rulesync 31.0.0 → 33.0.0

package/dist/{import-CBvXTNp8.cjs → import-D_SV_C0k.cjs}

@@ -453,36 +453,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$416 } = node_path.posix;
+const { join: join$417 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$416(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$417(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$416(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$416(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$417(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$417(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$416(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$417(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -4845,13 +4845,11 @@ const PI_HOOK_EVENTS = [
 /**
 * Hook events supported by oh-my-pi (`omp`), Pi's fork, through the same
 * generated TypeScript extension. oh-my-pi keeps Pi's names for every event
-* listed here, but it has neither `agent_before_settle` nor `ui_prompt_start`,
-* so `stop` and `notification` are not mapped yet. oh-my-pi's stop surface is
-* `session_stop`, which takes a Claude-compatible `{ decision: "block", reason }`
-* result; it needs its own handler in the generator and is left for a
-* follow-up. See CANONICAL_TO_OMP_EVENT_NAMES.
+* listed here except `stop`: it has no `agent_before_settle`, so `stop` maps to
+* its own `session_stop` event instead. It has no `ui_prompt_start` either, so
+* `notification` is not mapped. See CANONICAL_TO_OMP_EVENT_NAMES.
 *
-* @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
 */
 const OMP_HOOK_EVENTS = [
 	"sessionStart",
@@ -4862,6 +4860,7 @@ const OMP_HOOK_EVENTS = [
 	"preModelInvocation",
 	"postModelInvocation",
 	"beforeSubmitPrompt",
+	"stop",
 	"preCompact",
 	"postCompact"
 ];
@@ -6283,9 +6282,10 @@ const CANONICAL_TO_PI_EVENT_NAMES = {
 /**
 * Map canonical camelCase event names to oh-my-pi extension event names. They
 * are Pi's names (see CANONICAL_TO_PI_EVENT_NAMES) for the events oh-my-pi
-* kept. Note that oh-my-pi runs `session_shutdown` handlers with a 2-second
-* budget, and fails a `tool_call` closed when its handler exceeds
-* `extensionHandlers.toolCallTimeoutMs` (30 seconds by default).
+* kept, plus `session_stop` for `stop`. Note that oh-my-pi runs
+* `session_shutdown` handlers with a 2-second budget, and fails a `tool_call`
+* closed when its handler exceeds `extensionHandlers.toolCallTimeoutMs`
+* (30 seconds by default).
 *
 * @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
 */
@@ -6298,6 +6298,7 @@ const CANONICAL_TO_OMP_EVENT_NAMES = {
 	preModelInvocation: "context",
 	postModelInvocation: "message_end",
 	beforeSubmitPrompt: "input",
+	stop: "session_stop",
 	preCompact: "session_before_compact",
 	postCompact: "session_compact"
 };
@@ -12955,10 +12956,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 	[CODEWHALE_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
 		invalidRootPolicy: "error",
-		features: { hooks: {
-			kind: "replace-owned-keys",
-			ownedKeys: ["hooks"]
-		} }
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["allow_shell"]
+			}
+		}
 	},
 	".letta/settings.json": {
 		format: "json",
@@ -21759,22 +21766,29 @@ function mergeOpencodeV2Entries({ config, legacyKey, pluralKey, lower }) {
 		const entry = asOpencodeEntries(value);
 		const lowered = entry === null ? null : lower(entry);
 		if (Object.hasOwn(merged, name) || lowered === null) continue;
-		Object.defineProperty(merged, name, {
-			value: lowered,
-			enumerable: true,
-			configurable: true,
-			writable: true
-		});
+		setOwnEntry(merged, name, lowered);
 	}
 	return Object.keys(merged).length > 0 ? merged : legacy;
 }
 /**
+* Sets `target[key]` as an own, enumerable property. A plain assignment to a
+* key named `__proto__` would set the prototype instead.
+*/
+function setOwnEntry(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		configurable: true,
+		writable: true
+	});
+}
+/**
 * Returns the inline agent entries of an OpenCode config in the V1 `agent`
 * shape. Since v1.18.24 OpenCode V1 also reads the V2 `agents` spelling and
 * lowers it, so a layout that does so (`readsV2ConfigSpellings`) gets those
 * entries too.
 *
-* @see https://github.com/anomalyco/opencode/blob/v1.18.34/packages/opencode/src/config/v2-compat.ts
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
 */
 function getOpencodeAgentEntries({ config, layout = OPENCODE_LAYOUT }) {
 	if (!layout.readsV2ConfigSpellings) return asOpencodeEntries(config.agent);
@@ -21793,7 +21807,7 @@ function getOpencodeAgentEntries({ config, layout = OPENCODE_LAYOUT }) {
 * Other fields are kept: V1 drops a V2 `subagent`, but rulesync reads it as
 * `subtask` everywhere (as V2 does), so it is left for the command importer.
