: [{
-		canonical: "args",
-		tool: "args",
-		commandOnly: true
-	}]
-};
-var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
+//#region src/features/hooks/settings-json-hooks.ts
+/**
+* Shared implementation for the tools whose hooks live under the top-level
+* `hooks` key of a JSON settings file in Claude Code's shape —
+* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command", ... }] }] }`
+* — and whose file also holds settings rulesync does not own, so generation
+* merges the `hooks` key into it (see `SHARED_CONFIG_OWNERSHIP`) instead of
+* overwriting it, and `--delete` never removes the file wholesale.
+*
+* A concrete adapter supplies its {@link SettingsJsonHooksSpec} and its
+* settable paths; the event mapping, the matcher rules and the per-hook
+* fields the tool documents are all expressed in the spec's converter config.
+* An adapter that also supports preserving unowned hooks (Claude Code) opts in
+* through {@link ToolHooks.supportsPreserveUnowned}.
+*/
+var SettingsJsonHooks = class extends ToolHooks {
 	constructor(params) {
 		super({
 			...params,
@@ -22256,24 +22341,42 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 	isDeletable() {
 		return false;
 	}
+	/** The tool-specific half of the adapter. Every concrete class overrides this. */
+	static getSpec() {
+		throw new Error(`${this.name} does not define getSpec()`);
+	}
 	/**
-	* The converter config used for both directions. Exposed as a static hook so
-	* plugin-scoped subclasses can swap tool-specific details (e.g. the project
-	* directory variable) without duplicating the rest of the config.
+	* The converter config used for both directions. A separate hook so a
+	* subclass can swap tool-specific details (e.g. the project directory
+	* variable) without redefining the whole spec.
 	*/
 	static getConverterConfig() {
-		return CLAUDE_CONVERTER_CONFIG;
+		return this.getSpec().converterConfig;
 	}
 	static getSettablePaths(_options = {}) {
-		return {
-			relativeDirPath: CLAUDECODE_DIR,
-			relativeFilePath: CLAUDECODE_SETTINGS_FILE_NAME
-		};
+		throw new Error(`${this.name} does not define getSettablePaths()`);
+	}
+	/**
+	* The `SHARED_CONFIG_OWNERSHIP` key the settings file is merged under. By
+	* default it is derived from the settable paths; an adapter whose file is
+	* declared under another tool's key (the Claude Code plugin bundle) overrides
+	* it.
+	*/
+	static getSharedFileKey(paths) {
+		return sharedConfigFileKey(paths);
+	}
+	/**
+	* `new this(params)` for the concrete adapter the static method was called
+	* on; the cast is what an abstract class needs to be constructed through
+	* `this`, and lives in one place.
+	*/
+	static instantiate(params) {
+		return new this(params);
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -22281,40 +22384,41 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 			validate
 		});
 	}
-	static supportsPreserveUnowned() {
-		return true;
-	}
 	static async getAuxiliaryFiles({ toolHooks } = {}) {
-		return toolHooks instanceof ClaudecodeHooks ? toolHooks.getOwnershipLockFiles() : [];
+		return toolHooks instanceof this ? toolHooks.getOwnershipLockFiles() : [];
 	}
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		const config = rulesyncHooks.getJson();
-		const claudeHooks = canonicalToToolHooks({
+		const generatedHooks = canonicalToToolHooks({
 			config,
-			toolOverrideHooks: config.claudecode?.hooks,
+			toolOverrideHooks: overrideHooksOf({
+				config,
+				overrideKey: this.getSpec().overrideKey
+			}),
 			converterConfig: this.getConverterConfig(),
 			logger
 		});
 		const preserving = preserveUnowned && this.supportsPreserveUnowned();
 		const merged = mergeGeneratedHookLists({
 			existingContent,
-			generatedHooks: claudeHooks,
+			generatedHooks,
 			shape: "matcher-groups",
 			preserveUnowned: preserving,
 			previouslyOwned: preserving ? parseHooksOwnershipLock(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0,
 			logger
 		});
 		const fileContent = applySharedConfigPatch({
-			fileKey: CLAUDE_SETTINGS_SHARED_FILE_KEY,
+			fileKey: this.getSharedFileKey(paths),
 			feature: "hooks",
 			existingContent,
 			patch: { hooks: merged.hooks },
-			filePath
+			filePath,
+			logger
 		});
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -22324,20 +22428,29 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		});
 	}
 	toRulesyncHooks({ logger } = {}) {
+		const ctor = this.constructor;
+		const spec = ctor.getSpec();
+		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
 		let settings;
 		try {
-			settings = JSON.parse(this.getFileContent());
+			settings = parseSharedConfig({
+				format: "json",
+				fileContent: this.getFileContent(),
+				filePath: configPath,
+				invalidRootPolicy: "error"
+			});
 		} catch (error) {
-			throw new Error(`Failed to parse Claude hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+			const reason = error instanceof Error && error.cause instanceof Error ? error.cause : error;
+			throw new Error(`Failed to parse ${spec.displayName} hooks content in ${configPath}: ${formatError(reason)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
+			logger,
 			hooks: settings.hooks,
-			converterConfig: this.constructor.getConverterConfig(),
-			logger
+			converterConfig: ctor.getConverterConfig()
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey: "claudecode"
+			overrideKey: spec.overrideKey
 		}), null, 2) });
 	}
 	validate() {
@@ -22347,7 +22460,7 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		};
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new this({
+		return this.instantiate({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
@@ -22356,6 +22469,158 @@ var ClaudecodeHooks = class ClaudecodeHooks extends ToolHooks {
 		});
 	}
 };
+/**
+* The `hooks` map of a tool's override block (`config.<overrideKey>.hooks`),
+* or `undefined` when the block states none. The schema keeps every override
+* block loose, so the lookup goes through the record form.
+*/
+function overrideHooksOf({ config, overrideKey }) {
+	const override = lookupOwn({
+		record: config,
+		key: overrideKey
+	});
+	if (!isPlainObject$1(override)) return;
+	const hooks = override.hooks;
+	return isPlainObject$1(hooks) ? hooks : void 0;
+}
+//#endregion
+//#region src/features/hooks/bob-hooks.ts
+const BOB_SPEC = {
+	displayName: "Bob",
+	overrideKey: "bob",
+	converterConfig: {
+		supportedEvents: BOB_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_BOB_EVENT_NAMES,
+		toolToCanonicalEventNames: BOB_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "",
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"sessionStart",
+			"beforeSubmitPrompt",
+			"stop"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+		wildcardMatcherMeansAll: true
+	}
+};
+/**
+* IBM Bob lifecycle hooks.
+*
+* Hooks live under the top-level `hooks` key of Bob's settings file —
+* `<project>/.bob/settings.json` (project scope) and
+* `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
+* `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
+* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
+* settings rulesync does not own, so generation merges the `hooks` key into it
+* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
+*
+* @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
+*/
+var BobHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return BOB_SPEC;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? BOB_GLOBAL_SETTINGS_DIR_PATH : BOB_DIR,
+			relativeFilePath: BOB_SETTINGS_FILE_NAME
+		};
+	}
+};
+//#endregion
+//#region src/features/hooks/claudecode-hooks.ts
+const CLAUDE_SPEC = {
+	displayName: "Claude",
+	overrideKey: "claudecode",
+	converterConfig: {
+		supportedEvents: CLAUDE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CLAUDE_EVENT_NAMES,
+		toolToCanonicalEventNames: CLAUDE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CLAUDE_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"worktreeCreate",
+			"worktreeRemove",
+			"messageDisplay",
+			"postToolBatch",
+			"taskCreated",
+			"taskCompleted",
+			"teammateIdle",
+			"cwdChanged",
+			"beforeSubmitPrompt",
+			"stop"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set([
+			"command",
+			"prompt",
+			"http",
+			"mcp_tool",
+			"agent"
+		]),
+		emitsPromptModel: true,
+		stringPassthroughFields: [
+			{
+				canonical: "if",
+				tool: "if"
+			},
+			{
+				canonical: "statusMessage",
+				tool: "statusMessage"
+			},
+			{
+				canonical: "shell",
+				tool: "shell",
+				commandOnly: true
+			}
+		],
+		booleanPassthroughFields: [
+			{
+				canonical: "once",
+				tool: "once"
+			},
+			{
+				canonical: "async",
+				tool: "async",
+				commandOnly: true
+			},
+			{
+				canonical: "asyncRewake",
+				tool: "asyncRewake",
+				commandOnly: true
+			},
+			{
+				canonical: "continueOnBlock",
+				tool: "continueOnBlock"
+			}
+		],
+		arrayPassthroughFields: [{
+			canonical: "args",
+			tool: "args",
+			commandOnly: true
+		}]
+	}
+};
+var ClaudecodeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CLAUDE_SPEC;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: CLAUDECODE_DIR,
+			relativeFilePath: CLAUDECODE_SETTINGS_FILE_NAME
+		};
+	}
+	/**
+	* Every Claude-shaped settings file rulesync writes for Claude Code — the
+	* project and user `settings.json` and the plugin bundle's `hooks.json` — is
+	* declared under the one Claude key in `SHARED_CONFIG_OWNERSHIP`.
+	*/
+	static getSharedFileKey(_paths) {
+		return CLAUDE_SETTINGS_SHARED_FILE_KEY;
+	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+};
 //#endregion
 //#region src/features/hooks/claudecode-plugin-hooks.ts
 var ClaudecodePluginHooks = class extends ClaudecodeHooks {
@@ -22882,47 +23147,22 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hooks/continue-hooks.ts
-const CONTINUE_CONVERTER_CONFIG = {
-	supportedEvents: CONTINUE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CONTINUE_EVENT_NAMES,
-	toolToCanonicalEventNames: CONTINUE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CONTINUE_PROJECT_DIR",
+//#region src/features/hooks/commandcode-hooks.ts
+const COMMANDCODE_CONVERTER_CONFIG = {
+	supportedEvents: COMMANDCODE_HOOK_EVENTS,
+	canonicalToToolEventNames: CANONICAL_TO_COMMANDCODE_EVENT_NAMES,
+	toolToCanonicalEventNames: COMMANDCODE_TO_CANONICAL_EVENT_NAMES,
+	projectDirVar: "$COMMANDCODE_PROJECT_DIR",
 	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"beforeSubmitPrompt",
-		"stop",
-		"teammateIdle",
-		"taskCompleted",
-		"worktreeCreate",
-		"worktreeRemove"
-	]),
-	supportedHookTypes: /* @__PURE__ */ new Set([
-		"command",
-		"prompt",
-		"http",
-		"agent"
-	]),
-	emitsPromptModel: true,
-	stringPassthroughFields: [{
-		canonical: "statusMessage",
-		tool: "statusMessage"
-	}],
-	booleanPassthroughFields: [{
-		canonical: "once",
-		tool: "once"
-	}, {
-		canonical: "async",
-		tool: "async",
-		commandOnly: true
-	}]
+	noMatcherEvents: /* @__PURE__ */ new Set(["stop", "sessionStart"]),
+	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
 };
 /**
-* Single spelling of the settings/hooks codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Continue settings with
-* generated output.
+* Single spelling of the settings codec/policy: fail closed on an unparseable
+* root rather than replacing the user's Command Code settings with generated
+* output.
 */
-function parseContinueSettings(fileContent, filePath) {
+function parseCommandcodeSettings$1(fileContent, filePath) {
 	return parseSharedConfig({
 		format: "json",
 		fileContent,
@@ -22931,22 +23171,20 @@ function parseContinueSettings(fileContent, filePath) {
 	});
 }
 /**
-* Continue CLI hooks.
+* Command Code hooks.
 *
-* Hooks live under the top-level `hooks` key of `<project>/.continue/settings.json`
-* (project scope) and `~/.continue/settings.json` (user scope), in the
+* Hooks live under the top-level `hooks` key of `<project>/.commandcode/settings.json`
+* (project scope) and `~/.commandcode/settings.json` (user scope), in the
 * Claude-Code shape: `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{
-* "type": "command" | "http" | "prompt" | "agent", ..., "timeout"?: <seconds>
-* }] }] }`. Both files also hold settings rulesync does not own, so generation
-* merges the `hooks` key into the existing file (see `SHARED_CONFIG_OWNERSHIP`)
-* instead of overwriting it. The CLI additionally reads
-* `.continue/settings.local.json` and the Claude Code settings files; rulesync
-* writes only the committable project file and the user file.
+* "type": "command", "command": "...", "timeout"?: <seconds> }] }] }`. Both
+* files also hold settings rulesync does not own (`permissions`, `defaultMode`,
+* ...), so generation merges the `hooks` key into the existing file (see
+* `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
 *
-* @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/hookConfig.ts
-* @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/types.ts
+* @see https://commandcode.ai/docs/hooks
+* @see https://commandcode.ai/docs/settings
 */
-var ContinueHooks = class ContinueHooks extends ToolHooks {
+var CommandcodeHooks = class CommandcodeHooks extends ToolHooks {
 	constructor(params) {
 		super({
 			...params,
@@ -22958,14 +23196,14 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 	}
 	static getSettablePaths(_options = {}) {
 		return {
-			relativeDirPath: CONTINUE_DIR,
-			relativeFilePath: CONTINUE_SETTINGS_FILE_NAME
+			relativeDirPath: COMMANDCODE_DIR,
+			relativeFilePath: COMMANDCODE_SETTINGS_FILE_NAME
 		};
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = ContinueHooks.getSettablePaths({ global });
+		const paths = CommandcodeHooks.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new ContinueHooks({
+		return new CommandcodeHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -22974,14 +23212,14 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 		});
 	}
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = ContinueHooks.getSettablePaths({ global });
+		const paths = CommandcodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		const config = rulesyncHooks.getJson();
 		const hooks = canonicalToToolHooks({
 			config,
-			toolOverrideHooks: config.continue?.hooks,
-			converterConfig: CONTINUE_CONVERTER_CONFIG,
+			toolOverrideHooks: config.commandcode?.hooks,
+			converterConfig: COMMANDCODE_CONVERTER_CONFIG,
 			logger
 		});
 		const fileContent = applySharedConfigPatch({
@@ -22992,7 +23230,7 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 			filePath,
 			logger
 		});
-		return new ContinueHooks({
+		return new CommandcodeHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
@@ -23004,18 +23242,18 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
 		let settings;
 		try {
-			settings = parseContinueSettings(this.getFileContent(), configPath);
+			settings = parseCommandcodeSettings$1(this.getFileContent(), configPath);
 		} catch (error) {
-			throw new Error(`Failed to parse Continue hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
+			throw new Error(`Failed to parse Command Code hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
 			logger,
 			hooks: settings.hooks,
-			converterConfig: CONTINUE_CONVERTER_CONFIG
+			converterConfig: COMMANDCODE_CONVERTER_CONFIG
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey: "continue"
+			overrideKey: "commandcode"
 		}), null, 2) });
 	}
 	validate() {
@@ -23025,7 +23263,7 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 		};
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new ContinueHooks({
+		return new CommandcodeHooks({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
@@ -23035,6 +23273,73 @@ var ContinueHooks = class ContinueHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/features/hooks/continue-hooks.ts
+const CONTINUE_SPEC = {
+	displayName: "Continue",
+	overrideKey: "continue",
+	converterConfig: {
+		supportedEvents: CONTINUE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CONTINUE_EVENT_NAMES,
+		toolToCanonicalEventNames: CONTINUE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CONTINUE_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set([
+			"beforeSubmitPrompt",
+			"stop",
+			"teammateIdle",
+			"taskCompleted",
+			"worktreeCreate",
+			"worktreeRemove"
+		]),
+		supportedHookTypes: /* @__PURE__ */ new Set([
+			"command",
+			"prompt",
+			"http",
+			"agent"
+		]),
+		emitsPromptModel: true,
+		stringPassthroughFields: [{
+			canonical: "statusMessage",
+			tool: "statusMessage"
+		}],
+		booleanPassthroughFields: [{
+			canonical: "once",
+			tool: "once"
+		}, {
+			canonical: "async",
+			tool: "async",
+			commandOnly: true
+		}]
+	}
+};
+/**
+* Continue CLI hooks.
+*
+* Hooks live under the top-level `hooks` key of `<project>/.continue/settings.json`
+* (project scope) and `~/.continue/settings.json` (user scope), in the
+* Claude-Code shape: `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{
+* "type": "command" | "http" | "prompt" | "agent", ..., "timeout"?: <seconds>
+* }] }] }`. Both files also hold settings rulesync does not own, so generation
+* merges the `hooks` key into the existing file (see `SHARED_CONFIG_OWNERSHIP`)
+* instead of overwriting it. The CLI additionally reads
+* `.continue/settings.local.json` and the Claude Code settings files; rulesync
+* writes only the committable project file and the user file.
+*
+* @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/hookConfig.ts
+* @see https://github.com/continuedev/continue/blob/main/extensions/cli/src/hooks/types.ts
+*/
+var ContinueHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CONTINUE_SPEC;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: CONTINUE_DIR,
+			relativeFilePath: CONTINUE_SETTINGS_FILE_NAME
+		};
+	}
+};
+//#endregion
 //#region src/features/hooks/copilot-hooks.ts
 /**
 * Copilot hook entry as stored in .github/hooks/copilot-hooks.json.
