feat(permissions): support kilo, augmentcode, cline, qwencode by dyoshikawa · Pull Request #1338 · dyoshikawa/rulesync

dyoshikawa · 2026-03-17T07:49:57Z

Summary

Adds the permissions feature for four additional tool targets so .rulesync/permissions.json now generates and round-trips for:

Kilo Code (kilo) — kilo.jsonc with OpenCode-style permission object (project + global). Closes Support Kilo Code permissions #1417.
AugmentCode / Auggie CLI (augmentcode) — .augment/settings.json with toolPermissions[] (allow / deny / ask-user). bash maps to launch-process with a shellInputRegex derived from the rulesync glob (project + global). Closes Support AugmentCode permissions #1418.
Cline CLI (cline) — .cline/command-permissions.json matching the CLINE_COMMAND_PERMISSIONS env-var schema ({ allow, deny, allowRedirects }). Project only; bash-only with warnings for ask and non-bash categories. Closes Support Cline permissions #1420.
Qwen Code (qwencode) — .qwen/settings.json with Claude Code style permissions.allow/ask/deny arrays and Bash(...)/Read(...) aliases (project + global). Closes Support Qwen Code permissions #1422.

The new classes are wired into PermissionsProcessor with proper supportsProject / supportsGlobal / supportsImport flags, and the supported-tools matrix plus per-tool format docs (and the synced skills/rulesync mirror) are updated accordingly. New entries are also added to the generated .gitignore.

Refs #832.

Test plan

pnpm cicheck passes (formatting, oxlint, eslint, typecheck, 5436 tests, cspell, secretlint)
Per-tool unit tests for fromRulesyncPermissions / fromFile / toRulesyncPermissions / forDeletion round-trips
E2E happy-path coverage: 4 generate + 4 import + 3 global-mode tests in src/e2e/e2e-permissions.spec.ts
PermissionsProcessor.getToolTargets updated for project / global / importOnly modes

🤖 Generated with Claude Code

Implement unified permissions management that converts canonical .rulesync/permissions.json to tool-specific formats: - Claude Code: .claude/settings.json (PascalCase tools, grouped by action) - OpenCode: opencode.json (nested tool→pattern→action object) - Codex CLI: .codex/config.toml (bash-only prefix_rules with TOML) Includes coexistence with the ignore feature for Claude Code's settings.json, preserving Read() entries from .aiignore in deny list. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds a new permissions feature to Rulesync, centered on a canonical .rulesync/permissions.json file and converters for multiple tool-specific permission formats, integrating it into generate/import flows, CLI/MCP outputs, and JSON schema generation.

Changes:

Introduce canonical permissions types/schema (src/types/permissions.ts) and the .rulesync/permissions.json representation (RulesyncPermissions).
Implement permissions processors + tool converters for Claude Code, OpenCode, and Codex CLI, with unit tests.
Wire permissions into feature lists, result counts, CLI/MCP responses, fetch paths, and schema generation.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/utils/result.ts	Adds `permissionsCount` into total file counting.
src/types/permissions.ts	Introduces canonical permissions types, zod schemas, and join/split helpers.
src/types/features.ts	Registers `permissions` in `ALL_FEATURES`.
src/mcp/types.ts	Adds `permissionsCount` to MCP result counts.
src/mcp/import.ts	Includes `permissionsCount` in MCP import success response.
src/mcp/generate.ts	Includes `permissionsCount` in MCP generate success response.
src/lib/import.ts	Adds permissions import flow via `PermissionsProcessor`.
src/lib/generate.ts	Adds permissions generation flow via `PermissionsProcessor`.
src/lib/fetch.ts	Adds permissions file to `rulesync fetch` feature paths.
src/index.test.ts	Updates mocked `GenerateResult`/`ImportResult` to include permissions fields.
src/features/permissions/tool-permissions.ts	Adds base abstraction for permissions tool files.
src/features/permissions/rulesync-permissions.ts	Implements canonical `.rulesync/permissions.json` file handling and validation.
src/features/permissions/rulesync-permissions.test.ts	Unit tests for canonical permissions file behavior.
src/features/permissions/permissions-processor.ts	Adds feature processor to load/convert/write permissions across tool targets.
src/features/permissions/permissions-processor.test.ts	Unit tests for processor target handling and conversions.
src/features/permissions/opencode-permissions.ts	Implements OpenCode `opencode.json/jsonc` permissions conversion.
src/features/permissions/opencode-permissions.test.ts	Unit tests for OpenCode permissions conversion and file preference behavior.
src/features/permissions/codexcli-permissions.ts	Implements Codex CLI `.codex/config.toml` (bash-only) permissions conversion.
src/features/permissions/codexcli-permissions.test.ts	Unit tests for Codex CLI permissions conversion.
src/features/permissions/claudecode-permissions.ts	Implements Claude `.claude/settings.json` permissions conversion with ignore coexistence behavior.
src/features/permissions/claudecode-permissions.test.ts	Unit tests for Claude permissions conversion and ignore coexistence behavior.
src/constants/rulesync-paths.ts	Adds permissions paths + schema URL constants.
src/cli/commands/import.ts	Reports permissions counts in CLI import output/telemetry.
src/cli/commands/generate.ts	Reports permissions counts/paths and debug messages in CLI generate.
scripts/generate-json-schema.ts	Generates and formats `permissions-schema.json`.