 *
-* @see https://github.com/anomalyco/opencode/blob/v1.18.34/packages/opencode/src/config/v2-compat.ts
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
 */
 function getOpencodeCommandEntries({ config, layout = OPENCODE_LAYOUT }) {
 	if (!layout.readsV2ConfigSpellings) return asOpencodeEntries(config.command);
@@ -21816,7 +21830,7 @@ function getOpencodeCommandEntries({ config, layout = OPENCODE_LAYOUT }) {
 * reads V2 spellings, a flat V2 `skills` array is accepted too: its entries
 * that are not `http(s)://` URLs are the paths, as OpenCode V1 lowers them.
 *
-* @see https://github.com/anomalyco/opencode/blob/v1.18.34/packages/opencode/src/config/v2-compat.ts
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
 */
 function getOpencodeSkillPaths({ config, layout = OPENCODE_LAYOUT }) {
 	if (Array.isArray(config.skills)) {
@@ -21826,6 +21840,160 @@ function getOpencodeSkillPaths({ config, layout = OPENCODE_LAYOUT }) {
 	const skills = asOpencodeEntries(config.skills);
 	return skills !== null && Array.isArray(skills.paths) ? skills.paths : [];
 }
+/**
+* Whether a record is itself an MCP server entry rather than a V2 container
+* (`mcp.servers`, `mcp.timeout`): a server — or a server literally named
+* `type` / `enabled` — carries a scalar `type` or `enabled`. Mirrors OpenCode
+* V1's `isDirectServer`.
+*/
+function isDirectOpencodeMcpServer(value) {
+	return ["type", "enabled"].some((key) => Object.hasOwn(value, key) && (value[key] === null || typeof value[key] !== "object" || Array.isArray(value[key])));
+}
+const OPENCODE_V2_TIMEOUT_KEYS = [
+	"startup",
+	"catalog",
+	"execution"
+];
+/**
+* Whether an MCP server entry uses a V2-only per-server spelling, so that
+* OpenCode V1 lowers it: `disabled`, `codemode`, an object `timeout`, or a
+* snake_case `oauth` key.
+*/
+function isOpencodeV2NativeServer(value) {
+	const oauth = value.oauth;
+	return Object.hasOwn(value, "disabled") || Object.hasOwn(value, "codemode") || isRecord$1(value.timeout) || isRecord$1(oauth) && [
+		"client_id",
+		"client_secret",
+		"callback_port",
+		"redirect_uri"
+	].some((key) => Object.hasOwn(oauth, key));
+}
+/**
+* Lowers a V2 timeout object (`{ startup, catalog, execution }`) to V1's single
+* number, the way OpenCode V1 does: only a `catalog` equal to `execution`, with
+* no `startup`, has a V1 equivalent. Anything else — including a value that is
+* not a positive integer — is `undefined` (dropped).
+*/
+function lowerOpencodeV2Timeout(value) {
+	if (!hasPositiveIntegerTimeouts(value) || value.startup !== void 0 || typeof value.catalog !== "number") return;
+	return value.catalog === value.execution ? value.catalog : void 0;
+}
+const OPENCODE_V2_OAUTH_KEYS = /* @__PURE__ */ new Map([
+	["client_id", "clientId"],
+	["client_secret", "clientSecret"],
+	["callback_port", "callbackPort"],
+	["redirect_uri", "redirectUri"]
+]);
+/**
+* V2 `oauth` keys that have no V1 spelling. OpenCode V1 drops them when it
+* lowers a server, so they are dropped (and reported) here too rather than
+* being written back as a snake_case key among camelCase ones.
+*/
+const OPENCODE_V2_UNSUPPORTED_OAUTH_KEYS = /* @__PURE__ */ new Set(["auth_server_metadata_url"]);
+function lowerOpencodeV2OAuth(oauth, path, onDropped) {
+	const lowered = {};
+	for (const [key, value] of Object.entries(oauth)) {
+		if (OPENCODE_V2_UNSUPPORTED_OAUTH_KEYS.has(key)) {
+			onDropped?.(`${path}.${key}`, "unsupported");
+			continue;
+		}
+		setOwnEntry(lowered, OPENCODE_V2_OAUTH_KEYS.get(key) ?? key, value);
+	}
+	return lowered;
+}
+/**
+* Lowers one V2-spelled MCP server entry to V1's shape, as OpenCode V1 does:
+* `disabled` becomes `enabled` (an explicit `enabled` wins), an object
+* `timeout` becomes a number or is dropped, and snake_case `oauth` keys become
+* camelCase. `codemode` is kept: Rulesync passes it through where V1 drops it.
+*
+* Like V1, only an entry that is a local or remote server is lowered, and one
+* whose `enabled` or `disabled` is not a boolean is left as it is. Unlike V1,
+* such an entry is not dropped but passed on, so the schema rejects it loudly.
