rulesync 31.0.0 → 33.0.0

package/dist/{import-ORYbMDJK.js → import-5-Uennl1.js}

@@ -4823,13 +4823,11 @@ const PI_HOOK_EVENTS = [
 /**
 * Hook events supported by oh-my-pi (`omp`), Pi's fork, through the same
 * generated TypeScript extension. oh-my-pi keeps Pi's names for every event
-* listed here, but it has neither `agent_before_settle` nor `ui_prompt_start`,
-* so `stop` and `notification` are not mapped yet. oh-my-pi's stop surface is
-* `session_stop`, which takes a Claude-compatible `{ decision: "block", reason }`
-* result; it needs its own handler in the generator and is left for a
-* follow-up. See CANONICAL_TO_OMP_EVENT_NAMES.
+* listed here except `stop`: it has no `agent_before_settle`, so `stop` maps to
+* its own `session_stop` event instead. It has no `ui_prompt_start` either, so
+* `notification` is not mapped. See CANONICAL_TO_OMP_EVENT_NAMES.
 *
-* @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
 */
 const OMP_HOOK_EVENTS = [
 	"sessionStart",
@@ -4840,6 +4838,7 @@ const OMP_HOOK_EVENTS = [
 	"preModelInvocation",
 	"postModelInvocation",
 	"beforeSubmitPrompt",
+	"stop",
 	"preCompact",
 	"postCompact"
 ];
@@ -6261,9 +6260,10 @@ const CANONICAL_TO_PI_EVENT_NAMES = {
 /**
 * Map canonical camelCase event names to oh-my-pi extension event names. They
 * are Pi's names (see CANONICAL_TO_PI_EVENT_NAMES) for the events oh-my-pi
-* kept. Note that oh-my-pi runs `session_shutdown` handlers with a 2-second
-* budget, and fails a `tool_call` closed when its handler exceeds
-* `extensionHandlers.toolCallTimeoutMs` (30 seconds by default).
+* kept, plus `session_stop` for `stop`. Note that oh-my-pi runs
+* `session_shutdown` handlers with a 2-second budget, and fails a `tool_call`
+* closed when its handler exceeds `extensionHandlers.toolCallTimeoutMs`
+* (30 seconds by default).
 *
 * @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
 */
@@ -6276,6 +6276,7 @@ const CANONICAL_TO_OMP_EVENT_NAMES = {
 	preModelInvocation: "context",
 	postModelInvocation: "message_end",
 	beforeSubmitPrompt: "input",
+	stop: "session_stop",
 	preCompact: "session_before_compact",
 	postCompact: "session_compact"
 };
@@ -12933,10 +12934,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 	[CODEWHALE_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
 		invalidRootPolicy: "error",
-		features: { hooks: {
-			kind: "replace-owned-keys",
-			ownedKeys: ["hooks"]
-		} }
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["allow_shell"]
+			}
+		}
 	},
 	".letta/settings.json": {
 		format: "json",
@@ -21737,22 +21744,29 @@ function mergeOpencodeV2Entries({ config, legacyKey, pluralKey, lower }) {
 		const entry = asOpencodeEntries(value);
 		const lowered = entry === null ? null : lower(entry);
 		if (Object.hasOwn(merged, name) || lowered === null) continue;
-		Object.defineProperty(merged, name, {
-			value: lowered,
-			enumerable: true,
-			configurable: true,
-			writable: true
-		});
+		setOwnEntry(merged, name, lowered);
 	}
 	return Object.keys(merged).length > 0 ? merged : legacy;
 }
 /**
+* Sets `target[key]` as an own, enumerable property. A plain assignment to a
+* key named `__proto__` would set the prototype instead.
+*/
+function setOwnEntry(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		configurable: true,
+		writable: true
+	});
+}
+/**
 * Returns the inline agent entries of an OpenCode config in the V1 `agent`
 * shape. Since v1.18.24 OpenCode V1 also reads the V2 `agents` spelling and
 * lowers it, so a layout that does so (`readsV2ConfigSpellings`) gets those
 * entries too.
 *
-* @see https://github.com/anomalyco/opencode/blob/v1.18.34/packages/opencode/src/config/v2-compat.ts
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
 */
 function getOpencodeAgentEntries({ config, layout = OPENCODE_LAYOUT }) {
 	if (!layout.readsV2ConfigSpellings) return asOpencodeEntries(config.agent);
@@ -21771,7 +21785,7 @@ function getOpencodeAgentEntries({ config, layout = OPENCODE_LAYOUT }) {
 * Other fields are kept: V1 drops a V2 `subagent`, but rulesync reads it as
 * `subtask` everywhere (as V2 does), so it is left for the command importer.
 *
-* @see https://github.com/anomalyco/opencode/blob/v1.18.34/packages/opencode/src/config/v2-compat.ts
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
 */
 function getOpencodeCommandEntries({ config, layout = OPENCODE_LAYOUT }) {
 	if (!layout.readsV2ConfigSpellings) return asOpencodeEntries(config.command);
@@ -21794,7 +21808,7 @@ function getOpencodeCommandEntries({ config, layout = OPENCODE_LAYOUT }) {
 * reads V2 spellings, a flat V2 `skills` array is accepted too: its entries
 * that are not `http(s)://` URLs are the paths, as OpenCode V1 lowers them.