@@ -23623,33 +23928,24 @@ const CORTEXCODE_SKILLS_DIR_PATH = (0, node_path.join)(CORTEXCODE_DIR, "skills")
 const CORTEXCODE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(CORTEXCODE_GLOBAL_DIR_PATH, "skills");
 //#endregion
 //#region src/features/hooks/cortexcode-hooks.ts
-const CORTEXCODE_CONVERTER_CONFIG = {
-	supportedEvents: CORTEXCODE_HOOK_EVENTS,
-	canonicalToToolEventNames: CANONICAL_TO_CORTEXCODE_EVENT_NAMES,
-	toolToCanonicalEventNames: CORTEXCODE_TO_CANONICAL_EVENT_NAMES,
-	projectDirVar: "$CORTEX_PROJECT_DIR",
-	prefixDotRelativeCommandsOnly: true,
-	noMatcherEvents: /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]),
-	supportedHookTypes: /* @__PURE__ */ new Set(["command", "prompt"]),
-	booleanPassthroughFields: [{
-		canonical: "enabled",
-		tool: "enabled"
-	}]
+const CORTEXCODE_SPEC = {
+	displayName: "Cortex Code",
+	overrideKey: "cortexcode",
+	converterConfig: {
+		supportedEvents: CORTEXCODE_HOOK_EVENTS,
+		canonicalToToolEventNames: CANONICAL_TO_CORTEXCODE_EVENT_NAMES,
+		toolToCanonicalEventNames: CORTEXCODE_TO_CANONICAL_EVENT_NAMES,
+		projectDirVar: "$CORTEX_PROJECT_DIR",
+		prefixDotRelativeCommandsOnly: true,
+		noMatcherEvents: /* @__PURE__ */ new Set(["beforeSubmitPrompt", "stop"]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command", "prompt"]),
+		booleanPassthroughFields: [{
+			canonical: "enabled",
+			tool: "enabled"
+		}]
+	}
 };
 /**
-* Single spelling of the settings/hooks codec/policy: fail closed on an
-* unparseable root rather than replacing the user's Cortex Code settings with
-* generated output.
-*/
-function parseCortexcodeSettings(fileContent, filePath) {
-	return parseSharedConfig({
-		format: "json",
-		fileContent,
-		filePath,
-		invalidRootPolicy: "error"
-	});
-}
-/**
 * Snowflake Cortex Code hooks.
 *
 * Hooks live under the top-level `hooks` key of `<project>/.cortex/settings.json`
@@ -23658,20 +23954,16 @@ function parseCortexcodeSettings(fileContent, filePath) {
 * "<regex>", "hooks": [{ "type": "command" | "prompt", ..., "timeout"?:
 * <seconds>, "enabled"?: <boolean> }] }] }`. The project file also holds
 * settings rulesync does not own, so generation merges the `hooks` key into
-* either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
+* either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it, and
+* neither file is removed wholesale (hooks.json sits in the CLI-owned
+* `~/.snowflake/cortex/` tree).
 *
 * @see https://docs.snowflake.com/en/user-guide/cortex-code/extensibility
 * @see https://docs.snowflake.com/en/user-guide/cortex-code/settings
 */
-var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? "{}"
-		});
-	}
-	isDeletable() {
-		return false;
+var CortexcodeHooks = class extends SettingsJsonHooks {
+	static getSpec() {
+		return CORTEXCODE_SPEC;
 	}
 	static getSettablePaths({ global = false } = {}) {
 		return global ? {
@@ -23682,60 +23974,338 @@ var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
 			relativeFilePath: CORTEXCODE_SETTINGS_FILE_NAME
 		};
 	}
+};
+//#endregion
+//#region src/constants/crush-paths.ts
+const CRUSH_RULE_FILE_NAME = "CRUSH.md";
+const CRUSH_GLOBAL_DIR = (0, node_path.join)(".config", "crush");
+const CRUSH_LOCAL_RULE_FILE_NAME = "CRUSH.local.md";
+const CRUSH_IGNORE_FILE_NAME = ".crushignore";
+const CRUSH_SKILLS_PROJECT_DIR = (0, node_path.join)(".crush", "skills");
+const CRUSH_SKILLS_GLOBAL_DIR = (0, node_path.join)(CRUSH_GLOBAL_DIR, "skills");
+const CRUSH_CONFIG_FILE_NAME = "crush.json";
+const CRUSH_HIDDEN_CONFIG_FILE_NAME = ".crush.json";
+const CRUSH_PERMISSIONS_KEY = "permissions";
+const CRUSH_ALLOWED_TOOLS_KEY = "allowed_tools";
+const CRUSH_OPTIONS_KEY = "options";
+const CRUSH_DISABLED_TOOLS_KEY = "disabled_tools";
+const CRUSH_HOOKS_KEY = "hooks";
+//#endregion
+//#region src/features/crush-config.ts
+/**
+* Where Crush's JSON config lives for a scope, before the project-scope twin
+* is resolved: `<project>/crush.json` or `~/.config/crush/crush.json`. This is
+* also the key every adapter reports through `getSettablePaths`, so the
+* shared-config ownership declaration, the gitignore derivation and the
+* shared-write ordering all see one file per scope.
+*/
+function getCrushConfigSettablePaths({ global = false } = {}) {
+	return {
+		relativeDirPath: global ? CRUSH_GLOBAL_DIR : ".",
+		relativeFilePath: CRUSH_CONFIG_FILE_NAME
+	};
+}
+/**
+* Resolves which Crush config file an adapter should read and write.
+*
+* At project scope Crush discovers both `.crush.json` and `crush.json` in the
+* working directory and merges every file it finds with `.crush.json` on top
+* (objects merge recursively, lists are concatenated, scalars are overridden).
+* Neither file therefore hides the other: an entry left in `crush.json` stays
+* in effect next to whatever `.crush.json` says. An existing `.crush.json` is
+* preferred because the user chose that spelling; otherwise `crush.json` is
+* used (and created when neither exists). The global scope has a single
+* spelling.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+async function resolveCrushConfigFile({ outputRoot, global = false }) {
+	const paths = getCrushConfigSettablePaths({ global });
+	const configDir = (0, node_path.join)(outputRoot, paths.relativeDirPath);
+	const filePath = (0, node_path.join)(configDir, paths.relativeFilePath);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (!global) {
+		const hiddenPath = (0, node_path.join)(configDir, CRUSH_HIDDEN_CONFIG_FILE_NAME);
+		const hiddenContent = await readFileContentOrNull(hiddenPath);
+		if (hiddenContent !== null) return {
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: CRUSH_HIDDEN_CONFIG_FILE_NAME,
+			filePath: hiddenPath,
+			fileContent: hiddenContent,
+			...fileContent === null ? {} : { twin: {
+				filePath,
+				fileContent
+			} }
+		};
+	}
+	return {
+		relativeDirPath: paths.relativeDirPath,
+		relativeFilePath: paths.relativeFilePath,
+		filePath,
+		fileContent
+	};
+}
+/**
+* Single spelling of the crush.json codec/policy, matching the
+* `SHARED_CONFIG_OWNERSHIP` declaration for both scopes: fail closed on an
+* unparseable root rather than replacing the user's Crush config with
+* generated output.
+*/
+function parseCrushConfig(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "json",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Combine two Crush config documents the way Crush itself does
+* (`github.com/qjebbs/go-jsons`): objects merge recursively, arrays are
+* concatenated with `base` first, and any other value from `override` wins.
+*/
+function mergeCrushConfigs({ base, override }) {
+	const merged = { ...base };
+	for (const [key, value] of Object.entries(override)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const current = merged[key];
+		if (isRecord$1(current) && isRecord$1(value)) merged[key] = mergeCrushConfigs({
+			base: current,
+			override: value
+		});
+		else if (Array.isArray(current) && Array.isArray(value)) merged[key] = [...current, ...value];
+		else merged[key] = value;
+	}
+	return merged;
+}
+/**
+* The content an import should read for a resolved location: the chosen file
+* merged over its twin when both exist, so a server, hook or tool entry that
+* only the lower-priority `crush.json` declares is imported too — Crush sees
+* it, so rulesync should as well.
+*/
+function crushConfigImportContent(location) {
+	const own = location.fileContent ?? "{}";
+	if (location.twin === void 0) return own;
+	const merged = mergeCrushConfigs({
+		base: parseCrushConfig(location.twin.fileContent, location.twin.filePath),
+		override: parseCrushConfig(own, location.filePath)
+	});
+	return JSON.stringify(merged, null, 2);
+}
+function lookupPath(root, path) {
+	let current = root;
+	for (const segment of path) {
+		if (!isRecord$1(current) || !Object.hasOwn(current, segment)) return;
+		current = current[segment];
+	}
+	return current;
+}
+function isNonEmptyValue(value) {
+	if (Array.isArray(value)) return value.length > 0;
+	if (isRecord$1(value)) return Object.keys(value).length > 0;
+	return value !== void 0;
+}
+/**
+* Warn when the twin Crush merges beneath the written file still carries a
+* value at one of the paths this feature owns. Rulesync only rewrites the
+* chosen file, and because Crush concatenates lists and merges objects across
+* the pair, such an entry — typically one an earlier generate wrote to
+* `crush.json` before the user added a `.crush.json` — stays in effect until
+* removed by hand, and cannot be retracted from `.rulesync/`.
+*/
+function warnCrushTwinLeftovers({ location, ownedPaths, logger }) {
+	if (location.twin === void 0) return;
+	let twin;
+	try {
+		twin = parseCrushConfig(location.twin.fileContent, location.twin.filePath);
+	} catch {
+		return;
+	}
+	const leftovers = ownedPaths.filter((path) => isNonEmptyValue(lookupPath(twin, path))).map((path) => `"${path.join(".")}"`);
+	if (leftovers.length === 0) return;
+	logger?.warn(`Crush merges ${location.twin.filePath} beneath ${location.filePath} (objects recursively, lists concatenated), so the ${leftovers.join(", ")} entries it still carries stay in effect and are not managed by rulesync; remove them from that file by hand.`);
+}
+//#endregion
+//#region src/features/hooks/crush-hooks.ts
+const SUPPORTED_CRUSH_EVENTS = new Set(CRUSH_HOOK_EVENTS);
+/**
+* Crush matches an event key case-insensitively and ignores underscores
+* (`PreToolUse`, `pre_tool_use` and `PRE_TOOL_USE` all work), so an import
+* looks the canonical name up by that normalized spelling.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+const NORMALIZED_CRUSH_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CRUSH_TO_CANONICAL_EVENT_NAMES).map(([crushEvent, canonical]) => [normalizeCrushEventName(crushEvent), canonical]));
+function normalizeCrushEventName(event) {
+	return event.replaceAll("_", "").toLowerCase();
+}
+/**
+* Build the `hooks` block of `crush.json` from a canonical hooks config.
+* Crush keys a flat array of `{name, matcher, command, timeout}` entries by
+* event name; `matcher` is a regex tested against the (lower-case) Crush tool
+* name and `timeout` is in seconds. Only `type: "command"` canonical hooks are
+* emitted, since a Crush hook is a shell command. A shared canonical event
+* Crush does not fire is skipped (the HooksProcessor reports it), while an
+* event under the `crush.hooks` override — such as one an import filed there
+* — is written verbatim so it round-trips.
+*/
+function canonicalToCrushHooks({ config, toolOverride, logger }) {
+	const sharedHooks = {};
+	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_CRUSH_EVENTS.has(event)) sharedHooks[event] = defs;
+	const effective = {
+		...sharedHooks,
+		...toolOverride
+	};
+	const hooks = {};
+	for (const [event, defs] of Object.entries(effective)) {
+		if (isPrototypePollutionKey(event)) continue;
+		const crushEvent = lookupOwn({
+			record: CANONICAL_TO_CRUSH_EVENT_NAMES,
+			key: event
+		}) ?? event;
+		const entries = [];
+		for (const def of defs) {
+			const entry = canonicalDefToCrushEntry({
+				def,
+				event,
+				logger
+			});
+			if (entry !== null) entries.push(entry);
+		}
+		if (entries.length > 0) hooks[crushEvent] = entries;
+	}
+	return hooks;
+}
+/** Convert one canonical hook definition to a Crush entry, or null to skip. */
+function canonicalDefToCrushEntry({ def, event, logger }) {
+	if ((def.type ?? "command") !== "command") return null;
+	if (typeof def.command !== "string" || def.command === "") {
+		logger?.warn(`Crush hook ${quoteValueForWarning(def.name ?? "")} under "${event}" has no "command", which Crush would discard, so it was skipped.`);
+		return null;
+	}
+	const entry = { command: def.command };
+	if (typeof def.name === "string" && def.name !== "") entry.name = def.name;
+	if (typeof def.matcher === "string" && def.matcher !== "" && def.matcher !== "*") entry.matcher = def.matcher;
+	if (typeof def.timeout === "number") entry.timeout = Math.ceil(def.timeout);
+	return entry;
+}
+/** Convert one raw hook entry to a canonical definition, or null to skip. */
+function crushEntryToCanonicalDef(raw) {
+	if (!isRecord$1(raw) || typeof raw.command !== "string") return null;
+	const def = {
+		type: "command",
+		command: raw.command
+	};
+	if (typeof raw.name === "string" && raw.name !== "") def.name = raw.name;
+	if (typeof raw.matcher === "string" && raw.matcher !== "") def.matcher = raw.matcher;
+	if (typeof raw.timeout === "number") def.timeout = raw.timeout;
+	return def;
+}
+/**
+* Reverse {@link canonicalToCrushHooks}: parse the `hooks` block back into a
+* canonical event → definition[] record. An event Crush does not document is
+* carried under its own name so `buildImportedHooksConfig` files it under the
+* `crush.hooks` override.
+*/
+function crushHooksToCanonical(hooksBlock) {
+	const canonical = {};
+	if (!isRecord$1(hooksBlock)) return canonical;
+	for (const [crushEvent, rawEntries] of Object.entries(hooksBlock)) {
+		if (isPrototypePollutionKey(crushEvent) || !Array.isArray(rawEntries)) continue;
+		const canonicalEvent = lookupOwn({
+			record: NORMALIZED_CRUSH_TO_CANONICAL_EVENT_NAMES,
+			key: normalizeCrushEventName(crushEvent)
+		}) ?? crushEvent;
+		const defs = rawEntries.map((raw) => crushEntryToCanonicalDef(raw)).filter((def) => def !== null);
+		if (defs.length === 0) continue;
+		canonical[canonicalEvent] = [...lookupOwn({
+			record: canonical,
+			key: canonicalEvent
+		}) ?? [], ...defs];
+	}
+	return canonical;
+}
+/**
+* Crush hooks.
+*
+* Crush reads hooks from the `hooks` key of its JSON config —
+* `<project>/crush.json` (or an existing `.crush.json`; Crush merges the pair,
+* lists concatenated) at project scope and `~/.config/crush/crush.json` at
+* user scope — as
+* `hooks.<Event>: [{name?, matcher?, command, timeout?}]`. Only `PreToolUse`
+* fires today. The `hooks` key is owned outright; every other top-level key
+* of the file is preserved and the file is never deleted.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/hooks/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+var CrushHooks = class CrushHooks extends ToolHooks {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseCrushConfig(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = CortexcodeHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"hooks\":{}}";
-		return new CortexcodeHooks({
+		const location = await resolveCrushConfigFile({
 			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
+			global
+		});
+		return new CrushHooks({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
 		});
 	}
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
-		const paths = CortexcodeHooks.getSettablePaths({ global });
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
-		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const config = rulesyncHooks.getJson();
-		const hooks = canonicalToToolHooks({
-			config,
-			toolOverrideHooks: config.cortexcode?.hooks,
-			converterConfig: CORTEXCODE_CONVERTER_CONFIG,
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [[CRUSH_HOOKS_KEY]],
 			logger
 		});
-		const fileContent = applySharedConfigPatch({
-			fileKey: sharedConfigFileKey(paths),
-			feature: "hooks",
-			existingContent,
-			patch: { hooks },
-			filePath,
+		const config = rulesyncHooks.getJson();
+		const hooks = canonicalToCrushHooks({
+			config,
+			toolOverride: config.crush?.hooks,
 			logger
 		});
-		return new CortexcodeHooks({
+		return new CrushHooks({
 			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(this.getSettablePaths({ global })),
+				feature: "hooks",
+				existingContent,
+				patch: { [CRUSH_HOOKS_KEY]: hooks },
+				filePath: location.filePath,
+				logger
+			}),
+			validate,
+			global
 		});
 	}
-	toRulesyncHooks({ logger } = {}) {
-		const configPath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
-		let settings;
-		try {
-			settings = parseCortexcodeSettings(this.getFileContent(), configPath);
-		} catch (error) {
-			throw new Error(`Failed to parse Cortex Code hooks content in ${configPath}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = toolHooksToCanonical({
-			logger,
-			hooks: settings.hooks,
-			converterConfig: CORTEXCODE_CONVERTER_CONFIG
-		});
+	toRulesyncHooks() {
+		const hooks = crushHooksToCanonical(this.json[CRUSH_HOOKS_KEY]);
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey: "cortexcode"
+			overrideKey: "crush"
 		}), null, 2) });
 	}
 	validate() {
@@ -23744,13 +24314,14 @@ var CortexcodeHooks = class CortexcodeHooks extends ToolHooks {
 			error: null
 		};
 	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new CortexcodeHooks({
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushHooks({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: {} }, null, 2),
-			validate: false
+			fileContent: JSON.stringify({ [CRUSH_HOOKS_KEY]: {} }, null, 2),
+			validate: false,
+			global
 		});
 	}
 };
@@ -26984,19 +27555,22 @@ var ReasonixHooks = class ReasonixHooks extends ToolHooks {
 //#endregion
 //#region src/features/hooks/tabnine-hooks.ts
 /**
-* Environment block safe to hand Tabnine for a hook. A tool rebuilds each
-* entry into `KEY=VALUE` for the spawned process, so a key holding `=`, a
-* control character or nothing at all names a different variable than it
-* appears to; such entries are dropped in both directions (with a warning on
-* export, where the value came from an authored `.rulesync/hooks.*`).