+*/
+function lowerOpencodeV2Server(value, path, onDropped) {
+	if (!isRecord$1(value) || value.type !== "local" && value.type !== "remote" || Object.hasOwn(value, "enabled") && typeof value.enabled !== "boolean" || Object.hasOwn(value, "disabled") && typeof value.disabled !== "boolean") return value;
+	const { disabled, timeout, ...rest } = value;
+	const lowered = { ...rest };
+	if (!Object.hasOwn(value, "enabled")) lowered.enabled = disabled !== true;
+	else if (value.enabled === disabled) onDropped?.(`${path}.disabled`, "conflict");
+	const lowTimeout = isRecord$1(timeout) ? lowerOpencodeV2Timeout(timeout) : timeout;
+	if (lowTimeout !== void 0) lowered.timeout = lowTimeout;
+	else if (isRecord$1(timeout) && Object.keys(timeout).length > 0) onDropped?.(`${path}.timeout`, "unsupported");
+	if (isRecord$1(value.oauth)) lowered.oauth = lowerOpencodeV2OAuth(value.oauth, `${path}.oauth`, onDropped);
+	return lowered;
+}
+function isPositiveInteger(value) {
+	return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+/** Whether each V2 timeout value a record carries is a positive integer. */
+function hasPositiveIntegerTimeouts(value) {
+	return OPENCODE_V2_TIMEOUT_KEYS.every((key) => value[key] === void 0 || isPositiveInteger(value[key]));
+}
+/**
+* Whether `mcp.timeout` is V2's global timeout object rather than a server
+* named `timeout`. As in OpenCode V1, each of its values must be a positive
+* integer; anything else is read as a server, which the schema then rejects.
+*/
+function isOpencodeV2GlobalTimeout(value) {
+	return isRecord$1(value) && !isDirectOpencodeMcpServer(value) && (Object.keys(value).length === 0 || OPENCODE_V2_TIMEOUT_KEYS.some((key) => Object.hasOwn(value, key))) && hasPositiveIntegerTimeouts(value);
+}
+function getOpencodeV2McpEnvelope(mcp) {
+	const nested = mcp.servers;
+	return isRecord$1(nested) && !isDirectOpencodeMcpServer(nested) ? nested : null;
+}
+/**
+* Returns the paths of the V2-only containers in an OpenCode `mcp` value that
+* a write in V1's flat shape does not keep: a non-empty `mcp.servers`
+* envelope, and a non-empty global `mcp.timeout`.
+*/
+function findOpencodeV2McpContainers(mcp) {
+	if (!isRecord$1(mcp)) return [];
+	const envelope = getOpencodeV2McpEnvelope(mcp);
+	return [...envelope !== null && Object.keys(envelope).length > 0 ? ["mcp.servers"] : [], ...isOpencodeV2GlobalTimeout(mcp.timeout) && Object.keys(mcp.timeout).length > 0 ? ["mcp.timeout"] : []];
+}
+/**
+* Lowers OpenCode V2 `mcp` spellings found in a V1 config to the flat V1 map,
+* the way OpenCode V1 itself does since v1.18.24 (`normalizeMcp`):
+*
+* - entries of the `mcp.servers` envelope are merged into the map, a flat entry
+*   of the same name winning;
+* - V2-spelled server entries (`disabled`, an object `timeout`, snake_case
+*   `oauth` keys) are lowered by {@link lowerOpencodeV2Server};
+* - the global `mcp.timeout` object is skipped. V1 moves it to
+*   `experimental.mcp_timeout`, a default request timeout that has no
+*   canonical counterpart, so it is not read as a server either.
+*
+* Unlike V1, an envelope entry that is not a valid server is not dropped: it
+* is passed on, so the schema rejects it loudly rather than it vanishing
+* without a word. Each value that is dropped — a non-empty global timeout, a
+* per-server timeout object or `oauth` key with no V1 equivalent, or an
+* envelope entry shadowed by a different flat entry — is reported through
+* `onDropped`.
+*
+* @see https://github.com/anomalyco/opencode/blob/v1.18.35/packages/opencode/src/config/v2-compat.ts
+* @see https://opencode.ai/v2/docs/mcp-servers/
+*/
+function lowerOpencodeV2Mcp(mcp, onDropped) {
+	if (!isRecord$1(mcp)) return mcp;
+	const envelope = getOpencodeV2McpEnvelope(mcp);
+	const globalTimeout = isOpencodeV2GlobalTimeout(mcp.timeout);
+	if (findOpencodeV2McpContainers(mcp).includes("mcp.timeout")) onDropped?.("mcp.timeout", "unsupported");
+	const servers = {};
+	for (const [name, value] of Object.entries(mcp)) {
+		if (name === "servers" && envelope !== null || name === "timeout" && globalTimeout) continue;
+		setOwnEntry(servers, name, isRecord$1(value) && isOpencodeV2NativeServer(value) ? lowerOpencodeV2Server(value, `mcp.${name}`, onDropped) : value);
+	}
+	for (const [name, value] of Object.entries(envelope ?? {})) {
+		const path = `mcp.servers.${name}`;
+		if (Object.hasOwn(servers, name)) {
+			if (!(0, node_util.isDeepStrictEqual)(servers[name], value)) onDropped?.(path, "conflict");
+			continue;
+		}
+		setOwnEntry(servers, name, lowerOpencodeV2Server(value, path, onDropped));
+	}
+	return servers;
+}
 /** Matches a string whose entire value is an OpenCode `{file:...}` reference. */
 const OPENCODE_FILE_TEMPLATE_PATTERN = /^\s*\{file:(.+?)\}\s*$/;
 /**
@@ -32857,6 +33025,31 @@ const PI_PROMPT_BLOCKING_EVENT = "input";
 * @see https://github.com/earendil-works/pi/blob/v0.87.1/packages/coding-agent/src/core/extensions/types.ts
 */
 const PI_SETTLE_BLOCKING_EVENT = "agent_before_settle";
+/**
+* `session_stop` is oh-my-pi's stop surface (it has no `agent_before_settle`).
