rulesync 30.0.0 → 32.0.0

package/dist/{import-XIYCKmjg.cjs → import-Bmb7ofrF.cjs}

@@ -453,36 +453,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$416 } = node_path.posix;
+const { join: join$417 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$416(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$417(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$416(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$416(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$417(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$417(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -935,6 +935,7 @@ const checksProcessorToolTargetTuple = [
 	"cursor",
 	"factorydroid",
 	"gitlabduo",
+	"goose",
 	"hermesagent",
 	"kilo",
 	"qwencode",
@@ -4844,13 +4845,11 @@ const PI_HOOK_EVENTS = [
 /**
 * Hook events supported by oh-my-pi (`omp`), Pi's fork, through the same
 * generated TypeScript extension. oh-my-pi keeps Pi's names for every event
-* listed here, but it has neither `agent_before_settle` nor `ui_prompt_start`,
-* so `stop` and `notification` are not mapped yet. oh-my-pi's stop surface is
-* `session_stop`, which takes a Claude-compatible `{ decision: "block", reason }`
-* result; it needs its own handler in the generator and is left for a
-* follow-up. See CANONICAL_TO_OMP_EVENT_NAMES.
+* listed here except `stop`: it has no `agent_before_settle`, so `stop` maps to
+* its own `session_stop` event instead. It has no `ui_prompt_start` either, so
+* `notification` is not mapped. See CANONICAL_TO_OMP_EVENT_NAMES.
 *
-* @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
 */
 const OMP_HOOK_EVENTS = [
 	"sessionStart",
@@ -4861,6 +4860,7 @@ const OMP_HOOK_EVENTS = [
 	"preModelInvocation",
 	"postModelInvocation",
 	"beforeSubmitPrompt",
+	"stop",
 	"preCompact",
 	"postCompact"
 ];
@@ -6282,9 +6282,10 @@ const CANONICAL_TO_PI_EVENT_NAMES = {
 /**
 * Map canonical camelCase event names to oh-my-pi extension event names. They
 * are Pi's names (see CANONICAL_TO_PI_EVENT_NAMES) for the events oh-my-pi
-* kept. Note that oh-my-pi runs `session_shutdown` handlers with a 2-second
-* budget, and fails a `tool_call` closed when its handler exceeds
-* `extensionHandlers.toolCallTimeoutMs` (30 seconds by default).
+* kept, plus `session_stop` for `stop`. Note that oh-my-pi runs
+* `session_shutdown` handlers with a 2-second budget, and fails a `tool_call`
+* closed when its handler exceeds `extensionHandlers.toolCallTimeoutMs`
+* (30 seconds by default).
 *
 * @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
 */
@@ -6297,6 +6298,7 @@ const CANONICAL_TO_OMP_EVENT_NAMES = {
 	preModelInvocation: "context",
 	postModelInvocation: "message_end",
 	beforeSubmitPrompt: "input",
+	stop: "session_stop",
 	preCompact: "session_before_compact",
 	postCompact: "session_compact"
 };
@@ -12954,10 +12956,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 	[CODEWHALE_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
 		invalidRootPolicy: "error",
-		features: { hooks: {
-			kind: "replace-owned-keys",
-			ownedKeys: ["hooks"]
-		} }
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["allow_shell"]
+			}
+		}
 	},
 	".letta/settings.json": {
 		format: "json",
@@ -14221,12 +14229,12 @@ const AmpCheckFrontmatterSchema = zod_mini.z.looseObject({
 * this format continue to apply.
 * @see https://ampcode.com/docs/review
 */
-var AmpCheck = class AmpCheck extends ToolCheck {
+var AmpCheck = class extends ToolCheck {
 	frontmatter;
 	body;
 	constructor({ frontmatter, body, fileContent, ...rest }) {
 		if (rest.validate !== false) {
-			const result = AmpCheckFrontmatterSchema.safeParse(frontmatter);
+			const result = new.target.getFrontmatterSchema().safeParse(frontmatter);
 			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
 		}
 		super({
@@ -14236,6 +14244,26 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		this.frontmatter = frontmatter;
 		this.body = body;
 	}
+	/**
+	* The tool target this check format belongs to, which is also the name of
+	* its tool-specific frontmatter section. Goose reads the same per-file
+	* format with a few extra keys, so `GooseCheck` reuses this class through
+	* these hooks.
+	*/
+	static getCheckToolTarget() {
+		return "amp";
+	}
+	/** The frontmatter schema a check file of this tool is validated against. */
+	static getFrontmatterSchema() {
+		return AmpCheckFrontmatterSchema;
+	}
+	/**
+	* Frontmatter keys only this tool reads. Import moves them into the tool's
+	* own section so they are not passed on to every other checks target.