 *
-* @see https://github.com/anomalyco/opencode/blob/v1.18.34/packages/opencode/src/config/v2-compat.ts
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
 */
 function getOpencodeSkillPaths({ config, layout = OPENCODE_LAYOUT }) {
 	if (Array.isArray(config.skills)) {
@@ -21804,6 +21818,160 @@ function getOpencodeSkillPaths({ config, layout = OPENCODE_LAYOUT }) {
 	const skills = asOpencodeEntries(config.skills);
 	return skills !== null && Array.isArray(skills.paths) ? skills.paths : [];
 }
+/**
+* Whether a record is itself an MCP server entry rather than a V2 container
+* (`mcp.servers`, `mcp.timeout`): a server — or a server literally named
+* `type` / `enabled` — carries a scalar `type` or `enabled`. Mirrors OpenCode
+* V1's `isDirectServer`.
+*/
+function isDirectOpencodeMcpServer(value) {
+	return ["type", "enabled"].some((key) => Object.hasOwn(value, key) && (value[key] === null || typeof value[key] !== "object" || Array.isArray(value[key])));
+}
+const OPENCODE_V2_TIMEOUT_KEYS = [
+	"startup",
+	"catalog",
+	"execution"
+];
+/**
+* Whether an MCP server entry uses a V2-only per-server spelling, so that
+* OpenCode V1 lowers it: `disabled`, `codemode`, an object `timeout`, or a
+* snake_case `oauth` key.
+*/
+function isOpencodeV2NativeServer(value) {
+	const oauth = value.oauth;
+	return Object.hasOwn(value, "disabled") || Object.hasOwn(value, "codemode") || isRecord$1(value.timeout) || isRecord$1(oauth) && [
+		"client_id",
+		"client_secret",
+		"callback_port",
+		"redirect_uri"
+	].some((key) => Object.hasOwn(oauth, key));
+}
+/**
+* Lowers a V2 timeout object (`{ startup, catalog, execution }`) to V1's single
+* number, the way OpenCode V1 does: only a `catalog` equal to `execution`, with
+* no `startup`, has a V1 equivalent. Anything else — including a value that is
+* not a positive integer — is `undefined` (dropped).
+*/
+function lowerOpencodeV2Timeout(value) {
+	if (!hasPositiveIntegerTimeouts(value) || value.startup !== void 0 || typeof value.catalog !== "number") return;
+	return value.catalog === value.execution ? value.catalog : void 0;
+}
+const OPENCODE_V2_OAUTH_KEYS = /* @__PURE__ */ new Map([
+	["client_id", "clientId"],
+	["client_secret", "clientSecret"],
+	["callback_port", "callbackPort"],
+	["redirect_uri", "redirectUri"]
+]);
+/**
+* V2 `oauth` keys that have no V1 spelling. OpenCode V1 drops them when it
+* lowers a server, so they are dropped (and reported) here too rather than
+* being written back as a snake_case key among camelCase ones.
+*/
+const OPENCODE_V2_UNSUPPORTED_OAUTH_KEYS = /* @__PURE__ */ new Set(["auth_server_metadata_url"]);
+function lowerOpencodeV2OAuth(oauth, path, onDropped) {
+	const lowered = {};
+	for (const [key, value] of Object.entries(oauth)) {
+		if (OPENCODE_V2_UNSUPPORTED_OAUTH_KEYS.has(key)) {
+			onDropped?.(`${path}.${key}`, "unsupported");
+			continue;
+		}
+		setOwnEntry(lowered, OPENCODE_V2_OAUTH_KEYS.get(key) ?? key, value);
+	}
+	return lowered;
+}
+/**
+* Lowers one V2-spelled MCP server entry to V1's shape, as OpenCode V1 does:
+* `disabled` becomes `enabled` (an explicit `enabled` wins), an object
+* `timeout` becomes a number or is dropped, and snake_case `oauth` keys become
+* camelCase. `codemode` is kept: Rulesync passes it through where V1 drops it.
+*
+* Like V1, only an entry that is a local or remote server is lowered, and one
+* whose `enabled` or `disabled` is not a boolean is left as it is. Unlike V1,
+* such an entry is not dropped but passed on, so the schema rejects it loudly.
+*/
+function lowerOpencodeV2Server(value, path, onDropped) {
+	if (!isRecord$1(value) || value.type !== "local" && value.type !== "remote" || Object.hasOwn(value, "enabled") && typeof value.enabled !== "boolean" || Object.hasOwn(value, "disabled") && typeof value.disabled !== "boolean") return value;
+	const { disabled, timeout, ...rest } = value;
+	const lowered = { ...rest };
+	if (!Object.hasOwn(value, "enabled")) lowered.enabled = disabled !== true;
+	else if (value.enabled === disabled) onDropped?.(`${path}.disabled`, "conflict");
+	const lowTimeout = isRecord$1(timeout) ? lowerOpencodeV2Timeout(timeout) : timeout;
+	if (lowTimeout !== void 0) lowered.timeout = lowTimeout;
+	else if (isRecord$1(timeout) && Object.keys(timeout).length > 0) onDropped?.(`${path}.timeout`, "unsupported");
+	if (isRecord$1(value.oauth)) lowered.oauth = lowerOpencodeV2OAuth(value.oauth, `${path}.oauth`, onDropped);
+	return lowered;
+}
+function isPositiveInteger(value) {
+	return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+/** Whether each V2 timeout value a record carries is a positive integer. */
+function hasPositiveIntegerTimeouts(value) {
+	return OPENCODE_V2_TIMEOUT_KEYS.every((key) => value[key] === void 0 || isPositiveInteger(value[key]));
+}
+/**
+* Whether `mcp.timeout` is V2's global timeout object rather than a server
+* named `timeout`. As in OpenCode V1, each of its values must be a positive
+* integer; anything else is read as a server, which the schema then rejects.