+* It fires when a main-session run is about to settle (never for subagents,
+* nor for a run the user aborted), and a handler returning
+* `{ continue: true, additionalContext }` queues one more turn with that text
+* as hidden model-visible context. As on Pi, only a stop command exiting with
+* code 2 asks for that, the feedback of every such command is combined, and
+* any other failure is rethrown for oh-my-pi to report. The generated handler
+* continues only when `event.stop_hook_active` is false, which oh-my-pi sets
+* after a continuation and clears once a stop pass lets the run settle, so the
+* agent is continued at most once per stop (the flag is shared by every
+* extension, so another extension's continuation also suppresses ours);
+* oh-my-pi additionally caps these
+* advisory continuations at 8 in a row. A run that ended on a provider error
+* (`stopReason: "error"`) is not continued, matching Pi's `completed`-only
+* gate. The advisory form is used rather than `{ decision: "block", reason }`,
+* which oh-my-pi keeps enforcing without that cap. oh-my-pi gives
+* `session_stop` handlers the 30-second extension handler budget: stop
+* commands running longer time the handler out, the run settles without a
+* continuation, and the command is not killed.
+*
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/packages/coding-agent/src/session/agent-session.ts
+*/
+const OMP_SESSION_STOP_BLOCKING_EVENT = "session_stop";
 const PI_EXTENSION_DIALECT = {
 	overrideKey: "pi",
 	typesPackage: "@earendil-works/pi-coding-agent",
@@ -32878,7 +33071,8 @@ const OMP_EXTENSION_DIALECT = {
 const PI_BLOCKING_MODE_BY_EVENT = {
 	[PI_BLOCKING_EVENT]: "tool",
 	[PI_PROMPT_BLOCKING_EVENT]: "prompt",
-	[PI_SETTLE_BLOCKING_EVENT]: "settle"
+	[PI_SETTLE_BLOCKING_EVENT]: "settle",
+	[OMP_SESSION_STOP_BLOCKING_EVENT]: "sessionStop"
 };
 /**
 * The body emitted inside a blocking handler's `catch`, per gate. `tool_call`
@@ -32891,7 +33085,8 @@ function failureLinesByMode(dialect) {
 		none: [],
 		tool: ["return { block: true, reason: toBlockReason(error) };"],
 		prompt: ["reportPromptGateFailure(ctx, toBlockReason(error));", dialect.promptCancelLine],
-		settle: ["stopHookFailures.push(error);"]
+		settle: ["stopHookFailures.push(error);"],
+		sessionStop: ["stopHookFailures.push(error);"]
 	};
 }
 /**
@@ -32983,6 +33178,12 @@ const PROMPT_GATE_HELPER_LINES = [
 	"  console.error(reason);",
 	"}"
 ];
+/** Helper emitted alongside every stop gate (Pi's settle gate and oh-my-pi's `session_stop`). */
+const STOP_HOOK_BLOCK_HELPER_LINES = [
+	"function isStopHookBlock(error: unknown): boolean {",
+	"  return (error as { code?: unknown } | null)?.code === 2;",
+	"}"
+];
 /**
 * Helper emitted alongside the stop hook's settle gate. `event.entries` holds
 * the drafts earlier extensions proposed at this boundary, so they are kept and
@@ -32993,10 +33194,6 @@ const PROMPT_GATE_HELPER_LINES = [
 * appended message is committed, and Pi re-validates the final context itself.