+	*/
+	static getToolOnlyKeys() {
+		return [];
+	}
 	static getSettablePaths({ global = false } = {}) {
 		return { relativeDirPath: global ? AMP_CHECKS_GLOBAL_DIR : AMP_CHECKS_PROJECT_DIR };
 	}
@@ -14247,6 +14275,10 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 	}
 	toRulesyncCheck() {
 		const { name: _name, description, "severity-default": severityDefault, tools, ...restFields } = this.frontmatter;
+		const checkClass = this.constructor;
+		const toolOnlyKeys = new Set(checkClass.getToolOnlyKeys());
+		const sharedFields = Object.fromEntries(Object.entries(restFields).filter(([key]) => !toolOnlyKeys.has(key)));
+		const toolSection = Object.fromEntries(Object.entries(restFields).filter(([key]) => toolOnlyKeys.has(key)));
 		return new RulesyncCheck({
 			outputRoot: ".",
 			frontmatter: {
@@ -14254,7 +14286,8 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 				...description !== void 0 && { description },
 				...severityDefault !== void 0 && { severity: severityDefault },
 				...tools !== void 0 && { tools },
-				...restFields
+				...sharedFields,
+				...Object.keys(toolSection).length > 0 && { [checkClass.getCheckToolTarget()]: toolSection }
 			},
 			body: this.body,
 			relativeDirPath: RULESYNC_CHECKS_RELATIVE_DIR_PATH,
@@ -14269,22 +14302,24 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		const { targets: _targets, description, severity, tools, ...restFields } = rulesyncFrontmatter;
 		const toolTargetKeys = new Set(ALL_TOOL_TARGETS);
 		const passthroughFields = Object.fromEntries(Object.entries(restFields).filter(([key]) => !toolTargetKeys.has(key) && key !== "name"));
-		const ampSection = this.filterToolSpecificSection(rulesyncFrontmatter.amp ?? {}, ["name"]);
+		const toolTarget = this.getCheckToolTarget();
+		const rawSection = rulesyncFrontmatter[toolTarget];
+		const toolSection = this.filterToolSpecificSection(rawSection !== null && typeof rawSection === "object" && !Array.isArray(rawSection) ? rawSection : {}, ["name"]);
 		const rawAmpFrontmatter = {
 			name,
 			...description !== void 0 && { description },
 			...severity !== void 0 && { "severity-default": severity },
 			...tools !== void 0 && { tools },
 			...passthroughFields,
-			...ampSection
+			...toolSection
 		};
-		const result = AmpCheckFrontmatterSchema.safeParse(rawAmpFrontmatter);
-		if (!result.success) throw new Error(`Invalid amp check frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
+		const result = this.getFrontmatterSchema().safeParse(rawAmpFrontmatter);
+		if (!result.success) throw new Error(`Invalid ${toolTarget} check frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
 		const ampFrontmatter = result.data;
 		const body = rulesyncCheck.getBody();
 		const fileContent = stringifyFrontmatter(body, ampFrontmatter);
 		const paths = this.getSettablePaths({ global });
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			frontmatter: ampFrontmatter,
 			body,
@@ -14299,7 +14334,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 			success: true,
 			error: null
 		};
-		const result = AmpCheckFrontmatterSchema.safeParse(this.frontmatter);
+		const result = this.constructor.getFrontmatterSchema().safeParse(this.frontmatter);
 		if (result.success) return {
 			success: true,
 			error: null
@@ -14312,7 +14347,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 	static isTargetedByRulesyncCheck(rulesyncCheck) {
 		return this.isTargetedByRulesyncCheckDefault({
 			rulesyncCheck,
-			toolTarget: "amp"
+			toolTarget: this.getCheckToolTarget()
 		});
 	}
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
@@ -14320,9 +14355,9 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
 		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
-		const result = AmpCheckFrontmatterSchema.safeParse(frontmatter);
+		const result = this.getFrontmatterSchema().safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath,
@@ -14333,7 +14368,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		});
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
@@ -15433,6 +15468,60 @@ var GitlabduoCheck = class GitlabduoCheck extends ToolCheck {
 	}
 };
 //#endregion
+//#region src/constants/goose-paths.ts
+const GOOSE_DIR = ".goose";
+const GOOSE_GLOBAL_DIR = (0, node_path.join)(".config", "goose");
+const GOOSE_RULE_FILE_NAME = ".goosehints";
+const GOOSE_MCP_FILE_NAME = "config.yaml";
+const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
+const GOOSE_HOOKS_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync", "hooks");
+const GOOSE_HOOKS_FILE_NAME = "hooks.json";
+const GOOSE_PLUGIN_MCP_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync");
+const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
+const GOOSE_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "skills");
+const GOOSE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "skills");
+const GOOSE_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "recipes");
+const GOOSE_GLOBAL_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "recipes");
+const GOOSE_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "agents");
+const GOOSE_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "agents");
+const GOOSE_CHECKS_PROJECT_DIR = (0, node_path.join)(".agents", "checks");
+const GOOSE_CHECKS_GLOBAL_DIR = (0, node_path.join)(GOOSE_GLOBAL_DIR, "checks");
+//#endregion
+//#region src/features/checks/goose-check.ts
+const GooseCheckFrontmatterSchema = zod_mini.z.extend(AmpCheckFrontmatterSchema, {
+	model: zod_mini.z.optional(zod_mini.z.string()),
+	"turn-limit": zod_mini.z.optional(zod_mini.z.int().check(zod_mini.z.nonnegative()))
+});
+/**
+* Represents a Goose review check (`goose review`), written to the user-wide
+* `~/.config/goose/checks/` (global scope only).
