rulesync 31.0.0 → 32.0.0

package/dist/{import-CBvXTNp8.cjs → import-Bmb7ofrF.cjs}

@@ -453,36 +453,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$416 } = node_path.posix;
+const { join: join$417 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$416(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$417(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$416(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$416(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$417(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$417(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -4845,13 +4845,11 @@ const PI_HOOK_EVENTS = [
 /**
 * Hook events supported by oh-my-pi (`omp`), Pi's fork, through the same
 * generated TypeScript extension. oh-my-pi keeps Pi's names for every event
-* listed here, but it has neither `agent_before_settle` nor `ui_prompt_start`,
-* so `stop` and `notification` are not mapped yet. oh-my-pi's stop surface is
-* `session_stop`, which takes a Claude-compatible `{ decision: "block", reason }`
-* result; it needs its own handler in the generator and is left for a
-* follow-up. See CANONICAL_TO_OMP_EVENT_NAMES.
+* listed here except `stop`: it has no `agent_before_settle`, so `stop` maps to
+* its own `session_stop` event instead. It has no `ui_prompt_start` either, so
+* `notification` is not mapped. See CANONICAL_TO_OMP_EVENT_NAMES.
 *
-* @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
 */
 const OMP_HOOK_EVENTS = [
 	"sessionStart",
@@ -4862,6 +4860,7 @@ const OMP_HOOK_EVENTS = [
 	"preModelInvocation",
 	"postModelInvocation",
 	"beforeSubmitPrompt",
+	"stop",
 	"preCompact",
 	"postCompact"
 ];
@@ -6283,9 +6282,10 @@ const CANONICAL_TO_PI_EVENT_NAMES = {
 /**
 * Map canonical camelCase event names to oh-my-pi extension event names. They
 * are Pi's names (see CANONICAL_TO_PI_EVENT_NAMES) for the events oh-my-pi
-* kept. Note that oh-my-pi runs `session_shutdown` handlers with a 2-second
-* budget, and fails a `tool_call` closed when its handler exceeds
-* `extensionHandlers.toolCallTimeoutMs` (30 seconds by default).
+* kept, plus `session_stop` for `stop`. Note that oh-my-pi runs
+* `session_shutdown` handlers with a 2-second budget, and fails a `tool_call`
+* closed when its handler exceeds `extensionHandlers.toolCallTimeoutMs`
+* (30 seconds by default).
 *
 * @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
 */
@@ -6298,6 +6298,7 @@ const CANONICAL_TO_OMP_EVENT_NAMES = {
 	preModelInvocation: "context",
 	postModelInvocation: "message_end",
 	beforeSubmitPrompt: "input",
+	stop: "session_stop",
 	preCompact: "session_before_compact",
 	postCompact: "session_compact"
 };
@@ -12955,10 +12956,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 	[CODEWHALE_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
 		invalidRootPolicy: "error",
-		features: { hooks: {
-			kind: "replace-owned-keys",
-			ownedKeys: ["hooks"]
-		} }
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["allow_shell"]
+			}
+		}
 	},
 	".letta/settings.json": {
 		format: "json",
@@ -32857,6 +32864,31 @@ const PI_PROMPT_BLOCKING_EVENT = "input";
 * @see https://github.com/earendil-works/pi/blob/v0.87.1/packages/coding-agent/src/core/extensions/types.ts
 */
 const PI_SETTLE_BLOCKING_EVENT = "agent_before_settle";
+/**
+* `session_stop` is oh-my-pi's stop surface (it has no `agent_before_settle`).