 */
 const STOP_HOOK_HELPER_LINES = [
-	"function isStopHookBlock(error: unknown): boolean {",
-	"  return (error as { code?: unknown } | null)?.code === 2;",
-	"}",
-	"",
 	"function continueAfterStopHook(",
 	"  event: AgentBeforeSettleEvent,",
 	"  reason: string,",
@@ -33079,14 +33276,16 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 		const blocking = PI_BLOCKING_MODE_BY_EVENT[piEvent] ?? "none";
 		const isPromptGate = blocking === "prompt";
 		const isSettleGate = blocking === "settle";
+		const isSessionStopGate = blocking === "sessionStop";
+		const collectsStopFailures = isSettleGate || isSessionStopGate;
 		const usesToolName = PI_TOOL_EVENTS.has(piEvent) && handlers.some((h) => h.matcher);
 		const usesErrorFlag = handlers.some((h) => h.onlyOnError);
 		const gatesOnAssistant = PI_ASSISTANT_MESSAGE_EVENTS.has(piEvent);
-		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || isSettleGate ? "event" : "";
+		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || collectsStopFailures ? "event" : "";
 		lines.push(`  pi.on(${JSON.stringify(piEvent)}, async (${params}) => {`);
 		if (gatesOnAssistant) lines.push(`    if (event.message.role !== "assistant") return;`);
 		if (isPromptGate) lines.push(`    if (event.source === "extension") ${dialect.promptPassLine}`);
-		if (isSettleGate) lines.push("    const stopHookFailures: unknown[] = [];");
+		if (collectsStopFailures) lines.push("    const stopHookFailures: unknown[] = [];");
 		for (const handler of handlers) lines.push(...buildCommandLines({
 			handler,
 			usesToolName,
@@ -33102,6 +33301,17 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 			lines.push("    }");
 			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
 		}
+		if (isSessionStopGate) {
+			lines.push("    const blocks = stopHookFailures.filter(isStopHookBlock);");
+			lines.push("    const endedOnError = (event.last_assistant_message as { stopReason?: unknown } | undefined)?.stopReason === \"error\";");
+			lines.push("    if (blocks.length > 0 && !event.stop_hook_active && !endedOnError) {");
+			lines.push("      return {");
+			lines.push("        continue: true,");
+			lines.push("        additionalContext: `Stop hook feedback:\\n${blocks.map(toBlockReason).join(\"\\n\\n\")}`,");
+			lines.push("      };");
+			lines.push("    }");
+			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
+		}
 		lines.push("  });");
 		if (isSettleGate) {
 			lines.push(`  pi.on("agent_settled", async () => {`);
@@ -33120,8 +33330,9 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 * `{ block: true, reason }`, and on `input` — Pi's prompt-submission gate —
 * where a non-zero exit cancels the prompt with the dialect's cancel result
 * (`{ action: "handled" }` for Pi, `{ handled: true }` for oh-my-pi), and
-* on `agent_before_settle`, where a stop command exiting with code 2 asks the
-* agent to continue once with the command's output as feedback.
+* on `agent_before_settle` (Pi) / `session_stop` (oh-my-pi), where a stop
+* command exiting with code 2 asks the agent to continue once with the
+* command's output as feedback.
 * `postToolUse` and `postToolUseFailure` share Pi's `tool_result` event; the
 * latter's commands run only when `event.isError` is set.
 *
@@ -33142,7 +33353,8 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 	const subscriptionLines = buildSubscriptionLines(handlerGroups, dialect);
 	const hasPromptGate = Boolean(handlerGroups[PI_PROMPT_BLOCKING_EVENT]);
 	const hasSettleGate = Boolean(handlerGroups[PI_SETTLE_BLOCKING_EVENT]);
-	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate;
+	const hasSessionStopGate = Boolean(handlerGroups[OMP_SESSION_STOP_BLOCKING_EVENT]);
+	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate || hasSessionStopGate;
 	const lines = ["// Generated by rulesync. Do not edit manually."];
 	if (subscriptionLines.length === 0) {
 		lines.push("export default function () {}");
@@ -33169,6 +33381,10 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 		lines.push(...PROMPT_GATE_HELPER_LINES);
 		lines.push("");
 	}
+	if (hasSettleGate || hasSessionStopGate) {
+		lines.push(...STOP_HOOK_BLOCK_HELPER_LINES);
+		lines.push("");
+	}
 	if (hasSettleGate) {
 		lines.push(...STOP_HOOK_HELPER_LINES);
 		lines.push("");
@@ -45526,18 +45742,21 @@ var KiroMcp = class KiroMcp extends ToolMcp {
 };
 //#endregion
 //#region src/features/mcp/opencode-mcp.ts
+const OpencodeMcpV2DisabledSchema = zod_mini.z.optional(zod_mini.z.boolean());
 const OpencodeMcpLocalServerSchema = zod_mini.z.looseObject({
 	type: zod_mini.z.literal("local"),