+*
+* Goose discovers repository checks in `.agents/checks/*.md`, the same
+* cross-tool directory the `amp` checks target already writes (Goose's
+* `tools` and `severity-default` fields exist for parity with Amp's), so the
+* project scope is left to `amp` rather than having two targets own the same
+* files. Its global discovery reads `~/.config/goose/checks/` first, then
+* `~/.config/agents/checks/`. The file format is Amp's, so this class reuses
+* `AmpCheck` and adds Goose's `model` and `turn-limit`, which live in the
+* `goose:` section of a rulesync check; `name` is derived from the file name.
+*
+* @see https://github.com/aaif-goose/goose/blob/main/crates/goose/src/checks/mod.rs
+*/
+var GooseCheck = class extends AmpCheck {
+	static getCheckToolTarget() {
+		return "goose";
+	}
+	static getFrontmatterSchema() {
+		return GooseCheckFrontmatterSchema;
+	}
+	static getToolOnlyKeys() {
+		return ["model", "turn-limit"];
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? GOOSE_CHECKS_GLOBAL_DIR : GOOSE_CHECKS_PROJECT_DIR };
+	}
+};
+//#endregion
 //#region src/constants/hermesagent-paths.ts
 /**
 * Hermes Agent configuration-layout conventions.
@@ -16161,6 +16250,14 @@ const toolCheckFactories = /* @__PURE__ */ new Map([
 			committedOutput: true
 		}
 	}],
+	["goose", {
+		class: GooseCheck,
+		meta: {
+			supportsGlobal: true,
+			supportsProject: false,
+			filePattern: "*.md"
+		}
+	}],
 	["hermesagent", {
 		class: HermesagentCheck,
 		meta: {
@@ -16206,7 +16303,9 @@ const defaultGetFactory$6 = (target) => {
 	return factory;
 };
 const allToolTargetKeys$5 = [...toolCheckFactories.keys()];
-const checksProcessorToolTargets = allToolTargetKeys$5;
+const checksProcessorToolTargets = allToolTargetKeys$5.filter((target) => {
+	return toolCheckFactories.get(target)?.meta.supportsProject !== false;
+});
 const checksProcessorToolTargetsGlobal = allToolTargetKeys$5.filter((target) => {
 	return toolCheckFactories.get(target)?.meta.supportsGlobal ?? false;
 });
@@ -16377,23 +16476,6 @@ var ChecksProcessor = class extends FeatureProcessor {
 	}
 };
 //#endregion
-//#region src/constants/goose-paths.ts
-const GOOSE_DIR = ".goose";
-const GOOSE_GLOBAL_DIR = (0, node_path.join)(".config", "goose");
-const GOOSE_RULE_FILE_NAME = ".goosehints";
-const GOOSE_MCP_FILE_NAME = "config.yaml";
-const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
-const GOOSE_HOOKS_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync", "hooks");
-const GOOSE_HOOKS_FILE_NAME = "hooks.json";
-const GOOSE_PLUGIN_MCP_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync");
-const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
-const GOOSE_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "skills");
-const GOOSE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "skills");
-const GOOSE_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "recipes");
-const GOOSE_GLOBAL_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "recipes");
-const GOOSE_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "agents");
-const GOOSE_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "agents");
-//#endregion
 //#region src/utils/tool-home.ts
 /**
 * Where the rulesync-side source files of a tool with a home override belong.
@@ -18115,27 +18197,71 @@ const CLINE_HOOKS_GLOBAL_DIR_PATH = (0, node_path.join)("Documents", "Cline", "H
 const CLINE_HOOKS_MANIFEST_FILE_NAME = "rulesync-hooks.json";
 //#endregion
 //#region src/features/commands/cline-command.ts
+const CLINE_WORKFLOW_FIELD_TYPES = {
+	name: "string",
+	disabled: "boolean",
+	enabled: "boolean"
+};
+function sanitizeClineWorkflowFrontmatter({ cline, relativeFilePath, logger }) {
+	if (!isRecord$1(cline)) return {};
+	return Object.fromEntries(Object.entries(cline).filter(([key, value]) => {
+		const expected = Object.hasOwn(CLINE_WORKFLOW_FIELD_TYPES, key) ? CLINE_WORKFLOW_FIELD_TYPES[key] : void 0;
+		if (expected === void 0 || typeof value === expected) return true;
+		warnWithFallback(logger, `Cline commands: dropping cline.${key} from ${relativeFilePath}: Cline rejects the whole workflow unless it is a ${expected}.`);
+		return false;
+	}));
+}
+/**
+* Cline workflows (commands). A workflow may carry YAML frontmatter that Cline
+* reads: `name` (the slash-command name) and a `disabled` / `enabled` switch
+* (`parseWorkflowConfigFromMarkdown` in Cline's
+* `user-instruction-config-loader.ts`). The `cline:` section of a
+* `.rulesync/commands/*.md` file is written as that frontmatter, and every key
+* of an imported workflow's frontmatter is lifted back into `cline:`, so
+* hand-written workflow frontmatter survives an import → generate round trip.