+* Environment block safe to hand Tabnine for a hook. The shared converter
+* refuses a whole `env` map holding one bad entry; Tabnine's shape is authored
+* outside it, so the same per-entry rule (`isSafeEnvEntry`: a key holding `=`,
+* a control character or nothing at all names a different variable than it
+* appears to) is applied entry by entry and the bad ones are dropped in both
+* directions, with a warning on export, where the value came from an authored
+* `.rulesync/hooks.*`.
 */
 function sanitizeEnv({ env, warn }) {
 	if (env === null || env === void 0 || typeof env !== "object" || Array.isArray(env)) return;
 	const result = {};
 	for (const [key, value] of Object.entries(env)) {
-		const unsafeKey = key === "" || key.includes("=") || CONTROL_CHARS.some((char) => key.includes(char));
-		const unsafeValue = typeof value !== "string" || CONTROL_CHARS.some((char) => value.includes(char));
-		if (unsafeKey || unsafeValue) {
+		if (!isSafeEnvEntry({
+			key,
+			value
+		})) {
 			warn?.(`Tabnine CLI hook env entry ${JSON.stringify(key)} is not a safe KEY=VALUE pair; skipping it.`);
 			continue;
 		}
@@ -27097,7 +27671,7 @@ const TabnineMatcherEntrySchema = zod_mini.z.looseObject({
 });
 function tabnineMatcherEntryToCanonical(entry) {
 	const sequential = entry.sequential === true;
-	const matcher = entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "" ? entry.matcher : void 0;
+	const matcher = entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "" && entry.matcher !== ".*" ? entry.matcher : void 0;
 	const defs = [];
 	for (const hook of entry.hooks ?? []) {
 		if (hook.type !== "command" || typeof hook.command !== "string" || hook.command === "") continue;
@@ -27818,6 +28392,18 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command"],
 		supportsMatcher: true
 	}],
+	["commandcode", {
+		class: CommandcodeHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: COMMANDCODE_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
+		supportsMatcher: true,
+		matcherEvents: ["preToolUse", "postToolUse"]
+	}],
 	["copilot", {
 		class: CopilotHooks,
 		meta: {
@@ -28139,6 +28725,18 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command", "http"],
 		supportsMatcher: true
 	}],
+	["crush", {
+		class: CrushHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: CRUSH_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
+		supportsMatcher: true,
+		passthroughOverrideEvents: true
+	}],
 	["zcode", {
 		class: ZcodeHooks,
 		meta: {
@@ -28820,14 +29418,6 @@ var ContinueIgnore = class ContinueIgnore extends ToolIgnore {
 	}
 };
 //#endregion
-//#region src/constants/crush-paths.ts
-const CRUSH_RULE_FILE_NAME = "CRUSH.md";
-const CRUSH_GLOBAL_DIR = (0, node_path.join)(".config", "crush");
-const CRUSH_LOCAL_RULE_FILE_NAME = "CRUSH.local.md";
-const CRUSH_IGNORE_FILE_NAME = ".crushignore";
-const CRUSH_SKILLS_PROJECT_DIR = (0, node_path.join)(".crush", "skills");
-const CRUSH_SKILLS_GLOBAL_DIR = (0, node_path.join)(CRUSH_GLOBAL_DIR, "skills");
-//#endregion
 //#region src/features/ignore/crush-ignore.ts
 /**
 * Ignore generator for Crush.
@@ -30829,9 +31419,9 @@ function asBobRemoteType(stated, url) {
 * SSE server carries a bare `url`. The canonical `transport` alias and the
 * Claude-style `httpUrl` alias are folded into `type`/`url`; `env`, `cwd`,
 * `headers`, `timeout`, `alwaysAllow` and `disabled` pass through, as Bob
-* documents all of them (`env` and `headers` with their prototype-pollution
-* keys dropped, since Bob spreads those maps into the process environment and
-* the HTTP requests).
+* documents all of them, with prototype-pollution keys dropped at every
+* nesting level (Bob spreads `env` and `headers` into the process environment
+* and the HTTP requests).
 *
 * Bob Shell documents the same file with an `httpURL` key instead of
 * `type` + `url` for streamable HTTP. rulesync writes the IDE spelling (the two
@@ -30899,7 +31489,7 @@ function convertToBobFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -30910,7 +31500,9 @@ function convertToBobFormat(mcpServers, logger) {
 * (`type: "streamable-http"` + `url`) is already canonical and passes through;
 * the Bob Shell spelling `httpURL` becomes `url` with `type: "http"`; a bare
 * `url` is an SSE server in Bob, so it gains `type: "sse"` to keep that reading
-* on the next generate.
+* on the next generate. Every other field passes through with its
+* prototype-pollution keys dropped at every nesting level, mirroring the
+* generate side's handling of `env` / `headers`.
 */
 function convertFromBobFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -30925,7 +31517,7 @@ function convertFromBobFormat(mcpServers) {
 				if (typeof value === "string") httpURL = value;
 				continue;
 			}
-			converted[key] = value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		if (httpURL !== void 0) {
 			converted.url = httpURL;
@@ -31669,6 +32261,254 @@ var CodexcliMcp = class CodexcliMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/commandcode-mcp.ts
+/**
+* Parse a Command Code MCP file. The project file is the `.mcp.json` other
+* agents (Claude Code among them) share, so a hand-written file is read as
+* JSONC to tolerate comments and trailing commas; malformed content or a
+* non-object root (`null`, an array, a scalar) fails closed rather than being
+* spread into the regenerated file.
+*/
+function parseCommandcodeMcpConfig({ fileContent, relativePath }) {
+	let parsed;
+	try {
+		parsed = parseJsonc$6(fileContent);
+	} catch (error) {
+		throw new Error(`Failed to parse Command Code MCP config at ${relativePath}: ${formatError(error)}`, { cause: error });
+	}
+	if (!isPlainObject$1(parsed)) throw new Error(`Failed to parse Command Code MCP config at ${relativePath}: expected a JSON object at the root`);
+	return parsed;
+}
+/**
+* The remote transport Command Code reads a server as. Its loader accepts
+* `http` (streamable HTTP) and `sse` for a `url` server; a bare `url` defaults
+* to `http`, and the canonical `streamable-http` spelling is folded into it.
+* A `ws(s)://` URL or any other stated transport has no Command Code
+* equivalent, so `undefined` tells the caller to skip the server.
+* @see https://commandcode.ai/docs/mcp
+*/
+function asCommandcodeRemoteTransport(stated, url) {
+	if (stated === "sse") return "sse";
+	if (stated === "http" || stated === "streamable-http") return "http";
+	if (stated === void 0) return /^wss?:\/\//i.test(url) ? void 0 : "http";
+}
+/**
+* Convert the canonical server map to the shape Command Code's config schema
+* documents (used for the global `~/.commandcode/mcp.json` only — the project
+* `.mcp.json` is shared with Claude Code and written pass-through, see the
+* class doc): a remote server is `{ transport, url, headers?, env?, oauth? }`
+* and a stdio server is `{ transport: "stdio", command, args?, env? }`, each
+* with an optional `enabled` flag. The documented spelling is `transport`
+* (`type` is only accepted as an alias on read), so that is what is written,
+* and only the documented keys are emitted — `timeout`, rulesync-only fields
+* and anything else is left out. The canonical `disabled: true` becomes
+* Command Code's native `enabled: false` (the rulesync-source-only `enabled`
+* filter never reaches this function: `getMcpServers()` drops such a server).
+*
+* A server Command Code drops at load time — no transport at all, a remote
+* transport without a URL, a WebSocket URL, or a stdio entry without a
+* command — is skipped with a warning rather than written in a form the tool
+* would silently ignore.
+* @see https://commandcode.ai/docs/mcp
+*/
+function convertToCommandcodeFormat(mcpServers, logger) {
+	const result = {};
+	for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(serverName) || !isRecord$1(serverConfig)) continue;
+		if (declaresNoTransport(serverConfig)) {
+			warnAndSkipMcpServer({
+				toolName: "Command Code",
+				serverName,
+				reason: "no transport",
+				logger
+			});
+			continue;
+		}
+		const converted = isRemoteMcpServer(serverConfig) ? convertRemoteServer$1({
+			serverName,
+			serverConfig,
+			logger
+		}) : convertStdioServer$1({
+			serverName,
+			serverConfig,
+			logger
+		});
+		if (converted === void 0) continue;
+		if (serverConfig.disabled === true) converted.enabled = false;
+		if (isRecord$1(serverConfig.env)) converted.env = omitPrototypePollutionKeys(serverConfig.env);
+		result[serverName] = converted;
+	}
+	return result;
+}
+function convertRemoteServer$1({ serverName, serverConfig, logger }) {
+	const url = resolveRemoteMcpUrl(serverConfig);
+	if (!url) {
+		warnAndSkipMcpServer({
+			toolName: "Command Code",
+			serverName,
+			reason: "a remote transport without a url",
+			logger
+		});
+		return;
+	}
+	const stated = serverConfig.type ?? serverConfig.transport;
+	const transport = asCommandcodeRemoteTransport(typeof stated === "string" ? stated : void 0, url);
+	if (transport === void 0) {
+		warnAndSkipMcpServer({
+			toolName: "Command Code",
+			serverName,
+			reason: stated === void 0 ? "a WebSocket url, which Command Code's remote transports (http and sse) cannot reach" : `the "${String(stated)}" transport, which Command Code does not offer for remote servers (only http and sse)`,
+			logger
+		});
+		return;
+	}
+	const converted = {
+		transport,
+		url
+	};
+	if (isRecord$1(serverConfig.headers)) converted.headers = omitPrototypePollutionKeys(serverConfig.headers);
+	if (isRecord$1(serverConfig.oauth)) converted.oauth = omitPrototypePollutionKeys(serverConfig.oauth);
+	return converted;
+}
+function convertStdioServer$1({ serverName, serverConfig, logger }) {
+	const [command, ...args] = resolveLocalMcpCommand(serverConfig);
+	if (!command) {
+		warnAndSkipMcpServer({
+			toolName: "Command Code",
+			serverName,
+			reason: "a stdio transport without a command",
+			logger
+		});
+		return;
+	}
+	const converted = {
+		transport: "stdio",
+		command
+	};
+	if (args.length > 0) converted.args = args;
+	return converted;
+}
+/**
+* Convert Command Code's server map back to the canonical shape. Both
+* spellings Command Code accepts (`transport` and its `type` alias, with
+* `command`/`url`) are already canonical, so entries pass through with only
+* prototype-pollution keys dropped; the native `enabled: false` maps to the
+* canonical `disabled: true` (a bare `enabled` would otherwise be read back
+* as rulesync's own generation filter and silently drop the server from every
+* other target).
+*/
+function convertFromCommandcodeFormat(mcpServers) {
+	if (!isMcpServers(mcpServers)) return {};
+	const result = {};
+	for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(serverName) || !isRecord$1(serverConfig)) continue;
+		const { enabled, ...rest } = omitPrototypePollutionKeys(serverConfig);
+		result[serverName] = enabled === false ? {
+			...rest,
+			disabled: true
+		} : rest;
+	}
+	return result;
+}
+/**
+* Command Code MCP configuration.
+*
+* Command Code reads `.mcp.json` at the project root (project scope, meant to
+* be committed) and `~/.commandcode/mcp.json` (user scope), both in the
+* `{ "mcpServers": { ... } }` shape the docs show; the per-machine local
+* scope under `~/.commandcode/projects/` is left to the tool. Top-level
+* sibling keys of an existing file are kept. The global file is not deleted
+* by `--delete` (it lives outside the project), while the project file is
+* rulesync's own and is.
+*
+* The project `.mcp.json` is the very file the `claudecode` target writes, so
+* at project scope the servers are written in the same pass-through shape
+* `ClaudecodeMcp` uses: whichever of the two targets generates last leaves
+* byte-identical content, and Command Code reads that shape natively (`type`
+* is an alias of `transport`, a bare `url` infers `http`, and unknown keys
+* are ignored). Only the global file — Command Code's own — gets the
+* `transport` / `enabled: false` rewrite of `convertToCommandcodeFormat`.
+*
+* @see https://commandcode.ai/docs/mcp
+*/
+var CommandcodeMcp = class CommandcodeMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = this.fileContent === void 0 ? {} : parseCommandcodeMcpConfig({
+			fileContent: this.fileContent,
+			relativePath: (0, node_path.join)(this.relativeDirPath, this.relativeFilePath)
+		});
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return !this.global;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return global ? {
+			relativeDirPath: COMMANDCODE_DIR,
+			relativeFilePath: COMMANDCODE_GLOBAL_MCP_FILE_NAME
+		} : {
+			relativeDirPath: ".",
+			relativeFilePath: COMMANDCODE_PROJECT_MCP_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}";
+		return new CommandcodeMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const json = parseCommandcodeMcpConfig({
+			fileContent: await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}",
+			relativePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)
+		});
+		const mcpServers = global ? convertToCommandcodeFormat(rulesyncMcp.getMcpServers(), logger) : rulesyncMcp.getMcpServers();
+		const commandcodeConfig = {
+			...json,
+			mcpServers
+		};
+		return new CommandcodeMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: JSON.stringify(commandcodeConfig, null, 2),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const mcpServers = convertFromCommandcodeFormat(this.json.mcpServers);
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CommandcodeMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/continue-mcp.ts
 /**
 * Parse a Continue MCP file. Continue reads the files under `mcpServers/` as
@@ -32331,7 +33171,7 @@ function convertToCortexcodeFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -32340,14 +33180,15 @@ function convertToCortexcodeFormat(mcpServers, logger) {
 /**
 * Convert Cortex Code's server map back to the canonical shape. The
 * documented spelling (`type` + `command`/`url`) is already canonical, so
-* entries pass through with only prototype-pollution keys dropped.
+* entries pass through with only prototype-pollution keys dropped — at every
+* nesting level, mirroring the generate side.
 */
 function convertFromCortexcodeFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
 	const result = {};
 	for (const [serverName, serverConfig] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(serverName) || !isRecord$1(serverConfig)) continue;
-		result[serverName] = omitPrototypePollutionKeys(serverConfig);
+		result[serverName] = omitPrototypePollutionKeysDeep(serverConfig);
 	}
 	return result;
 }
@@ -32386,19 +33227,12 @@ var CortexcodeMcp = class CortexcodeMcp extends ToolMcp {
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		if (!global) throw new Error(CORTEXCODE_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
-		const json = parseCortexcodeMcpConfig({
-			fileContent: await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}",
-			relativePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)
-		});
-		const newJson = {
-			...json,
-			mcpServers: json.mcpServers ?? {}
-		};
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}";
 		return new CortexcodeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: JSON.stringify(newJson, null, 2),
+			fileContent,
 			validate,
 			global
 		});
@@ -32446,6 +33280,319 @@ var CortexcodeMcp = class CortexcodeMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/crush-mcp.ts
+/**
+* Crush-only MCP fields with no canonical counterpart, authored under a
+* `crush`-prefixed key in `.rulesync/mcp.jsonc` and written under Crush's own
+* name: `oauth*` drive Crush's OAuth 2.1 flow for HTTP servers and
+* `sessionless` marks a server that issues no `Mcp-Session-Id`.
+* `RulesyncMcp.getMcpServers()` strips both spellings so the client secret
+* never reaches another tool's config; `fromRulesyncMcp` re-merges them from
+* the raw source JSON, honouring the raw Crush spelling as a fallback for an
+* entry copied straight out of a `crush.json` (the `experimental_environment`
+* precedent) — except `oauth`, whose canonical key is Claude Code's
+* `{ clientId }` object and which only `crushOauth` can set.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+const CRUSH_ONLY_KEYS = [
+	{
+		canonical: "crushOauth",
+		crush: "oauth",
+		accepts: (v) => typeof v === "boolean",
+		rawFallback: false
+	},
+	{
+		canonical: "crushOauthClientId",
+		crush: "oauth_client_id",
+		accepts: (v) => typeof v === "string",
+		rawFallback: true
+	},
+	{
+		canonical: "crushOauthClientSecret",
+		crush: "oauth_client_secret",
+		accepts: (v) => typeof v === "string",
+		rawFallback: true
+	},
+	{
+		canonical: "crushOauthCallbackPort",
+		crush: "oauth_callback_port",
+		accepts: (v) => Number.isInteger(v),
+		rawFallback: true
+	},
+	{
+		canonical: "crushSessionless",
+		crush: "sessionless",
+		accepts: (v) => typeof v === "boolean",
+		rawFallback: true
+	}
+];
+/**
+* The Crush-only keys of one raw canonical server entry, keyed by their
+* canonical name, so `convertToCrushFormat` sees them after the shared map
+* stripped them.