+* It fires when a main-session run is about to settle (never for subagents,
+* nor for a run the user aborted), and a handler returning
+* `{ continue: true, additionalContext }` queues one more turn with that text
+* as hidden model-visible context. As on Pi, only a stop command exiting with
+* code 2 asks for that, the feedback of every such command is combined, and
+* any other failure is rethrown for oh-my-pi to report. The generated handler
+* continues only when `event.stop_hook_active` is false, which oh-my-pi sets
+* after a continuation and clears once a stop pass lets the run settle, so the
+* agent is continued at most once per stop (the flag is shared by every
+* extension, so another extension's continuation also suppresses ours);
+* oh-my-pi additionally caps these
+* advisory continuations at 8 in a row. A run that ended on a provider error
+* (`stopReason: "error"`) is not continued, matching Pi's `completed`-only
+* gate. The advisory form is used rather than `{ decision: "block", reason }`,
+* which oh-my-pi keeps enforcing without that cap. oh-my-pi gives
+* `session_stop` handlers the 30-second extension handler budget: stop
+* commands running longer time the handler out, the run settles without a
+* continuation, and the command is not killed.
+*
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/packages/coding-agent/src/session/agent-session.ts
+*/
+const OMP_SESSION_STOP_BLOCKING_EVENT = "session_stop";
 const PI_EXTENSION_DIALECT = {
 	overrideKey: "pi",
 	typesPackage: "@earendil-works/pi-coding-agent",
@@ -32878,7 +32910,8 @@ const OMP_EXTENSION_DIALECT = {
 const PI_BLOCKING_MODE_BY_EVENT = {
 	[PI_BLOCKING_EVENT]: "tool",
 	[PI_PROMPT_BLOCKING_EVENT]: "prompt",
-	[PI_SETTLE_BLOCKING_EVENT]: "settle"
+	[PI_SETTLE_BLOCKING_EVENT]: "settle",
+	[OMP_SESSION_STOP_BLOCKING_EVENT]: "sessionStop"
 };
 /**
 * The body emitted inside a blocking handler's `catch`, per gate. `tool_call`
@@ -32891,7 +32924,8 @@ function failureLinesByMode(dialect) {
 		none: [],
 		tool: ["return { block: true, reason: toBlockReason(error) };"],
 		prompt: ["reportPromptGateFailure(ctx, toBlockReason(error));", dialect.promptCancelLine],
-		settle: ["stopHookFailures.push(error);"]
+		settle: ["stopHookFailures.push(error);"],
+		sessionStop: ["stopHookFailures.push(error);"]
 	};
 }
 /**
@@ -32983,6 +33017,12 @@ const PROMPT_GATE_HELPER_LINES = [
 	"  console.error(reason);",
 	"}"
 ];
+/** Helper emitted alongside every stop gate (Pi's settle gate and oh-my-pi's `session_stop`). */
+const STOP_HOOK_BLOCK_HELPER_LINES = [
+	"function isStopHookBlock(error: unknown): boolean {",
+	"  return (error as { code?: unknown } | null)?.code === 2;",
+	"}"
+];
 /**
 * Helper emitted alongside the stop hook's settle gate. `event.entries` holds
 * the drafts earlier extensions proposed at this boundary, so they are kept and
@@ -32993,10 +33033,6 @@ const PROMPT_GATE_HELPER_LINES = [
 * appended message is committed, and Pi re-validates the final context itself.