+*/
+function isOpencodeV2GlobalTimeout(value) {
+	return isRecord$1(value) && !isDirectOpencodeMcpServer(value) && (Object.keys(value).length === 0 || OPENCODE_V2_TIMEOUT_KEYS.some((key) => Object.hasOwn(value, key))) && hasPositiveIntegerTimeouts(value);
+}
+function getOpencodeV2McpEnvelope(mcp) {
+	const nested = mcp.servers;
+	return isRecord$1(nested) && !isDirectOpencodeMcpServer(nested) ? nested : null;
+}
+/**
+* Returns the paths of the V2-only containers in an OpenCode `mcp` value that
+* a write in V1's flat shape does not keep: a non-empty `mcp.servers`
+* envelope, and a non-empty global `mcp.timeout`.
+*/
+function findOpencodeV2McpContainers(mcp) {
+	if (!isRecord$1(mcp)) return [];
+	const envelope = getOpencodeV2McpEnvelope(mcp);
+	return [...envelope !== null && Object.keys(envelope).length > 0 ? ["mcp.servers"] : [], ...isOpencodeV2GlobalTimeout(mcp.timeout) && Object.keys(mcp.timeout).length > 0 ? ["mcp.timeout"] : []];
+}
+/**
+* Lowers OpenCode V2 `mcp` spellings found in a V1 config to the flat V1 map,
+* the way OpenCode V1 itself does since v1.18.24 (`normalizeMcp`):
+*
+* - entries of the `mcp.servers` envelope are merged into the map, a flat entry
+*   of the same name winning;
+* - V2-spelled server entries (`disabled`, an object `timeout`, snake_case
+*   `oauth` keys) are lowered by {@link lowerOpencodeV2Server};
+* - the global `mcp.timeout` object is skipped. V1 moves it to
+*   `experimental.mcp_timeout`, a default request timeout that has no
+*   canonical counterpart, so it is not read as a server either.
+*
+* Unlike V1, an envelope entry that is not a valid server is not dropped: it
+* is passed on, so the schema rejects it loudly rather than it vanishing
+* without a word. Each value that is dropped — a non-empty global timeout, a
+* per-server timeout object or `oauth` key with no V1 equivalent, or an
+* envelope entry shadowed by a different flat entry — is reported through
+* `onDropped`.
+*
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
+* @see https://opencode.ai/v2/docs/mcp-servers/
+*/
+function lowerOpencodeV2Mcp(mcp, onDropped) {
+	if (!isRecord$1(mcp)) return mcp;
+	const envelope = getOpencodeV2McpEnvelope(mcp);
+	const globalTimeout = isOpencodeV2GlobalTimeout(mcp.timeout);
+	if (findOpencodeV2McpContainers(mcp).includes("mcp.timeout")) onDropped?.("mcp.timeout", "unsupported");
+	const servers = {};
+	for (const [name, value] of Object.entries(mcp)) {
+		if (name === "servers" && envelope !== null || name === "timeout" && globalTimeout) continue;
+		setOwnEntry(servers, name, isRecord$1(value) && isOpencodeV2NativeServer(value) ? lowerOpencodeV2Server(value, `mcp.${name}`, onDropped) : value);
+	}
+	for (const [name, value] of Object.entries(envelope ?? {})) {
+		const path = `mcp.servers.${name}`;
+		if (Object.hasOwn(servers, name)) {
+			if (!isDeepStrictEqual(servers[name], value)) onDropped?.(path, "conflict");
+			continue;
+		}
+		setOwnEntry(servers, name, lowerOpencodeV2Server(value, path, onDropped));
+	}
+	return servers;
+}
 /** Matches a string whose entire value is an OpenCode `{file:...}` reference. */
 const OPENCODE_FILE_TEMPLATE_PATTERN = /^\s*\{file:(.+?)\}\s*$/;
 /**
@@ -32835,6 +33003,31 @@ const PI_PROMPT_BLOCKING_EVENT = "input";
 * @see https://github.com/earendil-works/pi/blob/v0.87.1/packages/coding-agent/src/core/extensions/types.ts
 */
 const PI_SETTLE_BLOCKING_EVENT = "agent_before_settle";
+/**
+* `session_stop` is oh-my-pi's stop surface (it has no `agent_before_settle`).