You can also share your feedback on Copilot code review. Take the survey.

+  tool: z.string(),
+  pattern: z.array(z.string()),


+      if (skippedTools.size > 0) {
+        logger.warn(
+          `Skipped permission tool(s) for ${this.toolTarget} (not supported): ${[...skippedTools].join(", ")}`,
+        );
+      }


- Remove identity mapping CANONICAL_TO_OPENCODE_TOOL_NAMES (OpenCode uses canonical names directly) - Extract resolveOpencodeConfigFile() helper to eliminate DRY violation in OpenCode file resolution - Remove duplicate unsupported-tools warning in PermissionsProcessor (CodexcliPermissions handles it) - Remove unused formatPatternForDisplay static method from CodexcliPermissions - Replace dynamic imports with static import for smol-toml in Codex CLI tests - Add regex validation for tool field in PermissionEntrySchema - Fix pluralization: 'permissions file' -> 'permission file' for singular form - Add ordering dependency comment for ignore/permissions coexistence in generate.ts - Add permissions column to supported tools tables in README, docs, and skills - Add permissions.json documentation to file-formats.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Enforce ignore/permissions execution order via function signature (generatePermissionsCore now requires ignoreResult parameter) - Add parentheses validation to permission pattern segments to prevent round-trip corruption in Claude Code's ToolName(pattern) format - Fix splitPatternForBash/splitPatternForPath to filter empty segments from consecutive delimiters Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds a new permissions feature to Rulesync, introducing a canonical .rulesync/permissions.json format and converters for multiple AI tool configuration formats, integrated into the existing generate/import pipelines.

Changes:

Introduce canonical permissions config/types (.rulesync/permissions.json) plus converters for Claude Code, OpenCode, and Codex CLI.
Integrate permissions into CLI, MCP responses, fetch filtering, and generate/import orchestration (including result counts).
Add JSON schema generation + update docs/skill docs/README to document the new feature.