 */
 const STOP_HOOK_HELPER_LINES = [
-	"function isStopHookBlock(error: unknown): boolean {",
-	"  return (error as { code?: unknown } | null)?.code === 2;",
-	"}",
-	"",
 	"function continueAfterStopHook(",
 	"  event: AgentBeforeSettleEvent,",
 	"  reason: string,",
@@ -33079,14 +33115,16 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 		const blocking = PI_BLOCKING_MODE_BY_EVENT[piEvent] ?? "none";
 		const isPromptGate = blocking === "prompt";
 		const isSettleGate = blocking === "settle";
+		const isSessionStopGate = blocking === "sessionStop";
+		const collectsStopFailures = isSettleGate || isSessionStopGate;
 		const usesToolName = PI_TOOL_EVENTS.has(piEvent) && handlers.some((h) => h.matcher);
 		const usesErrorFlag = handlers.some((h) => h.onlyOnError);
 		const gatesOnAssistant = PI_ASSISTANT_MESSAGE_EVENTS.has(piEvent);
-		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || isSettleGate ? "event" : "";
+		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || collectsStopFailures ? "event" : "";
 		lines.push(`  pi.on(${JSON.stringify(piEvent)}, async (${params}) => {`);
 		if (gatesOnAssistant) lines.push(`    if (event.message.role !== "assistant") return;`);
 		if (isPromptGate) lines.push(`    if (event.source === "extension") ${dialect.promptPassLine}`);
-		if (isSettleGate) lines.push("    const stopHookFailures: unknown[] = [];");
+		if (collectsStopFailures) lines.push("    const stopHookFailures: unknown[] = [];");
 		for (const handler of handlers) lines.push(...buildCommandLines({
 			handler,
 			usesToolName,
@@ -33102,6 +33140,17 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 			lines.push("    }");
 			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
 		}
+		if (isSessionStopGate) {
+			lines.push("    const blocks = stopHookFailures.filter(isStopHookBlock);");
+			lines.push("    const endedOnError = (event.last_assistant_message as { stopReason?: unknown } | undefined)?.stopReason === \"error\";");
+			lines.push("    if (blocks.length > 0 && !event.stop_hook_active && !endedOnError) {");
+			lines.push("      return {");
+			lines.push("        continue: true,");
+			lines.push("        additionalContext: `Stop hook feedback:\\n${blocks.map(toBlockReason).join(\"\\n\\n\")}`,");
+			lines.push("      };");
+			lines.push("    }");
+			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
+		}
 		lines.push("  });");
 		if (isSettleGate) {
 			lines.push(`  pi.on("agent_settled", async () => {`);
@@ -33120,8 +33169,9 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 * `{ block: true, reason }`, and on `input` — Pi's prompt-submission gate —
 * where a non-zero exit cancels the prompt with the dialect's cancel result
 * (`{ action: "handled" }` for Pi, `{ handled: true }` for oh-my-pi), and
-* on `agent_before_settle`, where a stop command exiting with code 2 asks the
-* agent to continue once with the command's output as feedback.
+* on `agent_before_settle` (Pi) / `session_stop` (oh-my-pi), where a stop
+* command exiting with code 2 asks the agent to continue once with the
+* command's output as feedback.
 * `postToolUse` and `postToolUseFailure` share Pi's `tool_result` event; the
 * latter's commands run only when `event.isError` is set.
 *
@@ -33142,7 +33192,8 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 	const subscriptionLines = buildSubscriptionLines(handlerGroups, dialect);
 	const hasPromptGate = Boolean(handlerGroups[PI_PROMPT_BLOCKING_EVENT]);
 	const hasSettleGate = Boolean(handlerGroups[PI_SETTLE_BLOCKING_EVENT]);
-	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate;
+	const hasSessionStopGate = Boolean(handlerGroups[OMP_SESSION_STOP_BLOCKING_EVENT]);
+	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate || hasSessionStopGate;
 	const lines = ["// Generated by rulesync. Do not edit manually."];
 	if (subscriptionLines.length === 0) {
 		lines.push("export default function () {}");
@@ -33169,6 +33220,10 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 		lines.push(...PROMPT_GATE_HELPER_LINES);
 		lines.push("");
 	}
+	if (hasSettleGate || hasSessionStopGate) {
+		lines.push(...STOP_HOOK_BLOCK_HELPER_LINES);
+		lines.push("");
+	}
 	if (hasSettleGate) {
 		lines.push(...STOP_HOOK_HELPER_LINES);
 		lines.push("");
@@ -55965,6 +56020,124 @@ function parseCodebuddySettings({ fileContent, relativePath }) {
 	}
 }
 //#endregion
+//#region src/features/permissions/codewhale-project-config.ts
+/**
+* The top-level key of the per-project `.codewhale/config.toml` overlay that
+* hides Codewhale's shell tools. The overlay only tightens: `false` disables
+* shell for the session, while `true` is ignored with a warning.