 	command: zod_mini.z.array(zod_mini.z.string()),
 	environment: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
 	enabled: zod_mini.z._default(zod_mini.z.boolean(), true),
+	disabled: OpencodeMcpV2DisabledSchema,
 	cwd: zod_mini.z.optional(zod_mini.z.string())
 });
 const OpencodeMcpRemoteServerSchema = zod_mini.z.looseObject({
 	type: zod_mini.z.literal("remote"),
 	url: zod_mini.z.string(),
 	headers: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
-	enabled: zod_mini.z._default(zod_mini.z.boolean(), true)
+	enabled: zod_mini.z._default(zod_mini.z.boolean(), true),
+	disabled: OpencodeMcpV2DisabledSchema
 });
 const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
 	"timeout",
@@ -45549,7 +45768,7 @@ const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
 	...Object.keys(OpencodeMcpRemoteServerSchema.def.shape),
 	...OPENCODE_PASSTHROUGH_SERVER_FIELDS
-].filter((key) => key !== "enabled");
+].filter((key) => key !== "enabled" && key !== "disabled");
 /**
 * A bare toggle entry: `{"enabled": <bool>}` with no transport of its own,
 * disabling a server another config layer defines. It is the third member of
@@ -45677,7 +45896,7 @@ const OPENCODE_TOGGLE_KEPT_KEYS = /* @__PURE__ */ new Set([
 function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 	const dropped = Object.keys(serverConfig).filter((key) => !OPENCODE_TOGGLE_KEPT_KEYS.has(key));
 	if (dropped.length === 0) return;
-	logger?.warn(`OpenCode MCP: "${serverName}" declares no transport, so it is written as a toggle entry and ${dropped.toSorted().join(", ")} ${dropped.length === 1 ? "is" : "are"} dropped.`);
+	logger?.warn(`OpenCode MCP: ${quoteValueForWarning(serverName)} declares no transport, so it is written as a toggle entry and ${dropped.toSorted().map(quoteValueForWarning).join(", ")} ${dropped.length === 1 ? "is" : "are"} dropped.`);
 }
 /**
 * Convert standard MCP format to OpenCode native format
@@ -45757,9 +45976,35 @@ var OpencodeMcp = class extends ToolMcp {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
 	static layout = OPENCODE_LAYOUT;
 	json;
-	constructor(params) {
+	/**
+	* With a `logger`, the V2 values that lowering the content drops are warned
+	* about (see {@link OpencodeMcp.lowerConfig}); `fromFile` passes one so the
+	* warnings come from the lowering that builds the parsed view rather than
+	* from an extra pass of their own. (`validate()`, which the parent
+	* constructor calls before this view exists, lowers separately and silently.)
+	*/
+	constructor({ logger, ...params }) {
 		super(params);
-		this.json = OpencodeConfigSchema.parse((0, jsonc_parser.parse)(this.fileContent || "{}"));
+		this.json = OpencodeConfigSchema.parse(this.constructor.lowerConfig((0, jsonc_parser.parse)(this.fileContent || "{}"), logger));
+	}
+	/**
+	* Lowers the OpenCode V2 `mcp` spellings of a parsed config for a layout
+	* that reads them (see {@link lowerOpencodeV2Mcp}), so every reader — import,
+	* the toggle lookup on generate, and the rules feature's `instructions`
+	* write to the same file — accepts a V2-shaped `mcp`. Only the parsed view
+	* is lowered; content written back keeps whatever `mcp` a feature that does
+	* not own the key found there. With a `logger`, each V2 value the lowering
+	* drops is warned about.
+	*/
+	static lowerConfig(json, logger) {
+		if (!this.layout.readsV2ConfigSpellings || !isRecord$1(json) || json.mcp === void 0) return json;
+		return {
+			...json,
+			mcp: lowerOpencodeV2Mcp(json.mcp, (path, reason) => {
+				const quoted = quoteValueForWarning(path);
+				logger?.warn(reason === "conflict" ? `OpenCode MCP: ${quoted} conflicts with a V1 value that takes precedence (the flat "mcp" entry of the same name, or "enabled"), so it is dropped on import.` : `OpenCode MCP: ${quoted} has no Rulesync equivalent, so it is dropped on import.`);
+			})
+		};
 	}
 	getJson() {
 		return this.json;
@@ -45776,7 +46021,7 @@ var OpencodeMcp = class extends ToolMcp {
 			relativeFilePath: this.layout.jsonFileName
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
 		const basePaths = this.getSettablePaths({ global });
 		const jsonDir = (0, node_path.join)(outputRoot, basePaths.relativeDirPath);
 		let fileContent = null;
@@ -45798,7 +46043,8 @@ var OpencodeMcp = class extends ToolMcp {
 			relativeDirPath: basePaths.relativeDirPath,
 			relativeFilePath,
 			fileContent: JSON.stringify(newJson, null, 2),
-			validate
+			validate,
+			logger
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
@@ -45817,7 +46063,12 @@ var OpencodeMcp = class extends ToolMcp {
 			mcpServers: rulesyncMcp.getMcpServers(),
 			replacement: "{env:$1}"