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/utils/result.ts	Adds `permissionsCount` and includes it in total count calculation.
src/types/permissions.ts	Defines canonical permissions schema/types and pattern join/split helpers.
src/types/features.ts	Adds `permissions` to `ALL_FEATURES`.
src/mcp/types.ts	Extends MCP result counts with `permissionsCount`.
src/mcp/import.ts	Includes `permissionsCount` in MCP import success response.
src/mcp/generate.ts	Includes `permissionsCount` in MCP generate success response.
src/lib/import.ts	Wires `PermissionsProcessor` into import pipeline and exposes `permissionsCount`.
src/lib/generate.ts	Wires permissions generation, ensures ignore runs first for Claude settings coexistence, and exposes `permissionsCount/paths`.
src/lib/fetch.ts	Adds `.rulesync/permissions.json` to feature-path filtering.
src/index.test.ts	Updates top-level tests to include permissions fields in mock results.
src/features/permissions/tool-permissions.ts	Introduces ToolPermissions base class for tool-specific permissions files.
src/features/permissions/rulesync-permissions.ts	Implements `.rulesync/permissions.json` model + schema export for JSON schema generation.
src/features/permissions/rulesync-permissions.test.ts	Unit tests for rulesync permissions file loading/validation.
src/features/permissions/permissions-processor.ts	Implements the permissions feature processor and target support metadata.
src/features/permissions/permissions-processor.test.ts	Unit tests for processor behavior and conversions.
src/features/permissions/opencode-permissions.ts	Implements OpenCode converter (opencode.json/jsonc).
src/features/permissions/opencode-permissions.test.ts	Tests OpenCode conversion + preservation behavior.
src/features/permissions/codexcli-permissions.ts	Implements Codex CLI converter for `.codex/config.toml` (bash-only).
src/features/permissions/codexcli-permissions.test.ts	Tests Codex CLI conversion + warnings/preservation behavior.
src/features/permissions/claudecode-permissions.ts	Implements Claude Code converter and preserves ignore-generated `Read()` denies.
src/features/permissions/claudecode-permissions.test.ts	Tests Claude conversion, preservation of other keys, and ignore coexistence logic.
src/constants/rulesync-paths.ts	Adds permissions file/schema constants.
src/cli/commands/import.ts	Includes permissions in import output + analytics capture.
src/cli/commands/generate.ts	Includes permissions in generate output and logging/pluralization.
scripts/generate-json-schema.ts	Generates `permissions-schema.json` alongside existing schemas.
skills/rulesync/supported-tools.md	Documents permissions support in supported tools table.
skills/rulesync/file-formats.md	Documents `.rulesync/permissions.json` format and tool outputs.
docs/reference/supported-tools.md	Documents permissions support in supported tools table.
docs/reference/file-formats.md	Documents `.rulesync/permissions.json` format and tool outputs.
README.md	Updates supported tools/features table to include permissions.

You can also share your feedback on Copilot code review. Take the survey.

Copilot

Pull request overview

Adds a new permissions feature to Rulesync, introducing a canonical .rulesync/permissions.json format and tool-specific generators (and partial import support) so tool permission policies can be managed centrally alongside existing Rulesync features.

Changes:

Introduces canonical permissions schema/types plus converters for Claude Code, OpenCode, and Codex CLI.
Integrates permissions into generate/import flows, CLI output, MCP output, fetch paths, and total-count aggregation.
Updates docs/README + adds JSON schema generation + unit tests for the new feature.

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/utils/result.ts	Adds `permissionsCount` to result totals.
src/types/permissions.ts	Defines canonical permissions schema, mappings, and pattern join/split helpers.
src/types/features.ts	Registers `permissions` in `ALL_FEATURES`.
src/mcp/types.ts	Extends MCP result counts with `permissionsCount`.
src/mcp/import.ts	Returns `permissionsCount` in MCP import results.
src/mcp/generate.ts	Returns `permissionsCount` in MCP generate results.
src/lib/import.ts	Adds permissions import pipeline via `PermissionsProcessor` (with target gating).
src/lib/generate.ts	Adds permissions generation pipeline + orders after ignore generation.
src/lib/fetch.ts	Adds `.rulesync/permissions.json` to feature fetch paths.
src/index.test.ts	Updates mocked generate/import results to include permissions fields.
src/features/permissions/tool-permissions.ts	Introduces base abstraction for tool permissions files.
src/features/permissions/rulesync-permissions.ts	Implements `.rulesync/permissions.json` loader/validator + schema re-export.
src/features/permissions/rulesync-permissions.test.ts	Unit tests for canonical permissions file handling.
src/features/permissions/permissions-processor.ts	Adds feature processor wiring, target support, and conversions.
src/features/permissions/permissions-processor.test.ts	Tests processor behavior and conversions at a basic level.
src/features/permissions/opencode-permissions.ts	Implements OpenCode permissions read/write and round-trip conversion.
src/features/permissions/opencode-permissions.test.ts	Tests OpenCode permissions conversions and json/jsonc preference.
src/features/permissions/codexcli-permissions.ts	Implements Codex CLI TOML permissions generation (bash-only) + export to canonical.
src/features/permissions/codexcli-permissions.test.ts	Tests Codex CLI permission mapping and TOML preservation behavior.
src/features/permissions/claudecode-permissions.ts	Implements Claude settings.json permissions conversion + preserves ignore `Read()` denies.
src/features/permissions/claudecode-permissions.test.ts	Tests Claude conversion, preservation, and MCP tool name passthrough.
src/constants/rulesync-paths.ts	Adds constants for permissions file path/name + schema URL.
src/cli/commands/import.ts	Includes permissions in CLI import reporting + JSON mode capture.
src/cli/commands/generate.ts	Includes permissions in CLI generate reporting + JSON mode capture.
skills/rulesync/supported-tools.md	Documents permissions support in the supported-tools matrix.
skills/rulesync/file-formats.md	Documents `.rulesync/permissions.json` format and tool outputs.
scripts/generate-json-schema.ts	Generates `permissions-schema.json` alongside existing schemas.
docs/reference/supported-tools.md	Documents permissions support in the supported-tools matrix.
docs/reference/file-formats.md	Documents `.rulesync/permissions.json` format and tool outputs.
README.md	Updates supported-tools table to include permissions.

