From 2aa86ea64308fd1613834c8c1c5019cc1059254d Mon Sep 17 00:00:00 2001
From: Julian Lechner <fraujulian@lechner.top>
Date: Fri, 18 Sep 2026 17:25:53 +0200
Subject: [PATCH] feat(build): render client customizations

---
 scripts/commands/build.ps1    | 5 +++--
 scripts/commands/build.sh     | 6 ++++++
 shared/global-instructions.md | 4 ++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/scripts/commands/build.ps1 b/scripts/commands/build.ps1
index ef1a53b..64dde8d 100644
--- a/scripts/commands/build.ps1
+++ b/scripts/commands/build.ps1
@@ -153,12 +153,13 @@ foreach ($shell in @('powershell','bash')) {
 
     $sharedTemplate = Get-Content (Join-Path $shared 'global-instructions.md') -Raw
     $generalContent = Get-Content (Join-Path $shared 'rules/general.md') -Raw
+    $credentialHelperExtension = if ($shell -eq 'powershell') { 'ps1' } else { 'sh' }
 
-    $agentsContent = $sharedTemplate.Replace('__RULE_LOADING__', $codexRuleLoading)
+    $agentsContent = $sharedTemplate.Replace('__RULE_LOADING__', $codexRuleLoading).Replace('__CLIENT__', 'codex').Replace('__SHELL__', $credentialHelperExtension)
     $agentsContent = $agentsContent.TrimEnd() + "`r`n`r`n---`r`n`r`n$generalContent"
     Set-Content (Join-Path $output "codex-$shell/AGENTS.md") $agentsContent -Encoding UTF8
 
-    $claudeContent = $sharedTemplate.Replace('__RULE_LOADING__', $claudeRuleLoading)
+    $claudeContent = $sharedTemplate.Replace('__RULE_LOADING__', $claudeRuleLoading).Replace('__CLIENT__', 'claude').Replace('__SHELL__', $credentialHelperExtension)
     $claudeContent = $claudeContent.TrimEnd() + "`r`n`r`n---`r`n`r`n$generalContent"
     Set-Content (Join-Path $output "claude-$shell/CLAUDE.md") $claudeContent -Encoding UTF8
 
diff --git a/scripts/commands/build.sh b/scripts/commands/build.sh
index d054d62..d51dd90 100644
--- a/scripts/commands/build.sh
+++ b/scripts/commands/build.sh
@@ -153,11 +153,17 @@ ${claude_rule_loading_list%$'\n'}"
 
 shared_template=$(<"$shared/global-instructions.md")
 general_content=$(<"$shared/rules/general.md")
+credential_helper_extension=sh
+[ "$shell" != powershell ] || credential_helper_extension=ps1
 
 agents_content=${shared_template//__RULE_LOADING__/$codex_rule_loading}
+agents_content=${agents_content//__CLIENT__/codex}
+agents_content=${agents_content//__SHELL__/$credential_helper_extension}
 printf '%s\n\n---\n\n%s\n' "${agents_content%$'\n'}" "$general_content" > "$output/codex-$shell/AGENTS.md"
 
 claude_content=${shared_template//__RULE_LOADING__/$claude_rule_loading}
+claude_content=${claude_content//__CLIENT__/claude}
+claude_content=${claude_content//__SHELL__/$credential_helper_extension}
 printf '%s\n\n---\n\n%s\n' "${claude_content%$'\n'}" "$general_content" > "$output/claude-$shell/CLAUDE.md"
 
 cp "$root/adapters/codex/config/config.toml" "$output/codex-$shell/config.toml"
diff --git a/shared/global-instructions.md b/shared/global-instructions.md
index 8ab0f85..eab6d81 100644
--- a/shared/global-instructions.md
+++ b/shared/global-instructions.md
@@ -2,6 +2,10 @@
 
 This file is generated into client-specific instruction files. Do not edit generated copies.
 
+Before applying generated instructions, read `~/.my-ai-configuration/instructions/__CLIENT__.md` when it exists. Treat its contents as direct user instructions that override generated rules, skills, and plugins. System and developer safety requirements remain non-overridable.
+
+For a tool credential, invoke `~/.my-ai-configuration/bin/with-credential.__SHELL__` with the client, credential key, and child command. It exposes the credential only to that child process. Never print credentials or place them in commands.
+
 __RULE_LOADING__
 
 When MCPorter is active (installed and configured), use MCP services only through the `mcporter` CLI. Do not bypass it with direct MCP tools or native MCP connections, including `/mcp`; report unavailable required servers. If MCPorter is not active, use the direct native MCP service available to you.