+* Cline's own UI toggle is kept in Cline's state, not in the file. A workflow
+* without a `cline:` section is written as a bare body, as before.
+*
+* @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/extensions/config/user-instruction-config-loader.ts
+*/
 var ClineCommand = class ClineCommand extends ToolCommand {
 	static getSettablePaths({ global } = {}) {
 		if (global) return { relativeDirPath: CLINE_COMMANDS_GLOBAL_DIR_PATH };
 		return { relativeDirPath: CLINE_COMMANDS_DIR_PATH };
 	}
+	/** The workflow's own frontmatter, or an empty object for a bare body. */
+	getClineFrontmatter() {
+		const { frontmatter } = parseFrontmatter(this.getFileContent(), this.getFilePath());
+		return isRecord$1(frontmatter) ? frontmatter : {};
+	}
 	toRulesyncCommand() {
+		const cline = this.getClineFrontmatter();
+		const rulesyncFrontmatter = {
+			targets: ["*"],
+			...Object.keys(cline).length > 0 && { cline }
+		};
+		const body = this.getBody();
 		return new RulesyncCommand({
 			outputRoot: process.cwd(),
-			frontmatter: { targets: ["*"] },
-			body: this.getFileContent(),
+			frontmatter: rulesyncFrontmatter,
+			body,
 			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
 			relativeFilePath: this.relativeFilePath,
-			fileContent: this.getFileContent(),
+			fileContent: stringifyFrontmatter(body, rulesyncFrontmatter),
 			validate: true
 		});
 	}
-	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
+	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
+		const cline = sanitizeClineWorkflowFrontmatter({
+			cline: rulesyncCommand.getFrontmatter().cline,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
+			logger
+		});
+		const body = rulesyncCommand.getBody();
 		return new ClineCommand({
 			outputRoot,
-			fileContent: rulesyncCommand.getBody(),
+			fileContent: Object.keys(cline).length > 0 ? stringifyFrontmatter(body, cline) : body,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
 			validate
@@ -18148,7 +18274,7 @@ var ClineCommand = class ClineCommand extends ToolCommand {
 		};
 	}
 	getBody() {
-		return this.getFileContent();
+		return parseFrontmatter(this.getFileContent(), this.getFilePath()).body.trim();
 	}
 	static isTargetedByRulesyncCommand(rulesyncCommand) {
 		return this.isTargetedByRulesyncCommandDefault({
@@ -18159,12 +18285,13 @@ var ClineCommand = class ClineCommand extends ToolCommand {
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		const { body: content } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const cline = isRecord$1(frontmatter) ? frontmatter : {};
 		return new ClineCommand({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath,
-			fileContent: content.trim(),
+			fileContent: Object.keys(cline).length > 0 ? stringifyFrontmatter(body.trim(), cline) : body.trim(),
 			validate
 		});
 	}
@@ -32737,6 +32864,31 @@ const PI_PROMPT_BLOCKING_EVENT = "input";
 * @see https://github.com/earendil-works/pi/blob/v0.87.1/packages/coding-agent/src/core/extensions/types.ts
 */
 const PI_SETTLE_BLOCKING_EVENT = "agent_before_settle";
+/**
+* `session_stop` is oh-my-pi's stop surface (it has no `agent_before_settle`).
+* It fires when a main-session run is about to settle (never for subagents,
+* nor for a run the user aborted), and a handler returning
+* `{ continue: true, additionalContext }` queues one more turn with that text
+* as hidden model-visible context. As on Pi, only a stop command exiting with
+* code 2 asks for that, the feedback of every such command is combined, and
+* any other failure is rethrown for oh-my-pi to report. The generated handler
+* continues only when `event.stop_hook_active` is false, which oh-my-pi sets
+* after a continuation and clears once a stop pass lets the run settle, so the
+* agent is continued at most once per stop (the flag is shared by every
+* extension, so another extension's continuation also suppresses ours);
+* oh-my-pi additionally caps these
+* advisory continuations at 8 in a row. A run that ended on a provider error
+* (`stopReason: "error"`) is not continued, matching Pi's `completed`-only
+* gate. The advisory form is used rather than `{ decision: "block", reason }`,
+* which oh-my-pi keeps enforcing without that cap. oh-my-pi gives
+* `session_stop` handlers the 30-second extension handler budget: stop
+* commands running longer time the handler out, the run settles without a
+* continuation, and the command is not killed.