 		});
-		const existingMcp = OpencodeConfigSchema.safeParse((0, jsonc_parser.parse)(fileContent || "{}"));
+		const existingJson = (0, jsonc_parser.parse)(fileContent || "{}");
+		const existingMcp = OpencodeConfigSchema.safeParse(this.lowerConfig(existingJson));
+		if (this.layout.readsV2ConfigSpellings && isRecord$1(existingJson)) {
+			const containers = findOpencodeV2McpContainers(existingJson.mcp);
+			if (containers.length > 0) logger?.warn(`OpenCode MCP: the whole "mcp" key is rewritten in the flat V1 shape, so ${containers.map(quoteValueForWarning).join(" and ")} ${containers.length === 1 ? "is" : "are"} not kept.`);
+		}
 		const { mcp: convertedMcp, tools: mcpTools } = convertToOpencodeFormat(transformedServers, (existingMcp.success ? existingMcp.data.mcp : void 0) ?? {}, logger);
 		return new this({
 			outputRoot,
@@ -45917,7 +46168,7 @@ var OpencodeMcp = class extends ToolMcp {
 	}
 	validate() {
 		const json = parseJsonc$6(this.fileContent || "{}");
-		const result = OpencodeConfigSchema.safeParse(json);
+		const result = OpencodeConfigSchema.safeParse(this.constructor.lowerConfig(json));
 		if (!result.success) return {
 			success: false,
 			error: result.error
@@ -55965,6 +56216,124 @@ function parseCodebuddySettings({ fileContent, relativePath }) {
 	}
 }
 //#endregion
+//#region src/features/permissions/codewhale-project-config.ts
+/**
+* The top-level key of the per-project `.codewhale/config.toml` overlay that
+* hides Codewhale's shell tools. The overlay only tightens: `false` disables
+* shell for the session, while `true` is ignored with a warning.
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/docs/CONFIGURATION.md#per-project-overlay-485
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/crates/tui/src/lib.rs
+*/
+const CODEWHALE_ALLOW_SHELL_KEY = "allow_shell";
+const CODEWHALE_PROJECT_CONFIG_PATHS = {
+	relativeDirPath: CODEWHALE_DIR,
+	relativeFilePath: CODEWHALE_CONFIG_FILE_NAME
+};
+/** The project `.codewhale/config.toml` overlay, as written by the permissions feature. */
+var CodewhaleProjectConfigFile = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+/**
+* Whether the canonical config denies every shell command: a `deny` on the
+* catch-all `*` (or `**`) pattern of `bash` or of the all-tools `*` category.
+* Codewhale decides by action before specificity, so such a deny already
+* blocks every command in global scope too, whatever `allow` rules sit beside
+* it.
+*/
+function deniesEveryShellCommand(permission) {
+	return collectShellCommandRules(permission).rules.some(({ pattern, action }) => action === "deny" && isShellCatchAll(pattern));
+}
+/** Whether a canonical shell pattern names every command. */
+function isShellCatchAll(pattern) {
+	const trimmed = pattern.trim();
+	return trimmed === "*" || trimmed === "**";
+}
+function projectConfigFilePath(outputRoot) {
+	return (0, node_path.join)(outputRoot, CODEWHALE_PROJECT_CONFIG_PATHS.relativeDirPath, CODEWHALE_PROJECT_CONFIG_PATHS.relativeFilePath);
+}
+function parseProjectConfig({ fileContent, filePath }) {
+	return parseSharedConfig({
+		format: "toml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Whether an overlay disables shell (`allow_shell = false`). A file that
+* cannot be read as TOML is reported and treated as not disabling shell.
+*/
+function disablesShell({ fileContent, filePath, logger }) {
+	try {
+		return parseProjectConfig({
+			fileContent,
+			filePath
+		})[CODEWHALE_ALLOW_SHELL_KEY] === false;
+	} catch (error) {
+		logger?.warn(`Codewhale permissions: not reading "allow_shell" from ${filePath}, so a shell deny set there is not taken into account: ${formatError(error)}`);
+		return false;
+	}
+}
+/**
+* Whether the project overlay at `outputRoot` disables shell
+* (`allow_shell = false`), for import.
+*/
+async function readCodewhaleProjectShellDisabled({ outputRoot, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (fileContent === null) return false;
+	return disablesShell({
+		fileContent,
+		filePath,
+		logger
+	});
+}
+/**
+* The project `.codewhale/config.toml` overlay carrying `allow_shell = false`
+* when the canonical config denies every shell command, or `null` when the
+* file needs no change.
+*
+* Only `allow_shell` is written; every other overlay key (`model`,
+* `approval_policy`, ...) is kept, and an existing file that is not valid TOML
+* is an error only when it has to be written. An existing
+* `allow_shell = false` is never removed: the overlay cannot widen access, and
+* a hand-written value cannot be told apart from one rulesync wrote, so it is
+* reported instead.