+*/
+function readCrushOnlyKeys(rawServer) {
+	const result = {};
+	if (!isRecord$1(rawServer)) return result;
+	for (const { canonical, crush, accepts, rawFallback } of CRUSH_ONLY_KEYS) {
+		const value = accepts(rawServer[canonical]) ? rawServer[canonical] : rawFallback && accepts(rawServer[crush]) ? rawServer[crush] : void 0;
+		if (value !== void 0) result[canonical] = value;
+	}
+	return result;
+}
+function copyCrushOnlyKeys({ from, to }) {
+	for (const { canonical, crush, accepts } of CRUSH_ONLY_KEYS) if (accepts(from[canonical])) to[crush] = from[canonical];
+}
+/**
+* The remote transports Crush's `MCPType` enum accepts, spelled the way it
+* reads them. `streamable-http` is the canonical rulesync name for what Crush
+* calls `http`; a WebSocket server has no Crush transport and is left to the
+* caller to reject.
+*/
+function asCrushRemoteType(stated, url) {
+	if (stated === "sse") return "sse";
+	if (stated === "http" || stated === "streamable-http") return "http";
+	if (stated === void 0) return /^wss?:\/\//i.test(url) ? void 0 : "http";
+}
+/**
+* The transport half of a remote server (`type`, `url`, `headers`), or null
+* when Crush could not reach it and the server was skipped with a warning.
+*/
+function convertRemoteTransport({ name, config, logger }) {
+	const url = resolveRemoteMcpUrl(config);
+	if (!url) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: "a remote transport without a url",
+			logger
+		});
+		return null;
+	}
+	const stated = config.type ?? config.transport;
+	const type = asCrushRemoteType(stated, url);
+	if (type === void 0) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: stated === void 0 ? "a WebSocket url, which Crush's remote transports (http and sse) cannot reach" : `the "${stated}" transport, which Crush does not offer for remote servers (only http and sse)`,
+			logger
+		});
+		return null;
+	}
+	const converted = {
+		type,
+		url
+	};
+	if (config.headers && Object.keys(config.headers).length > 0) converted.headers = config.headers;
+	return converted;
+}
+/**
+* The transport half of a stdio server (`type`, `command`, `args`, `env`), or
+* null when it has no command and was skipped with a warning.
+*/
+function convertStdioTransport({ name, config, logger }) {
+	const [command, ...args] = resolveLocalMcpCommand(config);
+	if (!command) {
+		warnAndSkipMcpServer({
+			toolName: "Crush",
+			serverName: name,
+			reason: "a stdio transport without a command",
+			logger
+		});
+		return null;
+	}
+	const converted = {
+		type: "stdio",
+		command
+	};
+	if (args.length > 0) converted.args = args;
+	if (config.env && Object.keys(config.env).length > 0) converted.env = config.env;
+	return converted;
+}
+/**
+* Convert canonical rulesync servers to the `mcp.<name>` shape of crush.json.
+* `type` is required by Crush's schema, so it is always written: stdio servers
+* carry `type: "stdio"` with `command`/`args`/`env`, remote servers `http` or
+* `sse` with `url` and optional `headers`. `disabled`, the per-server
+* `disabledTools`/`enabledTools` filters (`disabled_tools`/`enabled_tools`)
+* and `timeout` (which Crush reads in seconds) map onto their Crush fields.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+function convertToCrushFormat(mcpServers, logger) {
+	const result = {};
+	for (const [name, config] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!isRecord$1(config)) continue;
+		if (declaresNoTransport(config)) {
+			warnAndSkipMcpServer({
+				toolName: "Crush",
+				serverName: name,
+				reason: "no transport",
+				logger
+			});
+			continue;
+		}
+		const converted = isRemoteMcpServer(config) ? convertRemoteTransport({
+			name,
+			config,
+			logger
+		}) : convertStdioTransport({
+			name,
+			config,
+			logger
+		});
+		if (converted === null) continue;
+		if (config.disabled === true) converted.disabled = true;
+		if (config.disabledTools && config.disabledTools.length > 0) converted.disabled_tools = config.disabledTools;
+		if (config.enabledTools && config.enabledTools.length > 0) converted.enabled_tools = config.enabledTools;
+		if (typeof config.timeout === "number") converted.timeout = Math.ceil(config.timeout);
+		copyCrushOnlyKeys({
+			from: config,
+			to: converted
+		});
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Convert the `mcp.<name>` entries of crush.json back to canonical rulesync
+* servers. `stdio` is Crush's default `type`, so it is dropped (a canonical
+* server with a `command` is stdio already); `http` and `sse` are kept as the
+* canonical transport names; `disabled_tools`/`enabled_tools` become the
+* canonical `disabledTools`/`enabledTools`; the Crush-only OAuth and
+* `sessionless` fields are lifted into their `crush*` authoring keys (a value
+* of the wrong type is dropped, as Crush itself would refuse it), and any
+* other key is kept verbatim so an import preserves what a hand-authored
+* entry declared.
+*/
+function convertFromCrushFormat(crushServers) {
+	const result = {};
+	for (const [name, config] of Object.entries(crushServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const converted = {};
+		for (const [key, value] of Object.entries(config)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			switch (key) {
+				case "type":
+					if (value === "http" || value === "sse") converted.type = value;
+					break;
+				case "disabled_tools":
+					if (isStringArray$2(value)) converted.disabledTools = value;
+					break;
+				case "enabled_tools":
+					if (isStringArray$2(value)) converted.enabledTools = value;
+					break;
+				case "oauth_token": break;
+				default: {
+					const crushOnly = CRUSH_ONLY_KEYS.find((entry) => entry.crush === key);
+					if (crushOnly === void 0) converted[key] = value;
+					else if (crushOnly.accepts(value)) converted[crushOnly.canonical] = value;
+				}
+			}
+		}
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Crush MCP servers.
+*
+* Crush reads MCP servers from the `mcp` key of its JSON config:
+* `<project>/crush.json` (or an existing `.crush.json`; Crush merges the pair,
+* objects recursively) at project scope and `~/.config/crush/crush.json` at
+* user scope. The
+* `crushrc` Bash config that Crush now recommends compiles its `mcp add`
+* builtin into the same `mcp.<name>` entries and overrides the JSON key by
+* key, so a `crushrc` next to the generated file takes precedence. Every
+* other top-level key of the file is preserved; the file is never deleted.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/config/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+*/
+var CrushMcp = class CrushMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseCrushConfig(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [["mcp"]],
+			logger
+		});
+		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => [serverName, {
+			...serverConfig,
+			...readCrushOnlyKeys(rulesyncMcp.getRawMcpServer(serverName))
+		}])), logger);
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(this.getSettablePaths({ global })),
+				feature: "mcp",
+				existingContent,
+				patch: { ["mcp"]: converted },
+				filePath: location.filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const converted = convertFromCrushFormat(isRecord$1(this.json["mcp"]) ? this.json["mcp"] : {});
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: converted }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: JSON.stringify({ ["mcp"]: {} }, null, 2),
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/mcp-env-var-format.ts
 /**
 * Canonical rulesync env var reference pattern: `${VAR}` (but not `${env:VAR}`,
@@ -36330,6 +37477,7 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 	static async getAuxiliaryFiles({ outputRoot = process.cwd(), global = false, rulesyncMcp, logger }) {
 		const servers = rulesyncMcp.forTarget({
 			toolTarget: "rovodev",
+			global,
 			logger
 		}).getMcpServers();
 		const managedNames = Object.keys(servers).filter((name) => toRovodevServer(name, servers[name]) !== null);
@@ -36490,7 +37638,7 @@ function convertToTabnineFormat(mcpServers, logger) {
 		}
 		for (const [key, value] of Object.entries(rest)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			converted[key] = (key === "env" || key === "headers") && isRecord$1(value) ? omitPrototypePollutionKeys(value) : value;
+			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		if (enabledTools !== void 0) converted.includeTools = enabledTools;
 		if (disabledTools !== void 0) converted.excludeTools = disabledTools;
@@ -36501,7 +37649,9 @@ function convertToTabnineFormat(mcpServers, logger) {
 /**
 * Convert Tabnine's server map back to the canonical shape: `includeTools` /
 * `excludeTools` become `enabledTools` / `disabledTools`; `type` (`stdio`,
-* `sse`, `http`) and every other documented field are already canonical.
+* `sse`, `http`) and every other documented field are already canonical and
+* pass through with their prototype-pollution keys dropped at every nesting
+* level, mirroring the generate side.
 */
 function convertFromTabnineFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -36513,7 +37663,7 @@ function convertFromTabnineFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "includeTools") converted.enabledTools = value;
 			else if (key === "excludeTools") converted.disabledTools = value;
-			else converted[key] = value;
+			else converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
 		result[serverName] = converted;
 	}
@@ -37625,6 +38775,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: true
 		}
 	}],
+	["commandcode", {
+		class: CommandcodeMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: false,
+			supportsDisabledTools: false
+		}
+	}],
 	["continue", {
 		class: ContinueMcp,
 		meta: {
@@ -37661,6 +38820,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: false
 		}
 	}],
+	["crush", {
+		class: CrushMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: true,
+			supportsDisabledTools: true
+		}
+	}],
 	["cursor", {
 		class: CursorMcp,
 		meta: {
@@ -38009,6 +39177,7 @@ var McpProcessor = class extends FeatureProcessor {
 		const toolMcps = await Promise.all([rulesyncMcp].map(async (mcp) => {
 			const targetedRulesyncMcp = mcp.forTarget({
 				toolTarget: this.toolTarget,
+				global: this.global,
 				logger: this.logger
 			});
 			const fieldsToStrip = [];
@@ -39092,7 +40261,7 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 function toAntigravityCliToolName(canonical) {
 	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$7(cliName) {
+function toCanonicalToolName$8(cliName) {
 	return ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES[cliName] ?? cliName;
 }
 /**
@@ -39308,7 +40477,7 @@ function convertAntigravityCliToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parsePermissionEntry$1(entry);
-			const canonical = toCanonicalToolName$7(toolName);
+			const canonical = toCanonicalToolName$8(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -39565,11 +40734,34 @@ const CANONICAL_TO_AUGMENT_TOOL_NAMES = {
 	websearch: "web-search"
 };
 const AUGMENT_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENT_TOOL_NAMES).map(([k, v]) => [v, k]));
+const CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES = {
+	terminal: "launch-process",
+	read: "view",
+	edit: "str-replace-editor",
+	write: "save-file"
+};
 function toAugmentToolName(canonical) {
-	return CANONICAL_TO_AUGMENT_TOOL_NAMES[canonical] ?? canonical;
+	return lookupOwn({
+		record: CANONICAL_TO_AUGMENT_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
 }
-function toCanonicalToolName$6(augmentName) {
-	return AUGMENT_TO_CANONICAL_TOOL_NAMES[augmentName] ?? augmentName;
+/**
+* Resolve an existing entry's `toolName` to the legacy spelling rulesync emits, so that the
+* current alias and the legacy name are treated as the same managed tool.
+*/
+function toLegacyAugmentToolName(augmentName) {
+	return lookupOwn({
+		record: CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES,
+		key: augmentName
+	}) ?? augmentName;
+}
+function toCanonicalToolName$7(augmentName) {
+	const legacyName = toLegacyAugmentToolName(augmentName);
+	return lookupOwn({
+		record: AUGMENT_TO_CANONICAL_TOOL_NAMES,
+		key: legacyName
+	}) ?? legacyName;
 }
 function actionToAugmentType(action) {
 	switch (action) {
@@ -39785,10 +40977,11 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 		const generatedKeys = new Set(generated.map((e) => `${e.toolName}|${e.shellInputRegex ?? ""}|${e.permission.type}`));
 		const preservedBasicEntries = basicExistingEntries.filter((entry) => {
 			if (entry.toolName === "*") return false;
-			if (!MANAGED_AUGMENT_TOOL_NAMES.has(entry.toolName)) return true;
+			const legacyToolName = toLegacyAugmentToolName(entry.toolName);
+			if (!MANAGED_AUGMENT_TOOL_NAMES.has(legacyToolName)) return true;
 			if (entry.permission.type === "deny") {
-				const key = `${entry.toolName}|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
-				return !generatedKeys.has(key);
+				const suffix = `|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
+				return !generatedKeys.has(`${entry.toolName}${suffix}`) && !generatedKeys.has(`${legacyToolName}${suffix}`);
 			}
 			return false;
 		});
@@ -40015,14 +41208,15 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 		if (isSpecialEntry(entry)) continue;
 		const type = entry.permission.type;
 		if (!isBasicAugmentType(type)) continue;
-		const canonical = toCanonicalToolName$6(entry.toolName);
+		const legacyToolName = toLegacyAugmentToolName(entry.toolName);
+		const canonical = toCanonicalToolName$7(entry.toolName);
 		if (forbiddenMapKeys.has(canonical)) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because it maps to the reserved object key '${canonical}', which cannot be used as a permission key.`);
 			continue;
 		}
 		const action = augmentTypeToAction(type);
 		let pattern;
-		if (entry.toolName === "launch-process" && entry.shellInputRegex) {
+		if (legacyToolName === "launch-process" && entry.shellInputRegex) {
 			const regex = entry.shellInputRegex;
 			if (isShellRegexRoundtrippable(regex)) pattern = shellRegexToGlob(regex);
 			else if (action === "deny") {
@@ -40037,9 +41231,19 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because its pattern resolves to the reserved object key '${pattern}'.`);
 			continue;
 		}
-		if (!permission[canonical]) permission[canonical] = {};
-		const existing = permission[canonical][pattern];
-		if (existing === void 0 || actionPriority[action] > actionPriority[existing]) permission[canonical][pattern] = action;
+		let bucket = lookupOwn({
+			record: permission,
+			key: canonical
+		});
+		if (bucket === void 0) {
+			bucket = {};
+			permission[canonical] = bucket;
+		}
+		const existing = lookupOwn({
+			record: bucket,
+			key: pattern
+		});
+		if (existing === void 0 || actionPriority[action] > actionPriority[existing]) bucket[pattern] = action;
 	}
 	return { permission };
 }
@@ -40250,7 +41454,7 @@ const CLAUDE_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONIC
 function toClaudeToolName(canonical) {
 	return CANONICAL_TO_CLAUDE_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$5(claudeName) {
+function toCanonicalToolName$6(claudeName) {
 	return CLAUDE_TO_CANONICAL_TOOL_NAMES[claudeName] ?? claudeName;
 }
 /**
@@ -41145,7 +42349,7 @@ function convertClaudeToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseClaudePermissionEntry(entry);
-			const canonical = toCanonicalToolName$5(toolName);
+			const canonical = toCanonicalToolName$6(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -41968,9 +43172,634 @@ function mapBashActionToDecision(action) {
 	return "forbidden";
 }
 //#endregion
+//#region src/features/permissions/commandcode-permissions.ts
+/** Top-level key of `.commandcode/settings.json` that rulesync owns. */
+const COMMANDCODE_PERMISSIONS_KEY = "permissions";
+const CATCH_ALL_PATTERN$6 = "*";
+const MCP_CANONICAL_PREFIX$5 = "mcp__";
+const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
+const CATEGORY_TO_COMMANDCODE_TOOL = {
+	bash: "Shell",
+	read: "Read",
+	edit: "Edit",
+	write: "Write",
+	grep: "Grep",
+	glob: "Glob",
+	webfetch: "WebFetch",
+	websearch: "WebSearch"
+};
+const COMMANDCODE_TOOL_TO_CATEGORY = {
+	...Object.fromEntries(Object.entries(CATEGORY_TO_COMMANDCODE_TOOL).map(([category, tool]) => [tool.toLowerCase(), category])),
+	bash: "bash",
+	powershell: "bash",
+	shell_command: "bash",
+	monitor_command: "bash",
+	kill_shell: "bash",
+	notebookedit: "edit",
+	write_file: "write",
+	web_fetch: "webfetch",
+	web_search: "websearch"
+};
+const ACTION_RANK$1 = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/** Whether `action` outranks `existing` (deny > ask > allow). */
+function isStricterAction({ action, existing }) {
+	return existing === void 0 || ACTION_RANK$1[action] > ACTION_RANK$1[existing];
+}
+/**
+* Why a padded `Shell( * )` cannot stand in for the bare `Shell` in `allow`:
+* the whitespace makes it a pattern rule, and a shell pattern grants only
+* commands that pass Command Code's pattern gate.
+*/
+const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (the command must parse into words and carry no environment assignment)";
+/**
+* Build a Command Code rule (`Shell(git *)`, `Read`, `mcp__github__get_issue`,
+* `mcp__*`, `*`) from a canonical category + pattern. Returns `null` for
+* categories Command Code cannot express so the caller can skip them.