+*
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/packages/coding-agent/src/session/agent-session.ts
+*/
+const OMP_SESSION_STOP_BLOCKING_EVENT = "session_stop";
 const PI_EXTENSION_DIALECT = {
 	overrideKey: "pi",
 	typesPackage: "@earendil-works/pi-coding-agent",
@@ -32758,7 +32910,8 @@ const OMP_EXTENSION_DIALECT = {
 const PI_BLOCKING_MODE_BY_EVENT = {
 	[PI_BLOCKING_EVENT]: "tool",
 	[PI_PROMPT_BLOCKING_EVENT]: "prompt",
-	[PI_SETTLE_BLOCKING_EVENT]: "settle"
+	[PI_SETTLE_BLOCKING_EVENT]: "settle",
+	[OMP_SESSION_STOP_BLOCKING_EVENT]: "sessionStop"
 };
 /**
 * The body emitted inside a blocking handler's `catch`, per gate. `tool_call`
@@ -32771,7 +32924,8 @@ function failureLinesByMode(dialect) {
 		none: [],
 		tool: ["return { block: true, reason: toBlockReason(error) };"],
 		prompt: ["reportPromptGateFailure(ctx, toBlockReason(error));", dialect.promptCancelLine],
-		settle: ["stopHookFailures.push(error);"]
+		settle: ["stopHookFailures.push(error);"],
+		sessionStop: ["stopHookFailures.push(error);"]
 	};
 }
 /**
@@ -32863,6 +33017,12 @@ const PROMPT_GATE_HELPER_LINES = [
 	"  console.error(reason);",
 	"}"
 ];
+/** Helper emitted alongside every stop gate (Pi's settle gate and oh-my-pi's `session_stop`). */
+const STOP_HOOK_BLOCK_HELPER_LINES = [
+	"function isStopHookBlock(error: unknown): boolean {",
+	"  return (error as { code?: unknown } | null)?.code === 2;",
+	"}"
+];
 /**
 * Helper emitted alongside the stop hook's settle gate. `event.entries` holds
 * the drafts earlier extensions proposed at this boundary, so they are kept and
@@ -32873,10 +33033,6 @@ const PROMPT_GATE_HELPER_LINES = [
 * appended message is committed, and Pi re-validates the final context itself.
 */
 const STOP_HOOK_HELPER_LINES = [
-	"function isStopHookBlock(error: unknown): boolean {",
-	"  return (error as { code?: unknown } | null)?.code === 2;",
-	"}",
-	"",
 	"function continueAfterStopHook(",
 	"  event: AgentBeforeSettleEvent,",
 	"  reason: string,",
@@ -32959,14 +33115,16 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 		const blocking = PI_BLOCKING_MODE_BY_EVENT[piEvent] ?? "none";
 		const isPromptGate = blocking === "prompt";
 		const isSettleGate = blocking === "settle";
+		const isSessionStopGate = blocking === "sessionStop";
+		const collectsStopFailures = isSettleGate || isSessionStopGate;
 		const usesToolName = PI_TOOL_EVENTS.has(piEvent) && handlers.some((h) => h.matcher);
 		const usesErrorFlag = handlers.some((h) => h.onlyOnError);
 		const gatesOnAssistant = PI_ASSISTANT_MESSAGE_EVENTS.has(piEvent);
-		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || isSettleGate ? "event" : "";
+		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || collectsStopFailures ? "event" : "";
 		lines.push(`  pi.on(${JSON.stringify(piEvent)}, async (${params}) => {`);
 		if (gatesOnAssistant) lines.push(`    if (event.message.role !== "assistant") return;`);
 		if (isPromptGate) lines.push(`    if (event.source === "extension") ${dialect.promptPassLine}`);
-		if (isSettleGate) lines.push("    const stopHookFailures: unknown[] = [];");
+		if (collectsStopFailures) lines.push("    const stopHookFailures: unknown[] = [];");
 		for (const handler of handlers) lines.push(...buildCommandLines({
 			handler,
 			usesToolName,
@@ -32982,6 +33140,17 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 			lines.push("    }");
 			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
 		}
+		if (isSessionStopGate) {
+			lines.push("    const blocks = stopHookFailures.filter(isStopHookBlock);");
+			lines.push("    const endedOnError = (event.last_assistant_message as { stopReason?: unknown } | undefined)?.stopReason === \"error\";");
+			lines.push("    if (blocks.length > 0 && !event.stop_hook_active && !endedOnError) {");
+			lines.push("      return {");
+			lines.push("        continue: true,");
+			lines.push("        additionalContext: `Stop hook feedback:\\n${blocks.map(toBlockReason).join(\"\\n\\n\")}`,");
+			lines.push("      };");
+			lines.push("    }");
+			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
+		}
 		lines.push("  });");
 		if (isSettleGate) {
 			lines.push(`  pi.on("agent_settled", async () => {`);
@@ -33000,8 +33169,9 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 * `{ block: true, reason }`, and on `input` — Pi's prompt-submission gate —
 * where a non-zero exit cancels the prompt with the dialect's cancel result
 * (`{ action: "handled" }` for Pi, `{ handled: true }` for oh-my-pi), and
-* on `agent_before_settle`, where a stop command exiting with code 2 asks the
-* agent to continue once with the command's output as feedback.
+* on `agent_before_settle` (Pi) / `session_stop` (oh-my-pi), where a stop
+* command exiting with code 2 asks the agent to continue once with the
+* command's output as feedback.
 * `postToolUse` and `postToolUseFailure` share Pi's `tool_result` event; the
 * latter's commands run only when `event.isError` is set.