+* It fires when a main-session run is about to settle (never for subagents,
+* nor for a run the user aborted), and a handler returning
+* `{ continue: true, additionalContext }` queues one more turn with that text
+* as hidden model-visible context. As on Pi, only a stop command exiting with
+* code 2 asks for that, the feedback of every such command is combined, and
+* any other failure is rethrown for oh-my-pi to report. The generated handler
+* continues only when `event.stop_hook_active` is false, which oh-my-pi sets
+* after a continuation and clears once a stop pass lets the run settle, so the
+* agent is continued at most once per stop (the flag is shared by every
+* extension, so another extension's continuation also suppresses ours);
+* oh-my-pi additionally caps these
+* advisory continuations at 8 in a row. A run that ended on a provider error
+* (`stopReason: "error"`) is not continued, matching Pi's `completed`-only
+* gate. The advisory form is used rather than `{ decision: "block", reason }`,
+* which oh-my-pi keeps enforcing without that cap. oh-my-pi gives
+* `session_stop` handlers the 30-second extension handler budget: stop
+* commands running longer time the handler out, the run settles without a
+* continuation, and the command is not killed.
+*
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/packages/coding-agent/src/session/agent-session.ts
+*/
+const OMP_SESSION_STOP_BLOCKING_EVENT = "session_stop";
 const PI_EXTENSION_DIALECT = {
 	overrideKey: "pi",
 	typesPackage: "@earendil-works/pi-coding-agent",
@@ -32856,7 +33049,8 @@ const OMP_EXTENSION_DIALECT = {
 const PI_BLOCKING_MODE_BY_EVENT = {
 	[PI_BLOCKING_EVENT]: "tool",
 	[PI_PROMPT_BLOCKING_EVENT]: "prompt",
-	[PI_SETTLE_BLOCKING_EVENT]: "settle"
+	[PI_SETTLE_BLOCKING_EVENT]: "settle",
+	[OMP_SESSION_STOP_BLOCKING_EVENT]: "sessionStop"
 };
 /**
 * The body emitted inside a blocking handler's `catch`, per gate. `tool_call`
@@ -32869,7 +33063,8 @@ function failureLinesByMode(dialect) {
 		none: [],
 		tool: ["return { block: true, reason: toBlockReason(error) };"],
 		prompt: ["reportPromptGateFailure(ctx, toBlockReason(error));", dialect.promptCancelLine],
-		settle: ["stopHookFailures.push(error);"]
+		settle: ["stopHookFailures.push(error);"],
+		sessionStop: ["stopHookFailures.push(error);"]
 	};
 }
 /**
@@ -32961,6 +33156,12 @@ const PROMPT_GATE_HELPER_LINES = [
 	"  console.error(reason);",
 	"}"
 ];
+/** Helper emitted alongside every stop gate (Pi's settle gate and oh-my-pi's `session_stop`). */
+const STOP_HOOK_BLOCK_HELPER_LINES = [
+	"function isStopHookBlock(error: unknown): boolean {",
+	"  return (error as { code?: unknown } | null)?.code === 2;",
+	"}"
+];
 /**
 * Helper emitted alongside the stop hook's settle gate. `event.entries` holds
 * the drafts earlier extensions proposed at this boundary, so they are kept and
@@ -32971,10 +33172,6 @@ const PROMPT_GATE_HELPER_LINES = [
 * appended message is committed, and Pi re-validates the final context itself.
 */
 const STOP_HOOK_HELPER_LINES = [
-	"function isStopHookBlock(error: unknown): boolean {",
-	"  return (error as { code?: unknown } | null)?.code === 2;",
-	"}",
-	"",
 	"function continueAfterStopHook(",
 	"  event: AgentBeforeSettleEvent,",
 	"  reason: string,",
@@ -33057,14 +33254,16 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 		const blocking = PI_BLOCKING_MODE_BY_EVENT[piEvent] ?? "none";
 		const isPromptGate = blocking === "prompt";
 		const isSettleGate = blocking === "settle";
+		const isSessionStopGate = blocking === "sessionStop";
+		const collectsStopFailures = isSettleGate || isSessionStopGate;
 		const usesToolName = PI_TOOL_EVENTS.has(piEvent) && handlers.some((h) => h.matcher);
 		const usesErrorFlag = handlers.some((h) => h.onlyOnError);
 		const gatesOnAssistant = PI_ASSISTANT_MESSAGE_EVENTS.has(piEvent);
-		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || isSettleGate ? "event" : "";
+		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || collectsStopFailures ? "event" : "";
 		lines.push(`  pi.on(${JSON.stringify(piEvent)}, async (${params}) => {`);
 		if (gatesOnAssistant) lines.push(`    if (event.message.role !== "assistant") return;`);
 		if (isPromptGate) lines.push(`    if (event.source === "extension") ${dialect.promptPassLine}`);
-		if (isSettleGate) lines.push("    const stopHookFailures: unknown[] = [];");
+		if (collectsStopFailures) lines.push("    const stopHookFailures: unknown[] = [];");
 		for (const handler of handlers) lines.push(...buildCommandLines({
 			handler,
 			usesToolName,
@@ -33080,6 +33279,17 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 			lines.push("    }");
 			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
 		}
+		if (isSessionStopGate) {
+			lines.push("    const blocks = stopHookFailures.filter(isStopHookBlock);");
+			lines.push("    const endedOnError = (event.last_assistant_message as { stopReason?: unknown } | undefined)?.stopReason === \"error\";");
+			lines.push("    if (blocks.length > 0 && !event.stop_hook_active && !endedOnError) {");
+			lines.push("      return {");
+			lines.push("        continue: true,");
+			lines.push("        additionalContext: `Stop hook feedback:\\n${blocks.map(toBlockReason).join(\"\\n\\n\")}`,");
+			lines.push("      };");
+			lines.push("    }");
+			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
+		}
 		lines.push("  });");
 		if (isSettleGate) {
 			lines.push(`  pi.on("agent_settled", async () => {`);
@@ -33098,8 +33308,9 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 * `{ block: true, reason }`, and on `input` — Pi's prompt-submission gate —
 * where a non-zero exit cancels the prompt with the dialect's cancel result
 * (`{ action: "handled" }` for Pi, `{ handled: true }` for oh-my-pi), and
-* on `agent_before_settle`, where a stop command exiting with code 2 asks the
-* agent to continue once with the command's output as feedback.