+*
+* MCP tools are keyed by their canonical `mcp__server__tool` name, so a
+* scoped `mcp__<remainder>` category is written verbatim and the bare `mcp`
+* category becomes `mcp__*` (or `mcp__<pattern>` when the pattern names a
+* server or tool). A pattern on an MCP category is still written as the
+* `(specifier)` here; `writableCommandcodeRule` decides what to do with it,
+* because Command Code ignores it. The all-tools `*` category is only
+* written for its catch-all pattern; narrower `*` patterns are shell
+* restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
+*/
+function buildCommandcodeRule(category, pattern) {
+	const catchAll = pattern === CATCH_ALL_PATTERN$6 || pattern === "";
+	if (category.startsWith(MCP_CANONICAL_PREFIX$5)) return catchAll ? category : `${category}(${pattern})`;
+	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$5}${pattern}`;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$6 : null;
+	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
+	if (tool === void 0) return null;
+	return catchAll ? tool : `${tool}(${pattern})`;
+}
+/**
+* Split `Tool(specifier)` into its two halves the way Command Code's
+* `splitRule` does (`command-code` 1.54.0): the rule is split at the first
+* unescaped `(` and must end with `)`, the tool half is trimmed (so
+* `Shell (rm -rf *)` is a `Shell` rule), and a `\(` / `\)` in the specifier
+* is an escaped parenthesis. `Tool` alone has an empty specifier. A rule that
+* opens a parenthesis without closing one is not a rule to Command Code at
+* all, so it comes back with an empty tool half and stays unmodeled. Nothing
+* else in the specifier is touched: Command Code does not trim it (the shell
+* matcher normalizes whitespace on its own, see `parseCommandcodeRule`), so
+* `Read( )` is a rule for the pattern `" "`, which matches nothing, not for
+* the whole tool.
+*/
+function splitCommandcodeRule(rule) {
+	const trimmed = rule.trim();
+	const parenIndex = trimmed.search(/(?<!\\)\(/);
+	if (parenIndex === -1) return {
+		tool: trimmed,
+		inner: ""
+	};
+	if (!trimmed.endsWith(")")) return {
+		tool: "",
+		inner: ""
+	};
+	return {
+		tool: trimmed.slice(0, parenIndex).trim(),
+		inner: trimmed.slice(parenIndex + 1, -1).replace(/\\([()])/g, "$1")
+	};
+}
+/** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
+function isCatchAllSpecifier(inner) {
+	return inner === "" || inner === CATCH_ALL_PATTERN$6;
+}
+/**
+* Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
+* `parsePermissionRule` / `parseMcpToken`). The MCP shape is only recognized
+* by its exact `mcp__` prefix, and such a rule never carries a specifier:
+* `mcp__<server>__<tool>(owner:foo)` denies, asks or allows the whole tool.
+* Its names are matched case-sensitively against the registered server and
+* tool (Command Code never lowercases them), so the remainder keeps its case
+* as the canonical category. `mcp__<server>`, `mcp__<server>__` and
+* `mcp__<server>__*` are the whole server (category `mcp__<server>`), and a
+* `*` server (`mcp__*`, `mcp__*__<tool>`) is every MCP tool, honored in
+* `deny`/`ask` only. A differently-cased `MCP__...` spelling is read as a
+* plain tool-name rule instead, matched case-insensitively:
+* `MCP__<server>__<tool>` matches that tool by name (so it folds onto the
+* `mcp__` category, remainder as written), `MCP__<server>__<tool>(specifier)`
+* globs the specifier against the call's `command` / `file_path` / `path` /
+* `url` / `pattern` argument (in `deny`/`ask` a `param:glob` form is tried
+* first) — kept as a pattern in `deny`/`ask`, but not imported from `allow`,
+* where a grant scoped that way cannot be modeled without widening it; the
+* globs
+* `MCP__*` (every MCP tool) and `MCP__<server>__*` (the whole server) match
+* by name in `deny`/`ask` only, and `MCP__<server>` names no tool at all.
+* Whatever matches nothing anywhere (or a glob rulesync does not model)
+* returns `null` and is left alone.
+*/
+function parseMcpCommandcodeRule({ tool, inner }) {
+	const remainder = tool.slice(5);
+	const separator = remainder.indexOf("__");
+	const server = separator === -1 ? remainder : remainder.slice(0, separator);
+	const rest = separator === -1 ? "" : remainder.slice(separator + 2);
+	if (server.length === 0) return null;
+	const everyServer = {
+		category: "mcp",
+		pattern: CATCH_ALL_PATTERN$6,
+		notInAllow: true
+	};
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$5)) {
+		if (server === CATCH_ALL_PATTERN$6) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$6)) return null;
+		return {
+			category: rest === "" || rest === CATCH_ALL_PATTERN$6 ? `${MCP_CANONICAL_PREFIX$5}${server}` : `${MCP_CANONICAL_PREFIX$5}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$6,
+			notInAllow: false
+		};
+	}
+	const category = `${MCP_CANONICAL_PREFIX$5}${remainder}`;
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$6);
+	if (!isCatchAllSpecifier(inner)) return namesTool ? {
+		category,
+		pattern: inner,
+		notInAllow: true
+	} : null;
+	if (remainder === CATCH_ALL_PATTERN$6) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$6 && !server.includes(CATCH_ALL_PATTERN$6)) return {
+		category: `${MCP_CANONICAL_PREFIX$5}${server}`,
+		pattern: CATCH_ALL_PATTERN$6,
+		notInAllow: true
+	};
+	return namesTool ? {
+		category,
+		pattern: CATCH_ALL_PATTERN$6,
+		notInAllow: false
+	} : null;
+}
+/**
+* A rule on one of the friendly tools, with its specifier read as Command
+* Code matches it. The shell matcher trims and collapses whitespace on both
+* the pattern and the command, so `Shell( git  * )` is `Shell(git *)` and a
+* pattern that is blank once normalized (`Shell( )`), or a bare `:*` whose
+* prefix is empty (`Shell(:*)`), matches nothing. A padded `Shell( * )` is
+* not the bare `Shell`: only a specifier of exactly
+* `` or `*` is dropped by the rule parser, so `( * )` stays a pattern rule —
+* in `deny`/`ask` it matches every command (the whole tool), while in `allow`
+* it is narrower than the bare `Shell` (it needs a command that parses into
+* words and has no environment-assignment prefix), so it is the whole tool
+* marked `notInAllow`. The path, web and tool-name matchers use the
+* specifier as written, so one that is blank or `*` only once trimmed
+* (`Read( * )`) matches nothing. What matches nothing comes back as `null`:
+* the rule is unmodeled and left alone.
+*/
+function friendlyToolRule({ category, inner }) {
+	if (category === "bash") {
+		if (isCatchAllSpecifier(inner)) return {
+			category,
+			pattern: CATCH_ALL_PATTERN$6,
+			notInAllow: false
+		};
+		const normalized = inner.trim().replace(/\s+/g, " ");
+		if (normalized === "" || normalized === ":*") return null;
+		return isCatchAllSpecifier(normalized) ? {
+			category,
+			pattern: CATCH_ALL_PATTERN$6,
+			notInAllow: true
+		} : {
+			category,
+			pattern: normalized,
+			notInAllow: false
+		};
+	}
+	if (isCatchAllSpecifier(inner)) return {
+		category,
+		pattern: CATCH_ALL_PATTERN$6,
+		notInAllow: false
+	};
+	return isCatchAllSpecifier(inner.trim()) ? null : {
+		category,
+		pattern: inner,
+		notInAllow: false
+	};
+}
+/**
+* Parse a Command Code rule back into canonical terms. Tool names fold case;
+* `Tool`, `Tool()` and `Tool(*)` all mean the whole tool; MCP-shaped rules
+* go through `parseMcpCommandcodeRule`. Returns `null` for a rule rulesync
+* cannot model (an exact internal tool name such as `edit_file`, a
+* name-wildcard like `edit_*`, a specifier on a rule that takes none, or a
+* rule Command Code enforces nothing for, such as `Agent`).
+*/
+function parseCommandcodeRule(rule) {
+	const { tool, inner } = splitCommandcodeRule(rule);
+	if (tool === CATCH_ALL_PATTERN$6) return isCatchAllSpecifier(inner) ? {
+		category: "*",
+		pattern: CATCH_ALL_PATTERN$6,
+		notInAllow: true
+	} : null;
+	const lowered = tool.toLowerCase();
+	if (lowered.startsWith(MCP_CANONICAL_PREFIX$5)) return parseMcpCommandcodeRule({
+		tool,
+		inner
+	});
+	const category = Object.hasOwn(COMMANDCODE_TOOL_TO_CATEGORY, lowered) ? COMMANDCODE_TOOL_TO_CATEGORY[lowered] : void 0;
+	if (category === void 0) return null;
+	return friendlyToolRule({
+		category,
+		inner
+	});
+}
+/**
+* Whether an imported rule is a differently-cased `MCP__<server>__<tool>`
+* name that folded onto an exact-prefix `mcp__` category (which Command Code
+* matches case-sensitively, unlike the name rule it came from).
+*/
+function isFoldedMcpToolNameRule({ rule, category }) {
+	const { tool } = splitCommandcodeRule(rule);
+	return category.startsWith(MCP_CANONICAL_PREFIX$5) && !tool.startsWith(MCP_CANONICAL_PREFIX$5);
+}
+/** The `Tool` half of `Tool(specifier)`, when the rule is an exact-prefix MCP rule with a specifier. */
+function scopedMcpRuleTool(rule) {
+	const { tool, inner } = splitCommandcodeRule(rule);
+	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$5) ? tool : null;
+}
+/**
+* The string entries of a Command Code permission list. Command Code reads
+* each entry on its own and skips one that is not a string, so a stray
+* `null` beside `Shell(rm -rf *)` must not throw the deny away with it; the
+* skipped entries are counted in a warning because they cannot be kept.
+*/
+function stringRules({ list, action, outcome, warn }) {
+	if (!Array.isArray(list)) return [];
+	const rules = list.filter((entry) => typeof entry === "string");
+	const skipped = list.length - rules.length;
+	if (skipped > 0) warn(`Command Code permission list "${action}" holds ${skipped} ${skipped === 1 ? "entry" : "entries"} that ${skipped === 1 ? "is" : "are"} not a string, which Command Code skips; ${skipped === 1 ? "that entry was" : "those entries were"} ${outcome}.`);
+	return rules;
+}
+/**
+* The canonical categories this run rebuilds — every category the canonical
+* config names (an empty `bash: {}` still reclaims the previous `Shell(...)`
+* entries, as in the Claude Code adapter) plus every rule it emits, keyed the
+* way an existing entry parses back (so `mcp: { github: "deny" }`, written as
+* `mcp__github`, claims the `mcp__github` entries of the previous run; case
+* variants of the friendly tool names fold together, while MCP names are
+* matched exactly, as Command Code does). An existing entry whose tool folds onto one of them is
+* rulesync's to replace, whatever list it sits in — otherwise flipping a rule
+* from deny to allow would leave the old deny behind and win. Every other
+* entry — an internal tool name rulesync cannot model, or a modeled tool the
+* canonical config does not mention — is the user's (Command Code writes
+* interactive approvals into the same lists) and is preserved verbatim.
+* A `deny`/`ask` entry that is reclaimed without an equally strict rule
+* taking its place (say a hand-written `mcp__*` deny next to a canonical
+* `mcp: { github: "deny" }`) is reported, so regenerating never silently
+* loosens what the user wrote. Mirrors `managedClaudeToolNames` in the
+* Claude Code adapter.
+*/
+function preservedRules({ existingPermissions, key, managedCategories, written, logger }) {
+	return stringRules({
+		list: existingPermissions[key],
+		action: key,
+		outcome: "dropped from the regenerated list",
+		warn: (message) => logger?.warn(message)
+	}).filter((rule) => {
+		const parsed = parseCommandcodeRule(rule);
+		if (parsed === null || !managedCategories.has(parsed.category)) return true;
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$6})`);
+		if (key !== "allow" && isStricterAction({
+			action: key,
+			existing: replacement
+		})) logger?.warn(`Command Code permission rule '${rule}' in "${key}" belongs to the '${parsed.category}' category, which the rulesync config now manages, and was replaced by its rules.`);
+		return false;
+	});
+}
+/**
+* The rule to write for a canonical rule, or `null` when Command Code would
+* ignore it in the `action` list. A server-less wildcard (`*`, `mcp__*`) in
+* `allow` is warned about and left unwritten rather than written dead. A
+* specifier on an MCP rule is ignored by Command Code in every list, so a
+* scoped `deny`/`ask` is written as the bare tool (which is what Command
+* Code would enforce anyway, only now visibly) with a warning, and a scoped
+* `allow` — which would grant the whole tool — is refused. Judged on the
+* rule as written, so the bare `mcp` category cannot smuggle a specifier in
+* through a `<server>__<tool>(specifier)` pattern.
+*/
+function writableCommandcodeRule({ rule, emitted, action, logger }) {
+	if (action === "allow" && emitted.notInAllow) {
+		logger?.warn(emitted.category === "bash" ? `Command Code reads '${rule}' in "allow" as ${PADDED_SHELL_WILDCARD_REASON}, so the '${emitted.category}' allow rule was not written; use the '*' pattern for the whole tool.` : `Command Code does not honor '${rule}' in "allow" as written (an allow rule must name what it grants), so the '${emitted.category}' allow rule was not written.`);
+		return null;
+	}
+	const tool = scopedMcpRuleTool(rule);
+	if (tool === null) return rule;
+	if (action === "allow") {
+		logger?.warn(`Command Code ignores the specifier of an MCP rule and would allow the whole '${tool}' tool, so the '${rule}' allow rule was not written.`);
+		return null;
+	}
+	logger?.warn(`Command Code ignores the specifier of an MCP rule, so '${rule}' was written as '${tool}' and applies "${action}" to the whole tool.`);
+	return tool;
+}
+/**
+* Record `action` for `rule`, keeping the stricter one (deny > ask > allow)
+* when two canonical rules collapse onto the same Command Code entry.
+*/
+function rankCommandcodeRule({ ranked, rule, action, logger }) {
+	const existing = ranked.get(rule);
+	if (existing !== void 0 && existing !== action) logger?.warn(`Command Code permission rule '${rule}' received conflicting actions ('${existing}' and '${action}'); keeping the stricter one (deny > ask > allow).`);
+	if (isStricterAction({
+		action,
+		existing
+	})) ranked.set(rule, action);
+}
+/**
+* Bucket the canonical rules into Command Code's `allow`/`ask`/`deny` lists.
+* Collisions resolve to the strictest action (deny > ask > allow); categories
+* Command Code cannot express are skipped with a warning when they carry a
+* `deny`; rules Command Code would ignore in the target list are dropped or
+* rewritten by `writableCommandcodeRule`.
+*/
+function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
+	const permission = honorAllToolsOnBash(config.permission);
+	const ranked = /* @__PURE__ */ new Map();
+	const managedCategories = /* @__PURE__ */ new Set();
+	for (const [category, rules] of Object.entries(permission)) {
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$6);
+		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
+		if (managedCategory !== null) managedCategories.add(managedCategory.category);
+		for (const [pattern, action] of Object.entries(rules)) {
+			const rule = buildCommandcodeRule(category, pattern);
+			const emitted = rule === null ? null : parseCommandcodeRule(rule);
+			if (rule === null || emitted === null) {
+				const honoredOnShell = category === "*" && permission.bash !== void 0;
+				if (action === "deny" && !honoredOnShell) logger?.warn(`Command Code has no permission rule for the '${category}' category with pattern '${pattern}'; its 'deny' rule could not be represented and was skipped.`);
+				continue;
+			}
+			managedCategories.add(emitted.category);
+			const written = writableCommandcodeRule({
+				rule,
+				emitted,
+				action,
+				logger
+			});
+			if (written !== null) rankCommandcodeRule({
+				ranked,
+				rule: written,
+				action,
+				logger
+			});
+		}
+	}
+	const written = /* @__PURE__ */ new Map();
+	for (const [rule, action] of ranked) {
+		const parsed = parseCommandcodeRule(rule);
+		if (parsed !== null) written.set(`${parsed.category}(${parsed.pattern})`, action);
+	}
+	const preserved = {
+		existingPermissions,
+		managedCategories,
+		written,
+		logger
+	};
+	const allow = preservedRules({
+		...preserved,
+		key: "allow"
+	});
+	const ask = preservedRules({
+		...preserved,
+		key: "ask"
+	});
+	const deny = preservedRules({
+		...preserved,
+		key: "deny"
+	});
+	for (const [rule, action] of ranked) if (action === "allow") allow.push(rule);
+	else if (action === "ask") ask.push(rule);
+	else deny.push(rule);
+	return {
+		allow: (0, es_toolkit.uniq)(allow.toSorted()),
+		ask: (0, es_toolkit.uniq)(ask.toSorted()),
+		deny: (0, es_toolkit.uniq)(deny.toSorted())
+	};
+}
+/**
+* Why a rule marked `notInAllow` is not imported from `allow`: Command Code
+* ignores a server-less wildcard or a tool-name glob there, while it does
+* enforce a scoped `MCP__<server>__<tool>(specifier)` — as a glob over the
+* call's arguments — and a padded `Shell( * )` — as a pattern narrower than
+* the bare `Shell` — which rulesync cannot model in `allow` without widening
+* the grant.