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/docs/CONFIGURATION.md#per-project-overlay-485
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/crates/tui/src/lib.rs
+*/
+const CODEWHALE_ALLOW_SHELL_KEY = "allow_shell";
+const CODEWHALE_PROJECT_CONFIG_PATHS = {
+	relativeDirPath: CODEWHALE_DIR,
+	relativeFilePath: CODEWHALE_CONFIG_FILE_NAME
+};
+/** The project `.codewhale/config.toml` overlay, as written by the permissions feature. */
+var CodewhaleProjectConfigFile = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+/**
+* Whether the canonical config denies every shell command: a `deny` on the
+* catch-all `*` (or `**`) pattern of `bash` or of the all-tools `*` category.
+* Codewhale decides by action before specificity, so such a deny already
+* blocks every command in global scope too, whatever `allow` rules sit beside
+* it.
+*/
+function deniesEveryShellCommand(permission) {
+	return collectShellCommandRules(permission).rules.some(({ pattern, action }) => action === "deny" && isShellCatchAll(pattern));
+}
+/** Whether a canonical shell pattern names every command. */
+function isShellCatchAll(pattern) {
+	const trimmed = pattern.trim();
+	return trimmed === "*" || trimmed === "**";
+}
+function projectConfigFilePath(outputRoot) {
+	return (0, node_path.join)(outputRoot, CODEWHALE_PROJECT_CONFIG_PATHS.relativeDirPath, CODEWHALE_PROJECT_CONFIG_PATHS.relativeFilePath);
+}
+function parseProjectConfig({ fileContent, filePath }) {
+	return parseSharedConfig({
+		format: "toml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Whether an overlay disables shell (`allow_shell = false`). A file that
+* cannot be read as TOML is reported and treated as not disabling shell.
+*/
+function disablesShell({ fileContent, filePath, logger }) {
+	try {
+		return parseProjectConfig({
+			fileContent,
+			filePath
+		})[CODEWHALE_ALLOW_SHELL_KEY] === false;
+	} catch (error) {
+		logger?.warn(`Codewhale permissions: not reading "allow_shell" from ${filePath}, so a shell deny set there is not taken into account: ${formatError(error)}`);
+		return false;
+	}
+}
+/**
+* Whether the project overlay at `outputRoot` disables shell
+* (`allow_shell = false`), for import.
+*/
+async function readCodewhaleProjectShellDisabled({ outputRoot, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (fileContent === null) return false;
+	return disablesShell({
+		fileContent,
+		filePath,
+		logger
+	});
+}
+/**
+* The project `.codewhale/config.toml` overlay carrying `allow_shell = false`
+* when the canonical config denies every shell command, or `null` when the
+* file needs no change.
+*
+* Only `allow_shell` is written; every other overlay key (`model`,
+* `approval_policy`, ...) is kept, and an existing file that is not valid TOML
+* is an error only when it has to be written. An existing
+* `allow_shell = false` is never removed: the overlay cannot widen access, and
+* a hand-written value cannot be told apart from one rulesync wrote, so it is
+* reported instead.