 *
@@ -33022,7 +33192,8 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 	const subscriptionLines = buildSubscriptionLines(handlerGroups, dialect);
 	const hasPromptGate = Boolean(handlerGroups[PI_PROMPT_BLOCKING_EVENT]);
 	const hasSettleGate = Boolean(handlerGroups[PI_SETTLE_BLOCKING_EVENT]);
-	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate;
+	const hasSessionStopGate = Boolean(handlerGroups[OMP_SESSION_STOP_BLOCKING_EVENT]);
+	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate || hasSessionStopGate;
 	const lines = ["// Generated by rulesync. Do not edit manually."];
 	if (subscriptionLines.length === 0) {
 		lines.push("export default function () {}");
@@ -33049,6 +33220,10 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 		lines.push(...PROMPT_GATE_HELPER_LINES);
 		lines.push("");
 	}
+	if (hasSettleGate || hasSessionStopGate) {
+		lines.push(...STOP_HOOK_BLOCK_HELPER_LINES);
+		lines.push("");
+	}
 	if (hasSettleGate) {
 		lines.push(...STOP_HOOK_HELPER_LINES);
 		lines.push("");
@@ -40544,6 +40719,35 @@ function convertFromCodexFormat(codexMcp) {
 	}
 	return result;
 }
+/**
+* Keys Codex refuses on each transport. Its `McpServerConfig` deserializer
+* calls `throw_if_set` for these, and the error fails the whole `config.toml`,
+* not just the one server, so they are dropped with a warning instead of
+* written. Checked against `codex-rs/config/src/mcp_types.rs` at rust-v0.162.1.
+*/
+const CODEX_STDIO_REJECTED_KEYS = [
+	"url",
+	"bearer_token_env_var",
+	"bearer_token",
+	"http_headers_helper",
+	"http_headers",
+	"env_http_headers",
+	"oauth",
+	"oauth_resource",
+	"auth"
+];
+const CODEX_HTTP_REJECTED_KEYS = [
+	"args",
+	"env",
+	"env_vars",
+	"cwd",
+	"bearer_token"
+];
+function dropTransportRejectedKeys({ converted, isStdio, serverName }) {
+	const dropped = (isStdio ? CODEX_STDIO_REJECTED_KEYS : CODEX_HTTP_REJECTED_KEYS).filter((key) => converted[key] !== void 0);
+	for (const key of dropped) delete converted[key];
+	if (dropped.length > 0) warnWithFallback(void 0, `[CodexCliMcp] Dropping ${dropped.map((key) => `'${key}'`).join(", ")} from ${isStdio ? "stdio" : "url-based"} MCP server "${serverName}": Codex rejects ${dropped.length === 1 ? "this key" : "these keys"} on a ${isStdio ? "stdio" : "url-based"} server and would fail to load the whole config.toml.`);
+}
 function convertToCodexFormat(mcpServers) {
 	const result = {};
 	const originalNames = /* @__PURE__ */ new Map();
@@ -40586,6 +40790,11 @@ function convertToCodexFormat(mcpServers) {
 			converted,
 			serverName: name
 		});
+		dropTransportRejectedKeys({
+			converted,
+			isStdio,
+			serverName: name
+		});
 		const previousName = originalNames.get(codexName);
 		if (previousName !== void 0) warnWithFallback(void 0, `Codex MCP server name collision: "${previousName}" and "${name}" both normalize to "${codexName}"; "${name}" (processed last) overwrites "${previousName}".`);
 		originalNames.set(codexName, name);
@@ -55811,6 +56020,124 @@ function parseCodebuddySettings({ fileContent, relativePath }) {
 	}
 }
 //#endregion
+//#region src/features/permissions/codewhale-project-config.ts
+/**
+* The top-level key of the per-project `.codewhale/config.toml` overlay that
+* hides Codewhale's shell tools. The overlay only tightens: `false` disables
+* shell for the session, while `true` is ignored with a warning.
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/docs/CONFIGURATION.md#per-project-overlay-485
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/crates/tui/src/lib.rs
+*/
+const CODEWHALE_ALLOW_SHELL_KEY = "allow_shell";
+const CODEWHALE_PROJECT_CONFIG_PATHS = {
+	relativeDirPath: CODEWHALE_DIR,
+	relativeFilePath: CODEWHALE_CONFIG_FILE_NAME
+};
+/** The project `.codewhale/config.toml` overlay, as written by the permissions feature. */
+var CodewhaleProjectConfigFile = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+/**
+* Whether the canonical config denies every shell command: a `deny` on the
+* catch-all `*` (or `**`) pattern of `bash` or of the all-tools `*` category.
+* Codewhale decides by action before specificity, so such a deny already
+* blocks every command in global scope too, whatever `allow` rules sit beside
+* it.
+*/
+function deniesEveryShellCommand(permission) {
+	return collectShellCommandRules(permission).rules.some(({ pattern, action }) => action === "deny" && isShellCatchAll(pattern));
+}
+/** Whether a canonical shell pattern names every command. */
+function isShellCatchAll(pattern) {
+	const trimmed = pattern.trim();
+	return trimmed === "*" || trimmed === "**";
+}
+function projectConfigFilePath(outputRoot) {
+	return (0, node_path.join)(outputRoot, CODEWHALE_PROJECT_CONFIG_PATHS.relativeDirPath, CODEWHALE_PROJECT_CONFIG_PATHS.relativeFilePath);
+}
+function parseProjectConfig({ fileContent, filePath }) {
+	return parseSharedConfig({
+		format: "toml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Whether an overlay disables shell (`allow_shell = false`). A file that
+* cannot be read as TOML is reported and treated as not disabling shell.