+*/
+function skippedAllowImportMessage({ rule, category }) {
+	const { tool, inner } = splitCommandcodeRule(rule);
+	if (category === "bash") return `Command Code reads '${rule}' in "allow" as ${PADDED_SHELL_WILDCARD_REASON}, which rulesync cannot import without widening the grant to every command, so it was not imported.`;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$5) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
+	return `Command Code globs the specifier of '${rule}' in "allow" against the call's arguments, which rulesync cannot import without widening the grant to the whole tool, so it was not imported.`;
+}
+/**
+* Parse Command Code's `permissions` lists back into a canonical permission
+* map with `deny > ask > allow` precedence, so a tool described more than
+* once resolves to the strictest action. Each rule is imported as what
+* Command Code enforces for it, never as what it looks like: a rule Command
+* Code ignores in `allow` (`*`, `mcp__*`, an `MCP__...` glob) is skipped
+* there with a warning, since importing it would turn a dead line into a
+* live grant for every other target, and so is a scoped
+* `MCP__<server>__<tool>(specifier)` allow, which Command Code enforces as a
+* glob over the call's arguments but rulesync cannot import without widening
+* it to the whole tool; the specifier of an exact-prefix `mcp__...` rule,
+* which Command Code drops, is folded to the whole tool in every list — with
+* a warning in `allow`, where the fold widens the grant the user wrote. A
+* tool-half glob in that exact-prefix spelling (`mcp__<server>__get_*`), which
+* Command Code matches against tool names in every list, is imported as the
+* category spelled that way, the same one the generator writes back; other
+* targets read it as a literal tool name.
+*/
+function parseCommandcodeRuleLists(permissions) {
+	const permission = {};
+	const lists = [
+		["allow", permissions.allow],
+		["ask", permissions.ask],
+		["deny", permissions.deny]
+	];
+	for (const [action, rawList] of lists) {
+		const list = stringRules({
+			list: rawList,
+			action,
+			outcome: "not imported",
+			warn: (message) => fallbackLogger.warn(message)
+		});
+		for (const rule of list) {
+			const parsed = parseCommandcodeRule(rule);
+			if (parsed === null || isPrototypePollutionKey(parsed.category) || isPrototypePollutionKey(parsed.pattern)) {
+				if (action !== "allow") fallbackLogger.warn(`Command Code permission rule '${rule}' in "${action}" is not one rulesync can model, so it could not be imported; it stays in the Command Code settings, where a regenerate keeps it unless the canonical config manages its category.`);
+				continue;
+			}
+			const { category, pattern } = parsed;
+			if (action === "allow" && parsed.notInAllow) {
+				fallbackLogger.warn(skippedAllowImportMessage({
+					rule,
+					category
+				}));
+				continue;
+			}
+			if (action === "allow" && scopedMcpRuleTool(rule) !== null) fallbackLogger.warn(`Command Code ignores the specifier of an MCP rule, so '${rule}' in "allow" was imported as the whole '${category}' tool, which is what Command Code grants for it.`);
+			if (isFoldedMcpToolNameRule({
+				rule,
+				category
+			})) fallbackLogger.warn(`Command Code matches '${rule}' in "${action}" against MCP tool names case-insensitively, but the '${category}' rule generated from it matches the server and tool names exactly as written; spell the rule the way the tool is registered if they differ.`);
+			const rules = permission[category] ??= {};
+			if (isStricterAction({
+				action,
+				existing: rules[pattern]
+			})) rules[pattern] = action;
+		}
+	}
+	return permission;
+}
+/**
+* Permissions generator for Command Code.
+*
+* Rules live under the `permissions` key of `.commandcode/settings.json`
+* (project) and `~/.commandcode/settings.json` (user) as three lists of
+* Claude-style entries: `deny` (always wins), `ask`, `allow`. The same key
+* also carries `defaultMode`, `additionalDirectories` and `disableBypass`,
+* and the file holds `hooks` and other settings, so writes go through the
+* shared-config gateway: rulesync replaces the three lists, keeps every
+* sibling key, and never deletes the file.
+*
+* Generate: `permission.<category>.<pattern>` becomes `Tool(pattern)` with
+* the friendly names (`Shell`, `Read`, `Edit`, `Write`, `WebFetch`,
+* `WebSearch`), `mcp__<server>__<tool>` names pass through, and the all-tools
+* `*` category becomes the bare `*` rule Command Code accepts in `deny`/`ask`.
+* Only the entries of the categories the canonical config names are rebuilt;
+* every other existing entry is preserved verbatim.
+* Import: the lists are parsed back as what Command Code enforces for each
+* entry — friendly tool names case-insensitively (with the internal aliases
+* such as `Bash`, `PowerShell` and `write_file` folding onto their
+* category), MCP names exactly; rules for internal tool names rulesync does
+* not model are skipped.
+*
+* @see https://commandcode.ai/docs/permissions
+* @see https://commandcode.ai/docs/settings
+*/
+var CommandcodePermissions = class CommandcodePermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? "{}"
+		});
+	}
+	/**
+	* `settings.json` holds hooks and other user settings, so it is never
+	* deleted; clearing permissions happens via an in-place merge.
+	*/
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: COMMANDCODE_DIR,
+			relativeFilePath: COMMANDCODE_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = CommandcodePermissions.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new CommandcodePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
+		const paths = CommandcodePermissions.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const existing = parseCommandcodeSettings({
+			fileContent: existingContent,
+			relativePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)
+		});
+		const existingPermissions = isRecord$1(existing[COMMANDCODE_PERMISSIONS_KEY]) ? existing[COMMANDCODE_PERMISSIONS_KEY] : {};
+		const lists = buildCommandcodeRuleLists({
+			config: rulesyncPermissions.getJson(),
+			existingPermissions,
+			logger
+		});
+		const permissions = { ...existingPermissions };
+		for (const key of [
+			"allow",
+			"ask",
+			"deny"
+		]) if (lists[key].length > 0) permissions[key] = lists[key];
+		else delete permissions[key];
+		return new CommandcodePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: { [COMMANDCODE_PERMISSIONS_KEY]: permissions },
+				filePath
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const settings = parseCommandcodeSettings({
+			fileContent: this.getFileContent() || "{}",
+			relativePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())
+		});
+		const permissions = isRecord$1(settings[COMMANDCODE_PERMISSIONS_KEY]) ? settings[COMMANDCODE_PERMISSIONS_KEY] : {};
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission: parseCommandcodeRuleLists(permissions) }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CommandcodePermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+/**
+* Fail closed on a syntax error or non-object root, matching the write path's
+* shared-config declaration, so a broken file is surfaced rather than
+* partially imported or overwritten.
+*/
+function parseCommandcodeSettings({ fileContent, relativePath }) {
+	try {
+		return parseSharedConfig({
+			format: "json",
+			fileContent,
+			filePath: relativePath,
+			invalidRootPolicy: "error"
+		});
+	} catch (error) {
+		throw new Error(`Failed to parse Command Code settings in ${relativePath}: ${formatError(error)}`, { cause: error });
+	}
+}
+//#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$4 = "*";
+const CATCH_ALL_PATTERN$5 = "*";
+/**
+* A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
+* would match `Tool(**)` against every argument just as the bare tool name
+* does, so it is written — and, under the all-tools category, honored — as
+* the bare entry instead of being skipped as a pattern-specific rule.
+*/
+function normalizeCatchAllPattern$1(pattern) {
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$5 : pattern;
+}
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
 	read: "Read",
@@ -41998,7 +43827,7 @@ const CONTINUE_PATTERN_RE = /^([^(]+)(?:\(([^)]*)\))?$/;
 function toContinueToolName(canonical) {
 	return Object.hasOwn(CANONICAL_TO_CONTINUE_TOOL_NAMES, canonical) ? CANONICAL_TO_CONTINUE_TOOL_NAMES[canonical] ?? canonical : canonical;
 }
-function toCanonicalToolName$4(continueName) {
+function toCanonicalToolName$5(continueName) {
 	return Object.hasOwn(CONTINUE_TO_CANONICAL_TOOL_NAMES, continueName) ? CONTINUE_TO_CANONICAL_TOOL_NAMES[continueName] ?? continueName : continueName;
 }
 /**
@@ -42006,7 +43835,7 @@ function toCanonicalToolName$4(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$4 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$5 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -42020,7 +43849,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$4 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$5 : pattern
 	};
 }
 /**
@@ -42187,13 +44016,14 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		if (isPrototypePollutionKey(category)) continue;
 		const toolName = category === "*" ? "*" : toContinueToolName(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (isPrototypePollutionKey(pattern)) continue;
+		for (const [rawPattern, action] of Object.entries(rules)) {
+			if (isPrototypePollutionKey(rawPattern)) continue;
+			const pattern = normalizeCatchAllPattern$1(rawPattern);
 			if (pattern.includes("(") || pattern.includes(")")) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$4) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$5) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -42218,7 +44048,7 @@ function convertContinuePermissionsToRulesync(lists) {
 			const parsedEntry = parseContinuePermissionEntry(entry);
 			if (parsedEntry === void 0) continue;
 			if (isPrototypePollutionKey(parsedEntry.toolName) || isPrototypePollutionKey(parsedEntry.pattern)) continue;
-			const category = toCanonicalToolName$4(parsedEntry.toolName);
+			const category = toCanonicalToolName$5(parsedEntry.toolName);
 			permission[category] ??= {};
 			permission[category][parsedEntry.pattern] ??= action;
 		}
@@ -42541,6 +44371,295 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 	}
 };
 //#endregion
+//#region src/features/permissions/crush-permissions.ts
+const CATCH_ALL_PATTERN$4 = "*";
+/**
+* A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
+* argument patterns at all, so it is the only pattern a rule can carry and
+* still be written.
+*/
+function normalizeCatchAllPattern(pattern) {
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$4 : pattern;
+}
+const CANONICAL_TO_CRUSH_TOOL_NAMES = {
+	bash: "bash",
+	read: "view",
+	edit: "edit",
+	write: "write",
+	grep: "grep",
+	glob: "glob",
+	webfetch: "fetch"
+};
+const CRUSH_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_TOOL_NAMES).map(([k, v]) => [v, k]));
+const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const MCP_CRUSH_PREFIX = "mcp_";
+function toCrushToolName(canonical) {
+	if (Object.hasOwn(CANONICAL_TO_CRUSH_TOOL_NAMES, canonical)) return CANONICAL_TO_CRUSH_TOOL_NAMES[canonical] ?? canonical;
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX$4) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
+	return canonical;
+}
+function toCanonicalToolName$4(crushName) {
+	return Object.hasOwn(CRUSH_TO_CANONICAL_TOOL_NAMES, crushName) ? CRUSH_TO_CANONICAL_TOOL_NAMES[crushName] ?? crushName : crushName;
+}
+function isMcpToolName(crushName) {
+	return crushName.startsWith(MCP_CRUSH_PREFIX) && crushName.length > 4;
+}
+function uniq$9(values) {
+	return [...new Set(values)];
+}
+/**
+* Permissions adapter for Crush.
+*
+* Crush has no per-argument permission rules. Its JSON config carries two
+* tool-level lists instead:
+*   - `permissions.allowed_tools`: tools (or `tool:action` pairs) that run
+*     without a permission prompt; everything else prompts.
+*   - `options.disabled_tools`: built-in tools removed from the agent
+*     entirely.
+*
+* Mapping (rulesync canonical -> Crush), catch-all (`*`) rules only:
+*   - `allow` -> an `allowed_tools` entry.
+*   - `deny` -> a `disabled_tools` entry. Crush only filters its built-ins
+*     through that list, so a deny for an MCP tool is reported and skipped
+*     (disable the tool in the MCP server's `disabled_tools` instead).
+*   - `ask` -> nothing (prompting is Crush's default).
+*   - Tool name: `bash` -> `bash`, `read` -> `view`, `edit` -> `edit`,
+*     `write` -> `write`, `grep` -> `grep`, `glob` -> `glob`,
+*     `webfetch` -> `fetch`, `mcp__<server>__<tool>` -> `mcp_<server>_<tool>`;
+*     any other category passes through verbatim.
+*
+* A pattern-specific rule cannot be expressed and is reported and skipped.
+* Because Crush cannot narrow an allowed tool, a category's catch-all `allow`
+* is not written while the same category carries a pattern-specific `deny` or
+* `ask`: the tool keeps prompting (fail closed) rather than being widened to
+* everything. The all-tools `*` category is mirrored onto `bash` by
+* `honorAllToolsOnBash` and otherwise skipped, since Crush has no allow-all
+* or disable-all list.
+*
+* `crush.json` is Crush's main config: entries naming a tool the canonical
+* config does not manage, and every `tool:action` entry (a form rulesync
+* never derives), are preserved verbatim; the managed tools' bare entries
+* are rebuilt, every other key of `permissions` / `options` and of the file is
+* kept, and the file is never deleted. Project scope writes `crush.json`, or
+* an existing `.crush.json`; Crush merges the pair (lists concatenated), so an
+* entry left in the other file stays in effect and is reported.
+*
+* @see https://github.com/charmbracelet/crush/blob/main/docs/config/README.md
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/config.go
+* @see https://github.com/charmbracelet/crush/blob/main/internal/permission/permission.go
+*/
+var CrushPermissions = class CrushPermissions extends ToolPermissions {
+	json;
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+		this.json = parseCrushConfig(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	/**
+	* `crush.json` is Crush's file: rulesync merges into it when it exists but
+	* does not create one that holds nothing of its own — an absent file and an
+	* absent `allowed_tools` both mean "prompt for everything".
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return getCrushConfigSettablePaths({ global });
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: crushConfigImportContent(location),
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
+		const location = await resolveCrushConfigFile({
+			outputRoot,
+			global
+		});
+		const existingContent = location.fileContent ?? "";
+		warnCrushTwinLeftovers({
+			location,
+			ownedPaths: [[CRUSH_PERMISSIONS_KEY, CRUSH_ALLOWED_TOOLS_KEY], [CRUSH_OPTIONS_KEY, CRUSH_DISABLED_TOOLS_KEY]],
+			logger
+		});
+		const existing = parseCrushConfig(existingContent, location.filePath);
+		const existingPermissions = isRecord$1(existing["permissions"]) ? existing[CRUSH_PERMISSIONS_KEY] : void 0;
+		const existingOptions = isRecord$1(existing["options"]) ? existing[CRUSH_OPTIONS_KEY] : void 0;
+		const config = rulesyncPermissions.getJson();
+		const generated = convertRulesyncToCrushLists({
+			config,
+			logger
+		});
+		const managedToolNames = managedCrushToolNames(config);
+		const preservedAllowed = (isStringArray$2(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
+		const preservedDisabled = (isStringArray$2(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
+		const allowedList = uniq$9([...preservedAllowed, ...generated.allowed]);
+		const disabledList = uniq$9([...preservedDisabled, ...generated.disabled]);
+		const patch = {};
+		if (allowedList.length > 0 || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = { [CRUSH_ALLOWED_TOOLS_KEY]: allowedList.length > 0 ? allowedList : void 0 };
+		if (disabledList.length > 0 || existingOptions !== void 0) patch[CRUSH_OPTIONS_KEY] = { [CRUSH_DISABLED_TOOLS_KEY]: disabledList.length > 0 ? disabledList : void 0 };
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath: location.relativeDirPath,
+			relativeFilePath: location.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(CrushPermissions.getSettablePaths({ global })),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath: location.filePath,
+				logger
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const permissions = isRecord$1(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
+		const options = isRecord$1(this.json["options"]) ? this.json[CRUSH_OPTIONS_KEY] : {};
+		const rulesyncConfig = convertCrushListsToRulesync({
+			allowed: isStringArray$2(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
+			disabled: isStringArray$2(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CrushPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+/**
+* The Crush tool names the canonical config manages, i.e. the names its
+* categories map to. Entries naming any other tool are the user's and survive
+* a generate. The all-tools `*` category names no Crush tool of its own.
+*/
+function managedCrushToolNames(config) {
+	return new Set(Object.keys(config.permission).filter((category) => category !== "*" && !isPrototypePollutionKey(category)).map((category) => toCrushToolName(category)));
+}
+/**
+* Reduce one category's rules to the single tool-wide action Crush can carry,
+* or undefined when nothing should be written for the tool: no catch-all rule,
+* a catch-all allow next to a narrower deny/ask (Crush cannot narrow an
+* allowed tool, so it keeps prompting instead), or a deny on an MCP tool
+* (`options.disabled_tools` only covers built-ins).
+*/
+function resolveCategoryAction({ category, toolName, rules, logger }) {
+	let catchAllAction;
+	let restricted = false;
+	for (const [rawPattern, action] of Object.entries(rules)) {
+		if (isPrototypePollutionKey(rawPattern)) continue;
+		const pattern = normalizeCatchAllPattern(rawPattern);
+		if (pattern === CATCH_ALL_PATTERN$4) {
+			catchAllAction = action;
+			continue;
+		}
+		logger?.warn(`Crush permissions are tool-wide (no argument patterns), so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
+		if (action !== "allow") restricted = true;
+	}
+	if (catchAllAction === "allow" && restricted) {
+		logger?.warn(`Crush cannot narrow an allowed tool, so "${category}" is not added to permissions.allowed_tools while it carries a pattern-specific deny/ask rule; Crush keeps prompting for "${toolName}".`);
+		return;
+	}
+	if (catchAllAction === "deny" && isMcpToolName(toolName)) {
+		logger?.warn(`Crush's options.disabled_tools only covers built-in tools, so the "deny" rule for "${category}" was skipped; disable the tool through the MCP server's "disabled_tools" instead.`);
+		return;
+	}
+	return catchAllAction;
+}
+/**
+* Convert a rulesync permissions config into Crush's two tool lists.