+* on `agent_before_settle` (Pi) / `session_stop` (oh-my-pi), where a stop
+* command exiting with code 2 asks the agent to continue once with the
+* command's output as feedback.
 * `postToolUse` and `postToolUseFailure` share Pi's `tool_result` event; the
 * latter's commands run only when `event.isError` is set.
 *
@@ -33120,7 +33331,8 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 	const subscriptionLines = buildSubscriptionLines(handlerGroups, dialect);
 	const hasPromptGate = Boolean(handlerGroups[PI_PROMPT_BLOCKING_EVENT]);
 	const hasSettleGate = Boolean(handlerGroups[PI_SETTLE_BLOCKING_EVENT]);
-	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate;
+	const hasSessionStopGate = Boolean(handlerGroups[OMP_SESSION_STOP_BLOCKING_EVENT]);
+	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate || hasSessionStopGate;
 	const lines = ["// Generated by rulesync. Do not edit manually."];
 	if (subscriptionLines.length === 0) {
 		lines.push("export default function () {}");
@@ -33147,6 +33359,10 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 		lines.push(...PROMPT_GATE_HELPER_LINES);
 		lines.push("");
 	}
+	if (hasSettleGate || hasSessionStopGate) {
+		lines.push(...STOP_HOOK_BLOCK_HELPER_LINES);
+		lines.push("");
+	}
 	if (hasSettleGate) {
 		lines.push(...STOP_HOOK_HELPER_LINES);
 		lines.push("");
@@ -45504,18 +45720,21 @@ var KiroMcp = class KiroMcp extends ToolMcp {
 };
 //#endregion
 //#region src/features/mcp/opencode-mcp.ts
+const OpencodeMcpV2DisabledSchema = z.optional(z.boolean());
 const OpencodeMcpLocalServerSchema = z.looseObject({
 	type: z.literal("local"),
 	command: z.array(z.string()),
 	environment: z.optional(z.record(z.string(), z.string())),
 	enabled: z._default(z.boolean(), true),
+	disabled: OpencodeMcpV2DisabledSchema,
 	cwd: z.optional(z.string())
 });
 const OpencodeMcpRemoteServerSchema = z.looseObject({
 	type: z.literal("remote"),
 	url: z.string(),
 	headers: z.optional(z.record(z.string(), z.string())),
-	enabled: z._default(z.boolean(), true)
+	enabled: z._default(z.boolean(), true),
+	disabled: OpencodeMcpV2DisabledSchema
 });
 const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
 	"timeout",
@@ -45527,7 +45746,7 @@ const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
 	...Object.keys(OpencodeMcpRemoteServerSchema.def.shape),
 	...OPENCODE_PASSTHROUGH_SERVER_FIELDS
-].filter((key) => key !== "enabled");
+].filter((key) => key !== "enabled" && key !== "disabled");
 /**
 * A bare toggle entry: `{"enabled": <bool>}` with no transport of its own,
 * disabling a server another config layer defines. It is the third member of
@@ -45655,7 +45874,7 @@ const OPENCODE_TOGGLE_KEPT_KEYS = /* @__PURE__ */ new Set([
 function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 	const dropped = Object.keys(serverConfig).filter((key) => !OPENCODE_TOGGLE_KEPT_KEYS.has(key));
 	if (dropped.length === 0) return;
-	logger?.warn(`OpenCode MCP: "${serverName}" declares no transport, so it is written as a toggle entry and ${dropped.toSorted().join(", ")} ${dropped.length === 1 ? "is" : "are"} dropped.`);
+	logger?.warn(`OpenCode MCP: ${quoteValueForWarning(serverName)} declares no transport, so it is written as a toggle entry and ${dropped.toSorted().map(quoteValueForWarning).join(", ")} ${dropped.length === 1 ? "is" : "are"} dropped.`);
 }
 /**
 * Convert standard MCP format to OpenCode native format
@@ -45735,9 +45954,35 @@ var OpencodeMcp = class extends ToolMcp {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
 	static layout = OPENCODE_LAYOUT;
 	json;
-	constructor(params) {
+	/**
+	* With a `logger`, the V2 values that lowering the content drops are warned
+	* about (see {@link OpencodeMcp.lowerConfig}); `fromFile` passes one so the
+	* warnings come from the lowering that builds the parsed view rather than
+	* from an extra pass of their own. (`validate()`, which the parent
+	* constructor calls before this view exists, lowers separately and silently.)
