test(config): cover legacy workspace shell opt-in

Refs #2523

crates/tui/src/main.rs

@@ -6905,6 +6905,20 @@ allow_shell = false
         assert_eq!(config.allow_shell, Some(true));
     }
 
+    #[test]
+    fn user_workspace_overlay_accepts_legacy_projects_table() {
+        let tmp = tempdir().expect("tempdir");
+        let workspace = tmp.path().join("project");
+        fs::create_dir_all(&workspace).expect("mkdir workspace");
+        let raw = format!("[projects.'{}']\nallow_shell = true\n", workspace.display());
+        let doc: toml::Value = toml::from_str(&raw).expect("parse config");
+
+        let mut config = Config::default();
+        merge_user_workspace_config_from_doc(&mut config, &doc, &workspace);
+
+        assert_eq!(config.allow_shell, Some(true));
+    }
+
     #[test]
     fn user_workspace_overlay_ignores_non_matching_workspace() {
         let tmp = tempdir().expect("tempdir");

docs/CONFIGURATION.md

@@ -34,6 +34,10 @@ The entry applies only when the launched workspace path matches the table key.
 The legacy `[projects."/absolute/path/to/project"]` table is also accepted for
 this user-owned override.
 
+In interactive mode, the per-project overlay
+`<workspace>/.codewhale/config.toml` is applied after this user entry. A
+project-level `allow_shell = false` still takes precedence.
+
 ### Per-project overlay (#485)
 
 When the TUI starts in a workspace that contains a