+*/
+function convertRulesyncToCrushLists({ config, logger }) {
+	const lists = {
+		allowed: [],
+		disabled: []
+	};
+	const actionByTool = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
+		if (isPrototypePollutionKey(category)) continue;
+		if (category === "*") {
+			for (const [rawPattern, action] of Object.entries(rules)) {
+				if (isPrototypePollutionKey(rawPattern)) continue;
+				logger?.warn(`Crush has no allow-all or disable-all tool list, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(rawPattern)}) was skipped.`);
+			}
+			continue;
+		}
+		const toolName = toCrushToolName(category);
+		const catchAllAction = resolveCategoryAction({
+			category,
+			toolName,
+			rules,
+			logger
+		});
+		if (catchAllAction === void 0) continue;
+		const previous = actionByTool.get(toolName);
+		if (previous !== void 0 && previous !== catchAllAction) logger?.warn(`Crush permissions: rules from different categories both resolve to ${quoteValueForWarning(toolName)} with conflicting actions (${previous} and ${catchAllAction}). Both are written; a disabled tool is hidden from the agent regardless of allowed_tools.`);
+		actionByTool.set(toolName, catchAllAction);
+		if (catchAllAction === "allow") lists.allowed.push(toolName);
+		else if (catchAllAction === "deny") lists.disabled.push(toolName);
+	}
+	return {
+		allowed: uniq$9(lists.allowed),
+		disabled: uniq$9(lists.disabled)
+	};
+}
+/**
+* Convert Crush's two tool lists back into a rulesync config. A `tool:action`
+* entry scopes an allow to one action of a tool, which the canonical model
+* cannot express, so it is left out rather than widened to the whole tool.
+*/
+function convertCrushListsToRulesync({ allowed, disabled }) {
+	const permission = {};
+	const bucketFor = (category) => {
+		const own = lookupOwn({
+			record: permission,
+			key: category
+		});
+		if (own !== void 0) return own;
+		const created = {};
+		permission[category] = created;
+		return created;
+	};
+	for (const entry of disabled) {
+		if (entry === "" || isPrototypePollutionKey(entry)) continue;
+		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] = "deny";
+	}
+	for (const entry of allowed) {
+		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
+		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] ??= "allow";
+	}
+	return { permission };
+}
+//#endregion
 //#region src/features/permissions/cursor-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Cursor CLI
@@ -43695,6 +45814,40 @@ function convertDeepagentsToRulesyncPermissions({ allowList }) {
 	return Object.keys(bash).length > 0 ? { permission: { bash } } : { permission: {} };
 }
 //#endregion
+//#region src/features/permissions/single-action-collapse.ts
+/**
+* Strictness order shared by the tools whose permission model evaluates
+* `deny > ask > allow`. Used wherever several canonical rules have to fold
+* into one entry, so the strictest action always wins.
+*/
+const PERMISSION_ACTION_PRIORITY = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+/**
+* Collapse a pattern map to the single action a tool can hold for a scope
+* that has no pattern matcher, using deny > ask > allow precedence.
+*
+* A map without a catch-all grants nothing to unmatched inputs, so an
+* implicit `ask` joins the candidates and a narrow allowlist can never widen
+* into a blanket allow. Returns `undefined` for an empty map; each caller
+* decides what an empty map means for its tool (e.g. emit nothing, or fall
+* back to `deny` when the tool's own default is allow).
+*/
+function collapseRulesToSingleAction({ rules }) {
+	const actions = Object.values(rules);
+	if (actions.length === 0) return;
+	return (Object.hasOwn(rules, "*") ? actions : [...actions, "ask"]).reduce((current, candidate) => PERMISSION_ACTION_PRIORITY[candidate] > PERMISSION_ACTION_PRIORITY[current] ? candidate : current);
+}
+/**
+* Whether a pattern map carries anything beyond the `*` catch-all, i.e.
+* whether collapsing it to a single action loses information worth a warning.
+*/
+function hasPatternSpecificRules(rules) {
+	return Object.keys(rules).some((pattern) => pattern !== "*");
+}
+//#endregion
 //#region src/features/permissions/devin-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names to Devin Local permission
@@ -43704,17 +45857,21 @@ function convertDeepagentsToRulesyncPermissions({ allowList }) {
 * `Write(glob)`, `Exec(prefix)`, and `Fetch(pattern)` — plus MCP tool patterns
 * (`mcp__server__tool`). The canonical `edit` and `write` categories both map
 * onto Devin's single `Write` scope; on import `Write` maps back to `write`, so
-* `edit` rules round-trip as `write` (a lossy but documented collapse). Unknown
+* `edit` rules round-trip as `write` (a lossy but documented collapse). The
+* canonical `websearch` category maps onto the bare `web_search` tool name,
+* accepted in the permission lists since CLI v3000.10.21 (2026-09-10). Unknown
 * names (e.g. `mcp__github__list_issues`) pass through verbatim.
 *
 * @see https://docs.devin.ai/cli/reference/permissions
+* @see https://docs.devin.ai/cli/changelog/stable — v3000.10.21, `web_search`
 */
 const CANONICAL_TO_DEVIN_SCOPE = {
 	read: "Read",
 	write: "Write",
 	edit: "Write",
 	bash: "Exec",
-	webfetch: "Fetch"
+	webfetch: "Fetch",
+	websearch: "web_search"
 };
 /**
 * Reverse mapping from Devin scope matchers to rulesync canonical names.
@@ -43723,8 +45880,15 @@ const DEVIN_SCOPE_TO_CANONICAL = {
 	Read: "read",
 	Write: "write",
 	Exec: "bash",
-	Fetch: "webfetch"
+	Fetch: "webfetch",
+	web_search: "websearch"
 };
+/**
+* Devin scopes that exist only as a bare tool name: there is no
+* `web_search(pattern)` matcher, so a pattern-specific rule under the canonical
+* category cannot be expressed and is collapsed to one action instead.
+*/
+const DEVIN_BARE_ONLY_SCOPES = /* @__PURE__ */ new Set(["web_search"]);
 function toDevinScope(canonical) {
 	return CANONICAL_TO_DEVIN_SCOPE[canonical] ?? canonical;
 }
@@ -43909,7 +46073,10 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse existing Devin config at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
-		const { allow, ask, deny } = convertRulesyncToDevinPermissions(config);
+		const { allow, ask, deny } = convertRulesyncToDevinPermissions({
+			config,
+			logger
+		});
 		const managedScopes = new Set(Object.keys(config.permission).map((category) => toDevinScope(category)));
 		const existingPermissions = isRecord$1(settings.permissions) ? settings.permissions : {};
 		const preserve = (entries) => (entries ?? []).filter((entry) => !managedScopes.has(parseDevinPermissionEntry(entry).scope));
@@ -44013,26 +46180,50 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	}
 };
 /**
+* Collapse the pattern rules of a bare-only scope to the single action Devin
+* can hold for it, using deny > ask > allow precedence. A map without a
+* catch-all grants nothing to unmatched inputs, so an implicit `ask` joins the
+* candidates and a narrow allowlist can never widen into a blanket allow.
+* Returns `undefined` for an empty map: like any other empty category it
+* emits nothing, which leaves Devin's own auto-approve default in place.
+*/
+function collapseBareOnlyScopeRules({ category, scope, rules, logger }) {
+	const action = collapseRulesToSingleAction({ rules });
+	if (action === void 0) return;
+	if (hasPatternSpecificRules(rules)) logger?.warn(`Devin accepts "${scope}" only as a bare tool name, with no pattern matcher. Collapsed the "${category}" pattern rules to "${action}" using deny > ask > allow precedence.`);
+	return action;
+}
+/**
 * Convert rulesync permissions config to Devin allow/ask/deny arrays.
 */
-function convertRulesyncToDevinPermissions(config) {
+function convertRulesyncToDevinPermissions({ config, logger }) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
+	const push = (entry, action) => {
+		switch (action) {
+			case "allow":
+				allow.push(entry);
+				break;
+			case "ask":
+				ask.push(entry);
+				break;
+			case "deny": deny.push(entry);
+		}
+	};
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const scope = toDevinScope(category);
-		for (const [pattern, action] of Object.entries(rules)) {
-			const entry = buildDevinPermissionEntry(scope, pattern);
-			switch (action) {
-				case "allow":
-					allow.push(entry);
-					break;
-				case "ask":
-					ask.push(entry);
-					break;
-				case "deny": deny.push(entry);
-			}
+		if (DEVIN_BARE_ONLY_SCOPES.has(scope)) {
+			const action = collapseBareOnlyScopeRules({
+				category,
+				scope,
+				rules,
+				logger
+			});
+			if (action !== void 0) push(scope, action);
+			continue;
 		}
+		for (const [pattern, action] of Object.entries(rules)) push(buildDevinPermissionEntry(scope, pattern), action);
 	}
 	return {
 		allow,
@@ -46278,20 +48469,14 @@ const OPENCODE_ACTION_ONLY_PERMISSION_KEYS = /* @__PURE__ */ new Set([
 	"question",
 	"doom_loop"
 ]);
-const PERMISSION_ACTION_PRIORITY = {
-	allow: 0,
-	ask: 1,
-	deny: 2
-};
 function toOpencodePermission({ category, value, logger }) {
 	if (typeof value === "string" || !OPENCODE_ACTION_ONLY_PERMISSION_KEYS.has(category)) return value;
-	const actions = Object.values(value);
-	if (actions.length === 0) {
+	const action = collapseRulesToSingleAction({ rules: value });
+	if (action === void 0) {
 		logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its empty pattern map to "deny" to avoid falling back to OpenCode's default allow behavior.`);
 		return "deny";
 	}
-	const action = (Object.hasOwn(value, "*") ? actions : [...actions, "ask"]).reduce((current, candidate) => PERMISSION_ACTION_PRIORITY[candidate] > PERMISSION_ACTION_PRIORITY[current] ? candidate : current);
-	if (Object.keys(value).some((pattern) => pattern !== "*")) logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its pattern rules to "${action}" using deny > ask > allow precedence.`);
+	if (hasPatternSpecificRules(value)) logger?.warn(`OpenCode's "${category}" permission accepts only a single action. Collapsed its pattern rules to "${action}" using deny > ask > allow precedence.`);
 	return action;
 }
 /**
@@ -46669,6 +48854,7 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"visible",
 	"eager",
 	"listDirectory",
+	"todoWrite",
 	"workflowsEnabled"
 ];
 const QWEN_OVERRIDE_SECURITY_KEYS = [
@@ -46774,6 +48960,11 @@ const QWEN_OVERRIDE_GROUPS = [{
 			rule: "global-machine-wide",
 			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`list_directory\` tool is registered in this repository.`,
 			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `list_directory` tool is registered for every project on this machine."
+		},
+		todoWrite: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`todo_write\` tool is registered in this repository.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `todo_write` tool is registered for every project on this machine."
 		}
 	}
 }, {
@@ -48580,9 +50771,25 @@ function widenToPrefixGlob(pattern) {
 function toShellEntry(prefix) {
 	return prefix === "" ? SHELL_TOOL_NAME : `${SHELL_TOOL_NAME}(${prefix})`;
 }
-/** The `bash` pattern a `run_shell_command(<prefix>)` entry stands for. */
+/**
+* The `bash` pattern a `run_shell_command(<prefix>)` entry stands for. A
+* prefix Tabnine matches literally, so one an author spelled glob-like
+* (`git *`, `*`) is read as the glob it looks like rather than doubled into
+* `git * *`, which no comparison or warning could make sense of.
+*/
 function toShellPattern(prefix) {
-	return prefix === void 0 || prefix === "" ? "*" : `${prefix} *`;
+	if (prefix === void 0 || prefix === "" || prefix === "*") return "*";
+	return prefix.endsWith(" *") ? prefix : `${prefix} *`;
+}
+/**
+* Whether {@link toShellPattern} read the prefix as a glob: such an entry
+* would never fire on Tabnine as spelled (the prefix is matched literally, so
+* `run_shell_command(git *)` only matches a command line starting with the
+* two characters `git *`), and rulesync writes it back as the prefix the glob
+* denotes — a wider entry that the author is told about.
+*/
+function isGlobSpelledPrefix(prefix) {
+	return prefix !== void 0 && (prefix === "*" || prefix.endsWith(" *"));
 }
 /**
 * Split a `tools.allowed`/`tools.exclude` entry into its tool name and the
@@ -48708,7 +50915,7 @@ function collectTrustAffectingOverrideEntries({ tools, general }) {
 	const allowed = isStringArray$2(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
 	if (allowed.length > 0) entries.push({
 		label: `tools.allowed (${allowed.map(quoteValueForWarning).join(", ")})`,
-		reason: "auto-approves what it names as the override spells it; a non-shell entry has no canonical rule to be checked against"
+		reason: "auto-approves what it names as the override spells it; a non-shell entry is only checked against a whole-tool deny of its tool"
 	});
 	if (Object.hasOwn(tools, SANDBOX_KEY) && isNotTrue(tools[SANDBOX_KEY])) entries.push({
 		label: `tools.sandbox = ${quoteValueForWarning(tools[SANDBOX_KEY])}`,
@@ -48819,6 +51026,54 @@ function buildToolLists({ permission, overrideShellAllowPatterns, logger }) {
 	};
 }
 /**
+* Names the glob-spelled `run_shell_command(...)` override entries that were
+* written as the prefix their glob denotes. Said only for the entries that
+* made it into the list: one that a deny or ask overlaps is announced as
+* withheld by the comparison instead, and one whose glob names no prefix at
+* all is skipped by it.
+*/
+function warnAboutGlobSpelledOverrideEntries({ entries, allowed, logger }) {
+	for (const { entry, pattern } of entries) {
+		const prefix = toShellPrefix(pattern);
+		const written = prefix === void 0 ? void 0 : toShellEntry(prefix);
+		if (written === void 0 || !allowed.includes(written)) continue;
+		warnWithFallback(logger, `Tabnine CLI permissions: read tools.allowed entry ${quoteValueForWarning(entry)} of the tabnine override as the 'bash' allow rule ${quoteValueForWarning(pattern)}; Tabnine matches a prefix literally, so it is written as ${quoteValueForWarning(written)}, which auto-approves every command it covers.`);
+	}
+}
+/**
+* A verbatim override allow naming a tool the canonical block denies is
+* withheld the way a shadowed `bash` allow is: Tabnine never loads an excluded
+* tool whatever `allowed` says, so the entry would only ever contradict the
+* deny it sits beside — and an override is not a way around a canonical rule.
+* Returns the entries that may be written.
+*/
+function withholdDeniedOverrideAllowed({ overrideVerbatimAllowed, exclude, logger }) {
+	const denied = overrideVerbatimAllowed.filter((entry) => {
+		const toolName = parseTabnineEntry(entry)?.toolName;
+		return toolName !== void 0 && exclude.includes(toolName);
+	});
+	if (denied.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: withheld ${denied.length} tools.allowed entry(ies) of the tabnine override (${denied.map(quoteValueForWarning).join(", ")}) that name a tool the canonical block denies; Tabnine never loads an excluded tool, so remove the deny rule from .rulesync/permissions.jsonc to allow it.`);
+	return overrideVerbatimAllowed.filter((entry) => !denied.includes(entry));
+}
+/**
+* The entries of a managed tool that the canonical block did not re-derive are
+* named rather than removed silently. Dropping an exclude loosens the policy,
+* so it is a warning; dropping an allow only brings back Tabnine's confirmation
+* prompt, so it is said at info level for the author who wonders where a
+* hand-written entry went.
+*/
+function reportDroppedManagedEntries({ existingTools, allowedList, excludeList, logger }) {
+	const dropped = (key, list) => (0, es_toolkit.uniq)(isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+		if (list.includes(entry)) return false;
+		const toolName = parseTabnineEntry(entry)?.toolName;
+		return toolName === void 0 || !list.includes(toolName);
+	});
+	const droppedExclude = dropped(EXCLUDE_KEY, excludeList);
+	if (droppedExclude.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: removed ${droppedExclude.length} existing tools.exclude entry(ies) (${droppedExclude.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add a deny rule to .rulesync/permissions.jsonc to keep them.`);
+	const droppedAllowed = dropped(ALLOWED_KEY, allowedList);
+	if (droppedAllowed.length > 0) (logger ?? moduleLogger$1).info(`Tabnine CLI permissions: removed ${droppedAllowed.length} existing tools.allowed entry(ies) (${droppedAllowed.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add an allow rule to .rulesync/permissions.jsonc to keep them.`);
+}
+/**
 * Permissions generator for the Tabnine CLI.