+	*/
+	constructor({ logger, ...params }) {
 		super(params);
-		this.json = OpencodeConfigSchema.parse(parse$1(this.fileContent || "{}"));
+		this.json = OpencodeConfigSchema.parse(this.constructor.lowerConfig(parse$1(this.fileContent || "{}"), logger));
+	}
+	/**
+	* Lowers the OpenCode V2 `mcp` spellings of a parsed config for a layout
+	* that reads them (see {@link lowerOpencodeV2Mcp}), so every reader — import,
+	* the toggle lookup on generate, and the rules feature's `instructions`
+	* write to the same file — accepts a V2-shaped `mcp`. Only the parsed view
+	* is lowered; content written back keeps whatever `mcp` a feature that does
+	* not own the key found there. With a `logger`, each V2 value the lowering
+	* drops is warned about.
+	*/
+	static lowerConfig(json, logger) {
+		if (!this.layout.readsV2ConfigSpellings || !isRecord$1(json) || json.mcp === void 0) return json;
+		return {
+			...json,
+			mcp: lowerOpencodeV2Mcp(json.mcp, (path, reason) => {
+				const quoted = quoteValueForWarning(path);
+				logger?.warn(reason === "conflict" ? `OpenCode MCP: ${quoted} conflicts with a V1 value that takes precedence (the flat "mcp" entry of the same name, or "enabled"), so it is dropped on import.` : `OpenCode MCP: ${quoted} has no Rulesync equivalent, so it is dropped on import.`);
+			})
+		};
 	}
 	getJson() {
 		return this.json;
@@ -45754,7 +45999,7 @@ var OpencodeMcp = class extends ToolMcp {
 			relativeFilePath: this.layout.jsonFileName
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
 		const basePaths = this.getSettablePaths({ global });
 		const jsonDir = join(outputRoot, basePaths.relativeDirPath);
 		let fileContent = null;
@@ -45776,7 +46021,8 @@ var OpencodeMcp = class extends ToolMcp {
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
 			fileContent: JSON.stringify(newJson, null, 2),
-			validate
+			validate,
+			logger
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
@@ -45795,7 +46041,12 @@ var OpencodeMcp = class extends ToolMcp {
 			mcpServers: rulesyncMcp.getMcpServers(),
 			replacement: "{env:$1}"
 		});
-		const existingMcp = OpencodeConfigSchema.safeParse(parse$1(fileContent || "{}"));
+		const existingJson = parse$1(fileContent || "{}");
+		const existingMcp = OpencodeConfigSchema.safeParse(this.lowerConfig(existingJson));
+		if (this.layout.readsV2ConfigSpellings && isRecord$1(existingJson)) {
+			const containers = findOpencodeV2McpContainers(existingJson.mcp);
+			if (containers.length > 0) logger?.warn(`OpenCode MCP: the whole "mcp" key is rewritten in the flat V1 shape, so ${containers.map(quoteValueForWarning).join(" and ")} ${containers.length === 1 ? "is" : "are"} not kept.`);
+		}
 		const { mcp: convertedMcp, tools: mcpTools } = convertToOpencodeFormat(transformedServers, (existingMcp.success ? existingMcp.data.mcp : void 0) ?? {}, logger);
 		return new this({
 			outputRoot,
@@ -45895,7 +46146,7 @@ var OpencodeMcp = class extends ToolMcp {
 	}
 	validate() {
 		const json = parseJsonc(this.fileContent || "{}");
-		const result = OpencodeConfigSchema.safeParse(json);
+		const result = OpencodeConfigSchema.safeParse(this.constructor.lowerConfig(json));
 		if (!result.success) return {
 			success: false,
 			error: result.error
@@ -55943,6 +56194,124 @@ function parseCodebuddySettings({ fileContent, relativePath }) {
 	}
 }
 //#endregion
+//#region src/features/permissions/codewhale-project-config.ts
+/**
+* The top-level key of the per-project `.codewhale/config.toml` overlay that
+* hides Codewhale's shell tools. The overlay only tightens: `false` disables
+* shell for the session, while `true` is ignored with a warning.
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/docs/CONFIGURATION.md#per-project-overlay-485
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/crates/tui/src/lib.rs
+*/
+const CODEWHALE_ALLOW_SHELL_KEY = "allow_shell";
+const CODEWHALE_PROJECT_CONFIG_PATHS = {
+	relativeDirPath: CODEWHALE_DIR,
+	relativeFilePath: CODEWHALE_CONFIG_FILE_NAME
+};
+/** The project `.codewhale/config.toml` overlay, as written by the permissions feature. */
+var CodewhaleProjectConfigFile = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+/**
+* Whether the canonical config denies every shell command: a `deny` on the
+* catch-all `*` (or `**`) pattern of `bash` or of the all-tools `*` category.
+* Codewhale decides by action before specificity, so such a deny already
+* blocks every command in global scope too, whatever `allow` rules sit beside
+* it.
+*/
+function deniesEveryShellCommand(permission) {
+	return collectShellCommandRules(permission).rules.some(({ pattern, action }) => action === "deny" && isShellCatchAll(pattern));
+}
+/** Whether a canonical shell pattern names every command. */
+function isShellCatchAll(pattern) {
+	const trimmed = pattern.trim();
+	return trimmed === "*" || trimmed === "**";
+}
+function projectConfigFilePath(outputRoot) {
+	return join(outputRoot, CODEWHALE_PROJECT_CONFIG_PATHS.relativeDirPath, CODEWHALE_PROJECT_CONFIG_PATHS.relativeFilePath);
+}
+function parseProjectConfig({ fileContent, filePath }) {
+	return parseSharedConfig({
+		format: "toml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Whether an overlay disables shell (`allow_shell = false`). A file that
+* cannot be read as TOML is reported and treated as not disabling shell.