+*/
+function disablesShell({ fileContent, filePath, logger }) {
+	try {
+		return parseProjectConfig({
+			fileContent,
+			filePath
+		})[CODEWHALE_ALLOW_SHELL_KEY] === false;
+	} catch (error) {
+		logger?.warn(`Codewhale permissions: not reading "allow_shell" from ${filePath}, so a shell deny set there is not taken into account: ${formatError(error)}`);
+		return false;
+	}
+}
+/**
+* Whether the project overlay at `outputRoot` disables shell
+* (`allow_shell = false`), for import.
+*/
+async function readCodewhaleProjectShellDisabled({ outputRoot, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (fileContent === null) return false;
+	return disablesShell({
+		fileContent,
+		filePath,
+		logger
+	});
+}
+/**
+* The project `.codewhale/config.toml` overlay carrying `allow_shell = false`
+* when the canonical config denies every shell command, or `null` when the
+* file needs no change.
+*
+* Only `allow_shell` is written; every other overlay key (`model`,
+* `approval_policy`, ...) is kept, and an existing file that is not valid TOML
+* is an error only when it has to be written. An existing
+* `allow_shell = false` is never removed: the overlay cannot widen access, and
+* a hand-written value cannot be told apart from one rulesync wrote, so it is
+* reported instead.
+*/
+async function createCodewhaleProjectConfigFile({ outputRoot = process.cwd(), config, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const existingContent = await readFileContentOrNull(filePath);
+	if (!deniesEveryShellCommand(config.permission)) {
+		if (existingContent !== null && disablesShell({
+			fileContent: existingContent,
+			filePath,
+			logger
+		})) logger?.warn(`Codewhale permissions: keeping "allow_shell = false" in ${filePath}; rulesync does not remove it. Delete it by hand to re-enable shell tools in this project, or add bash: { "*": "deny" } to the rulesync permissions to match it.`);
+		return null;
+	}
+	if (parseProjectConfig({
+		fileContent: existingContent ?? "",
+		filePath
+	})[CODEWHALE_ALLOW_SHELL_KEY] === false) return null;
+	return new CodewhaleProjectConfigFile({
+		outputRoot,
+		...CODEWHALE_PROJECT_CONFIG_PATHS,
+		fileContent: applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(CODEWHALE_PROJECT_CONFIG_PATHS),
+			feature: "permissions",
+			existingContent: existingContent ?? "",
+			patch: { [CODEWHALE_ALLOW_SHELL_KEY]: false },
+			filePath,
+			logger
+		})
+	});
+}
+//#endregion
 //#region src/features/permissions/codewhale-repo-law.ts
 /**
 * Project-scope Codewhale permissions: the enforced `protected_invariants` of
@@ -55961,7 +56288,8 @@ function collectRestrictions({ config, logger }) {
 	let skippedAllowCount = 0;
 	for (const [category, rules] of Object.entries(config.permission)) {
 		if (!REPO_LAW_CATEGORIES.includes(category)) {
-			if (Object.keys(rules).length > 0) skippedCategories.push(category);
+			const entries = Object.entries(rules);
+			if ((category === "bash" && entries.some(([pattern, action]) => action === "deny" && isShellCatchAll(pattern)) ? entries.filter(([, action]) => action === "allow") : entries).length > 0) skippedCategories.push(category);
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -56687,17 +57015,32 @@ async function warnOnShadowedConstitution({ outputRoot, logger }) {
 * Project scope manages the enforced `protected_invariants` of the repo
 * constitution `.codewhale/constitution.json` (see `codewhale-repo-law.ts`):
 * the project `.codewhale/config.toml` overlay cannot carry rules, but repo
-* law can hold writes to protected paths.
+* law can hold writes to protected paths. A deny on every shell command also
+* sets `allow_shell = false` in that overlay (see
+* `codewhale-project-config.ts`), which import reads back here.
 *
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/CONFIGURATION.md
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/AUTHORIZATION_ORDER.md
 */
 var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
-	constructor(params) {
+	/**
+	* Whether the project `.codewhale/config.toml` overlay disables shell
+	* (`allow_shell = false`); read on import in project scope only.
+	*/
+	projectShellDisabled;
+	constructor({ projectShellDisabled = false, ...params }) {
 		super({
 			...params,
 			fileContent: params.fileContent ?? ""
 		});
+		this.projectShellDisabled = projectShellDisabled;
+	}
+	/**
+	* The project `.codewhale/config.toml` overlay, where a deny on every shell
+	* command becomes `allow_shell = false` beside the user's other overlay keys.