+*/
+async function createCodewhaleProjectConfigFile({ outputRoot = process.cwd(), config, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const existingContent = await readFileContentOrNull(filePath);
+	if (!deniesEveryShellCommand(config.permission)) {
+		if (existingContent !== null && disablesShell({
+			fileContent: existingContent,
+			filePath,
+			logger
+		})) logger?.warn(`Codewhale permissions: keeping "allow_shell = false" in ${filePath}; rulesync does not remove it. Delete it by hand to re-enable shell tools in this project, or add bash: { "*": "deny" } to the rulesync permissions to match it.`);
+		return null;
+	}
+	if (parseProjectConfig({
+		fileContent: existingContent ?? "",
+		filePath
+	})[CODEWHALE_ALLOW_SHELL_KEY] === false) return null;
+	return new CodewhaleProjectConfigFile({
+		outputRoot,
+		...CODEWHALE_PROJECT_CONFIG_PATHS,
+		fileContent: applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(CODEWHALE_PROJECT_CONFIG_PATHS),
+			feature: "permissions",
+			existingContent: existingContent ?? "",
+			patch: { [CODEWHALE_ALLOW_SHELL_KEY]: false },
+			filePath,
+			logger
+		})
+	});
+}
+//#endregion
 //#region src/features/permissions/codewhale-repo-law.ts
 /**
 * Project-scope Codewhale permissions: the enforced `protected_invariants` of
@@ -56115,7 +56288,8 @@ function collectRestrictions({ config, logger }) {
 	let skippedAllowCount = 0;
 	for (const [category, rules] of Object.entries(config.permission)) {
 		if (!REPO_LAW_CATEGORIES.includes(category)) {
-			if (Object.keys(rules).length > 0) skippedCategories.push(category);
+			const entries = Object.entries(rules);
+			if ((category === "bash" && entries.some(([pattern, action]) => action === "deny" && isShellCatchAll(pattern)) ? entries.filter(([, action]) => action === "allow") : entries).length > 0) skippedCategories.push(category);
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -56841,17 +57015,32 @@ async function warnOnShadowedConstitution({ outputRoot, logger }) {
 * Project scope manages the enforced `protected_invariants` of the repo
 * constitution `.codewhale/constitution.json` (see `codewhale-repo-law.ts`):
 * the project `.codewhale/config.toml` overlay cannot carry rules, but repo
-* law can hold writes to protected paths.
+* law can hold writes to protected paths. A deny on every shell command also
+* sets `allow_shell = false` in that overlay (see
+* `codewhale-project-config.ts`), which import reads back here.
 *
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/CONFIGURATION.md
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/AUTHORIZATION_ORDER.md
 */
 var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
-	constructor(params) {
+	/**
+	* Whether the project `.codewhale/config.toml` overlay disables shell
+	* (`allow_shell = false`); read on import in project scope only.
+	*/
+	projectShellDisabled;
+	constructor({ projectShellDisabled = false, ...params }) {
 		super({
 			...params,
 			fileContent: params.fileContent ?? ""
 		});
+		this.projectShellDisabled = projectShellDisabled;
+	}
+	/**
+	* The project `.codewhale/config.toml` overlay, where a deny on every shell
+	* command becomes `allow_shell = false` beside the user's other overlay keys.
+	*/
+	static getExtraSharedWritePaths(options) {
+		return options?.global ? [] : [{ ...CODEWHALE_PROJECT_CONFIG_PATHS }];
 	}
 	/**
 	* Codewhale's approval card writes to the global file, and the constitution
@@ -56888,7 +57077,11 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			projectShellDisabled: global ? false : await readCodewhaleProjectShellDisabled({
+				outputRoot,
+				logger
+			})
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
@@ -56950,11 +57143,15 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 	toRulesyncPermissions() {
 		const filePath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
 		if (!this.global) {
-			const document = parseCodewhaleConstitution({
+			const permission = codewhaleConstitutionToCanonical(parseCodewhaleConstitution({
 				fileContent: this.getFileContent(),
 				filePath
-			});
-			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission: codewhaleConstitutionToCanonical(document) }, null, 2) });
+			}));
+			if (this.projectShellDisabled) permission.bash = {
+				...permission.bash,
+				"*": "deny"
+			};
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
 		}
 		const { permission, nativeRules } = codewhaleRulesToCanonical(partitionRuleRecords(parsePermissionsDocument({
 			fileContent: this.getFileContent(),
@@ -71883,6 +72080,14 @@ var PermissionsProcessor = class extends FeatureProcessor {
 			logger: this.logger,
 			global: this.global
 		});
+		if (this.toolTarget === "codewhale" && !this.global) {
+			const projectConfigFile = await createCodewhaleProjectConfigFile({
+				outputRoot: this.outputRoot,
+				config: effectivePermissions.getJson(),
+				logger: this.logger
+			});
+			return projectConfigFile ? [toolPermissions, projectConfigFile] : [toolPermissions];
+		}
 		if (this.toolTarget !== "codexcli") return [toolPermissions];
 		return [toolPermissions, createCodexcliBashRulesFile({
 			outputRoot: this.outputRoot,