+*/
+function disablesShell({ fileContent, filePath, logger }) {
+	try {
+		return parseProjectConfig({
+			fileContent,
+			filePath
+		})[CODEWHALE_ALLOW_SHELL_KEY] === false;
+	} catch (error) {
+		logger?.warn(`Codewhale permissions: not reading "allow_shell" from ${filePath}, so a shell deny set there is not taken into account: ${formatError(error)}`);
+		return false;
+	}
+}
+/**
+* Whether the project overlay at `outputRoot` disables shell
+* (`allow_shell = false`), for import.
+*/
+async function readCodewhaleProjectShellDisabled({ outputRoot, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (fileContent === null) return false;
+	return disablesShell({
+		fileContent,
+		filePath,
+		logger
+	});
+}
+/**
+* The project `.codewhale/config.toml` overlay carrying `allow_shell = false`
+* when the canonical config denies every shell command, or `null` when the
+* file needs no change.
+*
+* Only `allow_shell` is written; every other overlay key (`model`,
+* `approval_policy`, ...) is kept, and an existing file that is not valid TOML
+* is an error only when it has to be written. An existing
+* `allow_shell = false` is never removed: the overlay cannot widen access, and
+* a hand-written value cannot be told apart from one rulesync wrote, so it is
+* reported instead.
+*/
+async function createCodewhaleProjectConfigFile({ outputRoot = process.cwd(), config, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const existingContent = await readFileContentOrNull(filePath);
+	if (!deniesEveryShellCommand(config.permission)) {
+		if (existingContent !== null && disablesShell({
+			fileContent: existingContent,
+			filePath,
+			logger
+		})) logger?.warn(`Codewhale permissions: keeping "allow_shell = false" in ${filePath}; rulesync does not remove it. Delete it by hand to re-enable shell tools in this project, or add bash: { "*": "deny" } to the rulesync permissions to match it.`);
+		return null;
+	}
+	if (parseProjectConfig({
+		fileContent: existingContent ?? "",
+		filePath
+	})[CODEWHALE_ALLOW_SHELL_KEY] === false) return null;
+	return new CodewhaleProjectConfigFile({
+		outputRoot,
+		...CODEWHALE_PROJECT_CONFIG_PATHS,
+		fileContent: applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(CODEWHALE_PROJECT_CONFIG_PATHS),
+			feature: "permissions",
+			existingContent: existingContent ?? "",
+			patch: { [CODEWHALE_ALLOW_SHELL_KEY]: false },
+			filePath,
+			logger
+		})
+	});
+}
+//#endregion
 //#region src/features/permissions/codewhale-repo-law.ts
 /**
 * Project-scope Codewhale permissions: the enforced `protected_invariants` of
@@ -56093,7 +56462,8 @@ function collectRestrictions({ config, logger }) {
 	let skippedAllowCount = 0;
 	for (const [category, rules] of Object.entries(config.permission)) {
 		if (!REPO_LAW_CATEGORIES.includes(category)) {
-			if (Object.keys(rules).length > 0) skippedCategories.push(category);
+			const entries = Object.entries(rules);
+			if ((category === "bash" && entries.some(([pattern, action]) => action === "deny" && isShellCatchAll(pattern)) ? entries.filter(([, action]) => action === "allow") : entries).length > 0) skippedCategories.push(category);
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -56819,17 +57189,32 @@ async function warnOnShadowedConstitution({ outputRoot, logger }) {
 * Project scope manages the enforced `protected_invariants` of the repo
 * constitution `.codewhale/constitution.json` (see `codewhale-repo-law.ts`):
 * the project `.codewhale/config.toml` overlay cannot carry rules, but repo
-* law can hold writes to protected paths.
+* law can hold writes to protected paths. A deny on every shell command also
+* sets `allow_shell = false` in that overlay (see
+* `codewhale-project-config.ts`), which import reads back here.
 *
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/CONFIGURATION.md
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/AUTHORIZATION_ORDER.md
 */
 var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
-	constructor(params) {
+	/**
+	* Whether the project `.codewhale/config.toml` overlay disables shell
+	* (`allow_shell = false`); read on import in project scope only.
+	*/
+	projectShellDisabled;
+	constructor({ projectShellDisabled = false, ...params }) {
 		super({
 			...params,
 			fileContent: params.fileContent ?? ""
 		});
+		this.projectShellDisabled = projectShellDisabled;
+	}
+	/**
+	* The project `.codewhale/config.toml` overlay, where a deny on every shell
+	* command becomes `allow_shell = false` beside the user's other overlay keys.