+*/
+async function createCodewhaleProjectConfigFile({ outputRoot = process.cwd(), config, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const existingContent = await readFileContentOrNull(filePath);
+	if (!deniesEveryShellCommand(config.permission)) {
+		if (existingContent !== null && disablesShell({
+			fileContent: existingContent,
+			filePath,
+			logger
+		})) logger?.warn(`Codewhale permissions: keeping "allow_shell = false" in ${filePath}; rulesync does not remove it. Delete it by hand to re-enable shell tools in this project, or add bash: { "*": "deny" } to the rulesync permissions to match it.`);
+		return null;
+	}
+	if (parseProjectConfig({
+		fileContent: existingContent ?? "",
+		filePath
+	})[CODEWHALE_ALLOW_SHELL_KEY] === false) return null;
+	return new CodewhaleProjectConfigFile({
+		outputRoot,
+		...CODEWHALE_PROJECT_CONFIG_PATHS,
+		fileContent: applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(CODEWHALE_PROJECT_CONFIG_PATHS),
+			feature: "permissions",
+			existingContent: existingContent ?? "",
+			patch: { [CODEWHALE_ALLOW_SHELL_KEY]: false },
+			filePath,
+			logger
+		})
+	});
+}
+//#endregion
 //#region src/features/permissions/codewhale-repo-law.ts
 /**
 * Project-scope Codewhale permissions: the enforced `protected_invariants` of
@@ -56115,7 +56484,8 @@ function collectRestrictions({ config, logger }) {
 	let skippedAllowCount = 0;
 	for (const [category, rules] of Object.entries(config.permission)) {
 		if (!REPO_LAW_CATEGORIES.includes(category)) {
-			if (Object.keys(rules).length > 0) skippedCategories.push(category);
+			const entries = Object.entries(rules);
+			if ((category === "bash" && entries.some(([pattern, action]) => action === "deny" && isShellCatchAll(pattern)) ? entries.filter(([, action]) => action === "allow") : entries).length > 0) skippedCategories.push(category);
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -56841,17 +57211,32 @@ async function warnOnShadowedConstitution({ outputRoot, logger }) {
 * Project scope manages the enforced `protected_invariants` of the repo
 * constitution `.codewhale/constitution.json` (see `codewhale-repo-law.ts`):
 * the project `.codewhale/config.toml` overlay cannot carry rules, but repo
-* law can hold writes to protected paths.
+* law can hold writes to protected paths. A deny on every shell command also
+* sets `allow_shell = false` in that overlay (see
+* `codewhale-project-config.ts`), which import reads back here.
 *
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/CONFIGURATION.md
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/AUTHORIZATION_ORDER.md
 */
 var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
-	constructor(params) {
+	/**
+	* Whether the project `.codewhale/config.toml` overlay disables shell
+	* (`allow_shell = false`); read on import in project scope only.
+	*/
+	projectShellDisabled;
+	constructor({ projectShellDisabled = false, ...params }) {
 		super({
 			...params,
 			fileContent: params.fileContent ?? ""
 		});
+		this.projectShellDisabled = projectShellDisabled;
+	}
+	/**
+	* The project `.codewhale/config.toml` overlay, where a deny on every shell
+	* command becomes `allow_shell = false` beside the user's other overlay keys.
+	*/
+	static getExtraSharedWritePaths(options) {
+		return options?.global ? [] : [{ ...CODEWHALE_PROJECT_CONFIG_PATHS }];
 	}
 	/**
 	* Codewhale's approval card writes to the global file, and the constitution
@@ -56888,7 +57273,11 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			projectShellDisabled: global ? false : await readCodewhaleProjectShellDisabled({
+				outputRoot,
+				logger
+			})
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
@@ -56950,11 +57339,15 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 	toRulesyncPermissions() {
 		const filePath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
 		if (!this.global) {
-			const document = parseCodewhaleConstitution({
+			const permission = codewhaleConstitutionToCanonical(parseCodewhaleConstitution({
 				fileContent: this.getFileContent(),
 				filePath
-			});
-			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission: codewhaleConstitutionToCanonical(document) }, null, 2) });
+			}));
+			if (this.projectShellDisabled) permission.bash = {
+				...permission.bash,
+				"*": "deny"
+			};
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
 		}
 		const { permission, nativeRules } = codewhaleRulesToCanonical(partitionRuleRecords(parsePermissionsDocument({
 			fileContent: this.getFileContent(),
@@ -71883,6 +72276,14 @@ var PermissionsProcessor = class extends FeatureProcessor {
 			logger: this.logger,
 			global: this.global
 		});
+		if (this.toolTarget === "codewhale" && !this.global) {
+			const projectConfigFile = await createCodewhaleProjectConfigFile({
+				outputRoot: this.outputRoot,
+				config: effectivePermissions.getJson(),
+				logger: this.logger
+			});
+			return projectConfigFile ? [toolPermissions, projectConfigFile] : [toolPermissions];
+		}
 		if (this.toolTarget !== "codexcli") return [toolPermissions];
 		return [toolPermissions, createCodexcliBashRulesFile({
 			outputRoot: this.outputRoot,