 *
 * Tabnine CLI keeps its tool policy in `.tabnine/agent/settings.json` (project)
@@ -48884,7 +51139,10 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		const config = rulesyncPermissions.getJson();
 		const override = isRecord$1(config.tabnine) ? config.tabnine : {};
 		const { tools: overrideTools, general: overrideGeneral, refused: refusedPaths } = stripRefusedOverridePaths(override);
-		if (refusedPaths.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: refused to write ${refusedPaths.join(", ")} from the tabnine override; Tabnine CLI runs that value as a command or sends its traffic to it, and a permissions file (one that came from 'rulesync fetch' included) must not be able to point it at an executable or a server of its choosing. Set it by hand in ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} if you need it.`);
+		if (refusedPaths.length > 0) {
+			const one = refusedPaths.length === 1;
+			warnWithFallback(logger, `Tabnine CLI permissions: refused to write ${refusedPaths.join(", ")} from the tabnine override; Tabnine CLI runs ${one ? "that value" : "those values"} as a command or sends its traffic there, and a permissions file (one that came from 'rulesync fetch' included) must not be able to point it at an executable or a server of its choosing. Set ${one ? "it" : "them"} by hand in ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} if you need ${one ? "it" : "them"}.`);
+		}
 		const overrideList = (key) => {
 			const value = overrideTools[key];
 			if (value === void 0 || isStringArray$2(value)) return value ?? [];
@@ -48893,10 +51151,17 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		};
 		const overrideShellAllowPatterns = [];
 		const overrideVerbatimAllowed = [];
+		const globSpelledOverrideEntries = [];
 		for (const entry of overrideList(ALLOWED_KEY)) {
 			const parsed = parseTabnineEntry(entry);
-			if (parsed?.toolName === SHELL_TOOL_NAME) overrideShellAllowPatterns.push(toShellPattern(parsed.prefix));
-			else overrideVerbatimAllowed.push(entry);
+			if (parsed?.toolName === SHELL_TOOL_NAME) {
+				const pattern = toShellPattern(parsed.prefix);
+				if (isGlobSpelledPrefix(parsed.prefix)) globSpelledOverrideEntries.push({
+					entry,
+					pattern
+				});
+				overrideShellAllowPatterns.push(pattern);
+			} else overrideVerbatimAllowed.push(entry);
 		}
 		const overrideExclude = overrideList(EXCLUDE_KEY);
 		const { allowed, exclude } = buildToolLists({
@@ -48904,6 +51169,16 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			overrideShellAllowPatterns,
 			logger
 		});
+		warnAboutGlobSpelledOverrideEntries({
+			entries: globSpelledOverrideEntries,
+			allowed,
+			logger
+		});
+		const writableOverrideAllowed = withholdDeniedOverrideAllowed({
+			overrideVerbatimAllowed,
+			exclude,
+			logger
+		});
 		const ignoredOverrideKeys = Object.keys(override).filter((key) => key !== TOOLS_KEY && key !== GENERAL_KEY);
 		if (ignoredOverrideKeys.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: ignored ${ignoredOverrideKeys.length} key(s) of the tabnine override (${ignoredOverrideKeys.map(quoteValueForWarning).join(", ")}); only 'tools' and 'general' are written through the permissions feature.`);
 		const existingTools = this.existingToolsGroup(existingContent);
@@ -48914,7 +51189,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		});
 		const allowedList = (0, es_toolkit.uniq)([
 			...allowed,
-			...overrideVerbatimAllowed,
+			...writableOverrideAllowed,
 			...preservedEntries(ALLOWED_KEY)
 		]);
 		const excludeList = (0, es_toolkit.uniq)([
@@ -48922,12 +51197,12 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			...overrideExclude,
 			...preservedEntries(EXCLUDE_KEY)
 		]);
-		const droppedExcludeEntries = (0, es_toolkit.uniq)(isStringArray$2(existingTools?.[EXCLUDE_KEY]) ? existingTools[EXCLUDE_KEY] : []).filter((entry) => {
-			if (excludeList.includes(entry)) return false;
-			const toolName = parseTabnineEntry(entry)?.toolName;
-			return toolName === void 0 || !excludeList.includes(toolName);
+		reportDroppedManagedEntries({
+			existingTools,
+			allowedList,
+			excludeList,
+			logger
 		});
-		if (droppedExcludeEntries.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: removed ${droppedExcludeEntries.length} existing tools.exclude entry(ies) (${droppedExcludeEntries.map(quoteValueForWarning).join(", ")}) of a tool the canonical block manages; add a deny rule to .rulesync/permissions.jsonc to keep them.`);
 		const tools = {
 			...overrideTools,
 			[ALLOWED_KEY]: allowedList.length > 0 ? allowedList : void 0,
@@ -48941,7 +51216,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			entries: collectTrustAffectingOverrideEntries({
 				tools: {
 					...overrideTools,
-					[ALLOWED_KEY]: overrideVerbatimAllowed
+					[ALLOWED_KEY]: writableOverrideAllowed
 				},
 				general: overrideGeneral
 			}),
@@ -52274,6 +54549,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["commandcode", {
+		class: CommandcodePermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["continue", {
 		class: ContinuePermissions,
 		meta: {
@@ -52298,6 +54581,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["crush", {
+		class: CrushPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["cursor", {
 		class: CursorPermissions,
 		meta: {
@@ -55032,6 +57323,154 @@ var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/commandcode-skill.ts
+const CommandcodeSkillFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.string()
+});
+/**
+* Represents a Command Code skill directory.
+*
+* Command Code discovers Anthropic-style `<name>/SKILL.md` directories under
+* `<project>/.commandcode/skills/` (project scope) and
+* `~/.commandcode/skills/` (user scope). The frontmatter requires `name`
+* (matching the directory name) and `description`; supporting files next to
+* `SKILL.md` are carried along.
+*
+* @see https://commandcode.ai/docs/skills
+*/
+var CommandcodeSkill = class CommandcodeSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = COMMANDCODE_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: COMMANDCODE_SKILLS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return CommandcodeSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (!this.mainFile) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = CommandcodeSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		if (result.data.name !== this.getDirName()) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: frontmatter name (${result.data.name}) must match directory name (${this.getDirName()})`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const { name, description, ...commandcodeSection } = this.getFrontmatter();
+		const rulesyncFrontmatter = {
+			name,
+			description,
+			targets: ["*"],
+			...Object.keys(commandcodeSection).length > 0 && { commandcode: commandcodeSection }
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+		const settablePaths = CommandcodeSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const { name: _sectionName, description: _sectionDescription, ...commandcodeSection } = rulesyncFrontmatter.commandcode ?? {};
+		const commandcodeFrontmatter = {
+			...commandcodeSection,
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description
+		};
+		return new CommandcodeSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName: commandcodeFrontmatter.name,
+			frontmatter: commandcodeFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("commandcode");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: CommandcodeSkill.getSettablePaths
+		});
+		const result = CommandcodeSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${(0, node_path.join)(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		if (result.data.name !== loaded.dirName) {
+			const skillFilePath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName, SKILL_FILE_NAME);
+			throw new Error(`Frontmatter name (${result.data.name}) must match directory name (${loaded.dirName}) in ${skillFilePath}`);
+		}
+		return new CommandcodeSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		return new CommandcodeSkill({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/continue-skill.ts
 const ContinueSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -58319,6 +60758,183 @@ var PiSkill = class PiSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/constants/pool-paths.ts
+/**
+* Pool (Poolside's coding agent CLI) configuration-layout conventions.
+*
+* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
+* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
+* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
+* path), the project-root `AGENTS.md`, and nested per-directory
+* `AGENTS.md` files from the repository root down through the working
+* directory, deeper files taking precedence. It skips ignored directories
+* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
+*
+* Skills follow the Agent Skills format (`<name>/SKILL.md` bundles). Pool
+* scans `.poolside/skills/` (project) and `~/.config/poolside/skills/`
+* (global) plus the shared `.agents/skills/` / `~/.agents/skills/` roots and
+* the skill directories of other Agent Skills tools; rulesync writes only the
+* Pool-specific roots and leaves the shared ones to their own targets.
+*
+* @see https://docs.poolside.ai/agent-instructions
+* @see https://docs.poolside.ai/skills
+* @see https://github.com/poolsideai/pool
+*/
+/** Project-scoped `.poolside/` directory at the project root. */
+const POOL_DIR = ".poolside";
+/** Global config directory for Pool, relative to the home directory. */
+const POOL_GLOBAL_DIR = (0, node_path.join)(".config", "poolside");
+/** Project skills root, relative to the project root. */
+const POOL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_DIR, "skills");
+/** Global skills root, relative to the home directory. */
+const POOL_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_GLOBAL_DIR, "skills");
+//#endregion
+//#region src/features/skills/pool-skill.ts
+const PoolSkillFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.string()
+});
+/**
+* Represents a Pool (Poolside) skill directory.
+*
+* Pool discovers Agent Skills (`<name>/SKILL.md` bundles, optionally with
+* supporting files) from `.poolside/skills/` (project) and
+* `~/.config/poolside/skills/` (global). It also scans the shared
+* `.agents/skills/` / `~/.agents/skills/` roots and the skill directories of
+* other Agent Skills tools; those belong to their own targets, so this class
+* writes only the two Pool-specific roots and a skill is written exactly once.
+* Pool requires the directory name to equal the frontmatter `name`, otherwise
+* it skips the skill. Unlike adapters that reject such a skill outright, this
+* one warns and still writes it: the directory name is the canonical identity
+* shared with every other target, and Pool merely skips the skill rather than
+* failing, so a hard error here would block the other targets for a
+* Pool-only concern. Import is lenient for the same reason.
+* @see https://docs.poolside.ai/skills
+*/
+var PoolSkill = class PoolSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = POOL_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? POOL_GLOBAL_SKILLS_DIR_PATH : POOL_SKILLS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return PoolSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (!this.mainFile) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = PoolSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const frontmatter = this.getFrontmatter();
+		const rulesyncFrontmatter = {
+			name: frontmatter.name,
+			description: frontmatter.description,
+			targets: ["*"]
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
+		const settablePaths = PoolSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
+		const poolFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description
+		};
+		if (poolFrontmatter.name !== dirName) warnWithFallback(logger, `${stripControlCharacters(toPosixPath((0, node_path.join)(outputRoot, settablePaths.relativeDirPath, dirName, SKILL_FILE_NAME)))}: \`name\` ${quoteForLog(poolFrontmatter.name)} does not match its directory name ${quoteForLog(dirName)}; Pool only loads a skill whose directory name equals its \`name\``);
+		return new PoolSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: poolFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("pool");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: PoolSkill.getSettablePaths
+		});
+		const result = PoolSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${(0, node_path.join)(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		return new PoolSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		const settablePaths = PoolSkill.getSettablePaths({ global });
+		return new PoolSkill({
+			outputRoot,
+			relativeDirPath: relativeDirPath ?? settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/qwencode-skill.ts
 const QwencodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -60044,6 +62660,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["commandcode", {
+		class: CommandcodeSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["continue", {
 		class: ContinueSkill,
 		meta: {
@@ -60205,6 +62829,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["pool", {
+		class: PoolSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodeSkill,
 		meta: {
@@ -62139,6 +64771,143 @@ var CodexCliSubagent = class CodexCliSubagent extends ToolSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/commandcode-subagent.ts
+const CommandcodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	tools: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+	disallowedTools: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+	model: zod_mini.z.optional(zod_mini.z.string()),
+	reasoningEffort: zod_mini.z.optional(zod_mini.z.string()),
+	maxTurns: zod_mini.z.optional(zod_mini.z.number()),
+	permissionMode: zod_mini.z.optional(zod_mini.z.string()),
+	background: zod_mini.z.optional(zod_mini.z.boolean()),
+	showOutput: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* Command Code custom agent: a Markdown file with YAML frontmatter under
+* `.commandcode/agents/` (project) or `~/.commandcode/agents/` (user); the
+* body is the agent's system prompt.
+*
+* @see https://commandcode.ai/docs/custom-agents
+*/
+var CommandcodeSubagent = class CommandcodeSubagent extends ToolSubagent {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, fileContent, ...rest }) {
+		if (rest.validate !== false) {
+			const result = CommandcodeSubagentFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: fileContent ?? stringifyFrontmatter(body, frontmatter)
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: COMMANDCODE_AGENTS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	toRulesyncSubagent() {
+		const { name, description, ...rest } = this.frontmatter;
+		return new RulesyncSubagent({
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name,
+				description,
+				commandcode: { ...rest }
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
+		const commandcodeSection = rulesyncFrontmatter.commandcode ?? {};
+		const commandcodeSubagentFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...commandcodeSection
+		};
+		const body = rulesyncSubagent.getBody();
+		const fileContent = stringifyFrontmatter(body, commandcodeSubagentFrontmatter, { avoidBlockScalars: true });
+		const paths = this.getSettablePaths({ global });
+		return new CommandcodeSubagent({
+			outputRoot,
+			frontmatter: commandcodeSubagentFrontmatter,
+			body,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = CommandcodeSubagentFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		else return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "commandcode"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const result = CommandcodeSubagentFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new CommandcodeSubagent({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: content.trim(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new CommandcodeSubagent({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/subagents/copilot-subagent.ts
 const CopilotSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -65039,7 +67808,7 @@ var RooSubagent = class extends ToolSubagent {
 //#region src/features/subagents/tabnine-subagent.ts
 const TabnineSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
-	description: zod_mini.z.optional(zod_mini.z.string()),
+	description: zod_mini.z.string(),
 	/** "local" (default) runs inside the CLI; "remote" delegates to a Tabnine cloud agent. */
 	kind: zod_mini.z.optional(zod_mini.z.string()),
 	/** Built-in tool names the subagent may use; omitted = every tool. */
@@ -65098,14 +67867,23 @@ var TabnineSubagent = class TabnineSubagent extends ToolSubagent {
 			validate: true
 		});
 	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
 		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
 		const tabnineSection = rulesyncFrontmatter.tabnine ?? {};
-		const tabnineSubagentFrontmatter = {
+		const merged = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...tabnineSection
 		};
+		let description = merged.description;
+		if (description === void 0 || description === "") {
+			description = rulesyncFrontmatter.name ? `${rulesyncFrontmatter.name} subagent` : "subagent";
+			logger?.warn(`Tabnine CLI subagent ${rulesyncSubagent.getRelativeFilePath()} has no description, which Tabnine requires; wrote ${JSON.stringify(description)} as a placeholder.`);
+		}
+		const tabnineSubagentFrontmatter = {
+			...merged,
+			description
+		};
 		const body = rulesyncSubagent.getBody();
 		const fileContent = stringifyFrontmatter(body, tabnineSubagentFrontmatter, { avoidBlockScalars: true });
 		const paths = this.getSettablePaths({ global });
@@ -65788,6 +68566,15 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.toml"
 		}
 	}],
+	["commandcode", {
+		class: CommandcodeSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			filePattern: "*.md"
+		}
+	}],
 	["copilot", {
 		class: CopilotSubagent,
 		meta: {
@@ -68620,6 +71407,73 @@ var CodexcliRule = class CodexcliRule extends ToolRule {
 	}
 };
 //#endregion
+//#region src/features/rules/commandcode-rule.ts
+var CommandcodeRule = class CommandcodeRule extends ToolRule {
+	constructor({ fileContent, root, ...rest }) {
+		super({
+			...rest,
+			fileContent,
+			root: root ?? false
+		});
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { root: {
+			relativeDirPath: global ? COMMANDCODE_DIR : ".",
+			relativeFilePath: COMMANDCODE_RULE_FILE_NAME
+		} };
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const relativePath = (0, node_path.join)(root.relativeDirPath, root.relativeFilePath);
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
+		return new CommandcodeRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent,
+			validate,
+			root: true
+		});
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = rulesyncRule.getFrontmatter().root ?? false;
+		return new CommandcodeRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: isRoot
+		});
+	}
+	toRulesyncRule() {
+		return this.toRulesyncRuleDefault();
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new CommandcodeRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === ".commandcode")
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "commandcode"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/continue-rule.ts
 /**
 * Frontmatter schema for Continue rule files (`.continue/rules/*.md`).
@@ -71368,24 +74222,6 @@ var PiRule = class PiRule extends ToolRule {
 	}
 };
 //#endregion
-//#region src/constants/pool-paths.ts
-/**
-* Pool (Poolside's coding agent CLI) configuration-layout conventions.
-*
-* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
-* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
-* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
-* path), the project-root `AGENTS.md`, and nested per-directory
-* `AGENTS.md` files from the repository root down through the working
-* directory, deeper files taking precedence. It skips ignored directories
-* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
-*
-* @see https://docs.poolside.ai/agent-instructions
-* @see https://github.com/poolsideai/pool
-*/
-/** Global config directory for Pool, relative to the home directory. */
-const POOL_GLOBAL_DIR = (0, node_path.join)(".config", "poolside");
-//#endregion
 //#region src/features/rules/pool-rule.ts
 var PoolRule = class PoolRule extends ToolRule {
 	static getSettablePaths({ global = false } = {}) {
@@ -72958,6 +75794,15 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold"
 		}
 	}],
+	["commandcode", {
+		class: CommandcodeRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold"
+		}
+	}],
 	["continue", {
 		class: ContinueRule,
 		meta: {