+	*/
+	static getExtraSharedWritePaths(options) {
+		return options?.global ? [] : [{ ...CODEWHALE_PROJECT_CONFIG_PATHS }];
 	}
 	/**
 	* Codewhale's approval card writes to the global file, and the constitution
@@ -56866,7 +57251,11 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			projectShellDisabled: global ? false : await readCodewhaleProjectShellDisabled({
+				outputRoot,
+				logger
+			})
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
@@ -56928,11 +57317,15 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 	toRulesyncPermissions() {
 		const filePath = join(this.getRelativeDirPath(), this.getRelativeFilePath());
 		if (!this.global) {
-			const document = parseCodewhaleConstitution({
+			const permission = codewhaleConstitutionToCanonical(parseCodewhaleConstitution({
 				fileContent: this.getFileContent(),
 				filePath
-			});
-			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission: codewhaleConstitutionToCanonical(document) }, null, 2) });
+			}));
+			if (this.projectShellDisabled) permission.bash = {
+				...permission.bash,
+				"*": "deny"
+			};
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
 		}
 		const { permission, nativeRules } = codewhaleRulesToCanonical(partitionRuleRecords(parsePermissionsDocument({
 			fileContent: this.getFileContent(),
@@ -71861,6 +72254,14 @@ var PermissionsProcessor = class extends FeatureProcessor {
 			logger: this.logger,
 			global: this.global
 		});
+		if (this.toolTarget === "codewhale" && !this.global) {
+			const projectConfigFile = await createCodewhaleProjectConfigFile({
+				outputRoot: this.outputRoot,
+				config: effectivePermissions.getJson(),
+				logger: this.logger
+			});
+			return projectConfigFile ? [toolPermissions, projectConfigFile] : [toolPermissions];
+		}
 		if (this.toolTarget !== "codexcli") return [toolPermissions];
 		return [toolPermissions, createCodexcliBashRulesFile({
 			outputRoot: this.outputRoot,
@@ -101527,4 +101928,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncHooks as $, removeFile as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_RELATIVE_DIR_PATH as An, applyFileMode as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, DEPRECATED_FEATURE_REPLACEMENTS as Bn, getFileSize as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_MCP_SCHEMA_URL as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_USER_CONFIG_DIR_NAME as Fn, createTempDirectory as Ft, RulesyncSubagentFrontmatterSchema as G, quoteForLog as Gn, listDirectoryEntryNames as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, truncateText as Hn, isFileNotFoundError as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as In, directoryExists as It, RulesyncRule as J, stripHiddenCharacters as Jn, pathEscapesRoot as Jt, RulesyncSkill as K, stripControlCharacters as Kn, listFilePathsRecursively as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, parseCommaSeparatedList as Ln, ensureDir as Lt, CODEXCLI_DIR as M, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Mn, assertTreeContainsNoSymlinks as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Nn, assertWritablePathInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Pn, checkPathTraversal as Pt, RulesyncIgnore as Q, removeDirectoryStrict as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, ALL_FEATURES as Rn, fileExists as Rt, COMMANDCODE_DIR as S, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_MCP_RELATIVE_FILE_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, hasDeceptiveHiddenCharacters as Un, isFileSystemError as Ut, AUGMENTCODE_DIR as V, formatError as Vn, getHomeDirectory as Vt, RulesyncSubagent as W, hasEnclosingMarkOutsideKeycap as Wn, isSymlink as Wt, RulesyncPermissions as X, readFileContentOrNull as Xt, RulesyncRuleFrontmatterSchema as Y, readFileContent as Yt, RulesyncMcp as Z, removeDirectory as Zt, LETTACODE_DIR as _, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, toPosixPath as an, RulesyncCheck as at, CommandsProcessor as b, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, ALL_TOOL_TARGETS as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, ToolTargetSchema as dn, ConfigResolver as dt, removeFileStrict as en, getRulesyncSourceCandidates as et, displayWidthOf as f, CURATED_RULES_FEATURE_SUBDIR as fn, mergeInputRootConfigs as ft, HooksProcessor as g, RULESYNC_CHECKS_RELATIVE_DIR_PATH as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as hn, ConfigFileSchema as ht, inspectInputRoots as i, splitPathSegments as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_RULES_RELATIVE_DIR_PATH as jn, assertDirectoryIfExists as jt, caseFoldIdentity as k, RULESYNC_PERMISSIONS_SCHEMA_URL as kn, ErrorCodes as kt, SubagentsProcessor as l, ALL_TOOL_TARGETS_WITH_WILDCARD as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, MAX_FILE_SIZE as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, resolvePath as nn, parseJsonc as nt, convertFromTool as o, writeFileBuffer as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, FEATURE_SOURCE_TREE_ENTRIES as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, stripControlCharactersKeepingLineFeeds as qn, listSubdirectoryNames as qt, generate as r, runWithDirectoryRollback as rn, RulesyncCommand as rt, isPackagingToolTarget as s, writeFileContent as sn, stringifyFrontmatter as st, importFromTool as t, removeTempDirectory as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, PACKAGING_TOOL_TARGETS as un, SKILL_FILE_NAME as ut, LETTACODE_SETTINGS_LOCAL_FILE_NAME as v, RULESYNC_CONFIG_RELATIVE_FILE_PATH as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as wn, warnOnConflictingFlags as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as xn, JsonLogger as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_CONFIG_SCHEMA_URL as yn, findControlCharacter as yt, QWENCODE_DIR as z, ALL_FEATURES_WITH_WILDCARD as zn, findFilesByGlobs as zt };
 
-//# sourceMappingURL=import-ORYbMDJK.js.map
+//# sourceMappingURL=import-5-Uennl1.js.map