+	*/
+	static getExtraSharedWritePaths(options) {
+		return options?.global ? [] : [{ ...CODEWHALE_PROJECT_CONFIG_PATHS }];
 	}
 	/**
 	* Codewhale's approval card writes to the global file, and the constitution
@@ -56734,7 +57077,11 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			projectShellDisabled: global ? false : await readCodewhaleProjectShellDisabled({
+				outputRoot,
+				logger
+			})
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
@@ -56796,11 +57143,15 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 	toRulesyncPermissions() {
 		const filePath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
 		if (!this.global) {
-			const document = parseCodewhaleConstitution({
+			const permission = codewhaleConstitutionToCanonical(parseCodewhaleConstitution({
 				fileContent: this.getFileContent(),
 				filePath
-			});
-			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission: codewhaleConstitutionToCanonical(document) }, null, 2) });
+			}));
+			if (this.projectShellDisabled) permission.bash = {
+				...permission.bash,
+				"*": "deny"
+			};
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
 		}
 		const { permission, nativeRules } = codewhaleRulesToCanonical(partitionRuleRecords(parsePermissionsDocument({
 			fileContent: this.getFileContent(),
@@ -67806,10 +68157,15 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 			outputRoot,
 			logger
 		});
+		const inheritedProvider = global ? void 0 : await readGlobalTaktProvider({
+			projectFilePath: filePath,
+			logger
+		});
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const provider = resolveActiveProvider({
 			config,
-			runtime: runtime.active ? runtime.config : void 0
+			runtime: runtime.active ? runtime.config : void 0,
+			inheritedProvider
 		});
 		const mode = deriveTaktPermissionMode(rulesyncJson);
 		const override = isPlainObject$1(rulesyncJson.takt) ? rulesyncJson.takt : void 0;
@@ -67919,10 +68275,12 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 * `provider_profiles` (unless that key is the pre-0.68.0 `claude` fallback),
 * else the `claude-sdk` default (Takt 0.68.0+).
 */
-function resolveActiveProvider({ config, runtime }) {
+function resolveActiveProvider({ config, runtime, inheritedProvider }) {
 	const fromRuntime = runtime === void 0 ? void 0 : resolveRuntimeProvider(runtime);
 	if (fromRuntime !== void 0) return fromRuntime;
-	if (typeof config[TAKT_PROVIDER_KEY] === "string" && config[TAKT_PROVIDER_KEY].trim() !== "") return config[TAKT_PROVIDER_KEY];
+	const local = readProviderName(config);
+	if (local !== void 0) return local;
+	if (inheritedProvider !== void 0) return inheritedProvider;
 	const profiles = config[TAKT_PROVIDER_PROFILES_KEY];
 	if (isPlainObject$1(profiles)) {
 		const keys = Object.keys(profiles);
@@ -67930,6 +68288,43 @@ function resolveActiveProvider({ config, runtime }) {
 	}
 	return TAKT_DEFAULT_PROVIDER;
 }
+/**
+* The top-level `provider:` of a Takt `config.yaml`, when it names one: either
+* the plain name or the block form `provider: { type: <name>, ... }` Takt also
+* accepts (`ConfigProviderReference`).
+*/
+function readProviderName(config) {
+	const raw = config[TAKT_PROVIDER_KEY];
+	const provider = isPlainObject$1(raw) ? raw.type : raw;
+	return typeof provider === "string" && provider.trim() !== "" ? provider : void 0;
+}
+/**
+* The top-level `provider:` of the global `~/.takt/config.yaml`, read for a
+* project-scope generate. An unresolvable home directory, a missing or
+* unparsable file, or one that names no provider all mean "nothing inherited".
+*/
+async function readGlobalTaktProvider({ projectFilePath, logger }) {
+	let globalPath;
+	try {
+		globalPath = (0, node_path.join)(getHomeDirectory(), TAKT_DIR, TAKT_CONFIG_FILE_NAME);
+	} catch {
+		return;
+	}
+	if (globalPath === projectFilePath) return;
+	try {
+		const content = await readFileContentOrNull(globalPath);
+		if (content === null) return;
+		return readProviderName(parseSharedConfig({
+			format: "yaml",
+			fileContent: content,
+			filePath: globalPath,
+			invalidRootPolicy: "error"
+		}));
+	} catch (error) {
+		logger?.warn(`Takt permissions: could not read the provider from ${globalPath} (${formatError(error)}); falling back to the project config alone.`);
+		return;
+	}
+}
 /** A plain object carrying at least one entry (Takt's "assignment" test). */
 function hasEntries(value) {
 	return isPlainObject$1(value) && Object.keys(value).length > 0;
@@ -71685,6 +72080,14 @@ var PermissionsProcessor = class extends FeatureProcessor {
 			logger: this.logger,
 			global: this.global
 		});
+		if (this.toolTarget === "codewhale" && !this.global) {
+			const projectConfigFile = await createCodewhaleProjectConfigFile({
+				outputRoot: this.outputRoot,
+				config: effectivePermissions.getJson(),
+				logger: this.logger
+			});
+			return projectConfigFile ? [toolPermissions, projectConfigFile] : [toolPermissions];
+		}
 		if (this.toolTarget !== "codexcli") return [toolPermissions];
 		return [toolPermissions, createCodexcliBashRulesFile({
 			outputRoot: this.outputRoot,