You can also share your feedback on Copilot code review. Take the survey.

+
+export const PermissionEntrySchema = z.looseObject({
+  tool: z.string().check(z.regex(/^[a-zA-Z0-9_]+$/)),
+  pattern: z.array(z.string().check(z.regex(/^[^()]*$/))),


…ode/cline/qwencode Addresses 18 reviewer findings raised on PR #1338. Highlights: - #1 (critical): AugmentCode non-bash categories now fail-closed. A single deny rule in `read`/`edit`/`write`/`webfetch`/`websearch` collapses the whole tool to a catch-all `deny` entry; non-`*` allow/ask patterns are dropped with an aggregated warning instead of being silently downgraded to a catch-all `allow` that would shadow a deny. - #2 (high): `toolPermissions` are sorted to make AugmentCode's first-match-wins evaluation safe — entries with `shellInputRegex` come before catch-alls, longer regex first, with deny < ask-user < allow as the tiebreaker. - #5 (mid): existing `launch-process` deny entries are preserved across regeneration so a user-added shell deny rule cannot be silently downgraded; non-deny launch-process entries are still owned by rulesync. - #3 (mid): Qwencode generation uses `readFileContentOrNull` (no `readOrInitializeFileContent`) so dry-run does not create the `.qwen/` directory. - #4 (mid): Kilo schema parsing is deferred and respects `params.validate`, so `forDeletion` and dry-run construction never throw on permissive input. - #7, #16 (mid/low): Cline drops non-bash / ask rules at `logger.error` level (rather than warn) and surfaces a defensive warn on allow/deny pattern collisions. - #8, #13 (mid/low): Qwencode pattern parser uses the LAST `)` so nested parentheses (e.g. `Bash(echo (a))`) round-trip; malformed entries warn and fall back to `*`. - #9 (low): Augment non-bash warnings are aggregated once per category. - #11 (low): Kilo's wholesale-replace of the `permission` object is documented in `docs/reference/file-formats.md`. - #10, #6 (low): glob→regex behaviour and round-trip caveats are documented. - #14 (low): `mergedPermissions` is typed as `{ allow?: string[]; ask?: string[]; deny?: string[]; [k: string]: unknown }`. - #15 (low): redundant Qwencode global-mode equivalence assert removed. - #17 (low): `permissions-processor.test.ts` gains `loadToolFiles` cases for AugmentCode, Cline, Kilo, and Qwencode. Deferred: - #12 (kilo home-mock migration): the existing kilo global-mode test already passes `outputRoot` directly and does not reach `getHomeDirectory()`, so introducing the home-mock pattern adds only ceremony without coverage. - #18 (tool-name-mapping helper extraction): postponed to keep this fix focused and to avoid touching files outside the permissions feature. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings March 17, 2026 07:49

Copilot started reviewing on behalf of dyoshikawa March 17, 2026 07:50 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

dyoshikawa and others added 2 commits March 17, 2026 03:41

Copilot AI review requested due to automatic review settings March 17, 2026 11:27

Copilot started reviewing on behalf of dyoshikawa March 17, 2026 11:27 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

Comment thread src/features/permissions/opencode-permissions.ts

Comment thread docs/reference/file-formats.md

Comment thread skills/rulesync/file-formats.md

dyoshikawa requested a review from Copilot March 18, 2026 01:29

Copilot started reviewing on behalf of dyoshikawa March 18, 2026 01:30 View session

Copilot AI reviewed Mar 18, 2026

View reviewed changes

cm-dyoshikawa closed this Mar 19, 2026

dyoshikawa mentioned this pull request Mar 19, 2026

Permissions feature: code quality improvements from PR #1338 review #1343

Closed

cm-dyoshikawa deleted the permissions branch March 23, 2026 02:19

dyoshikawa changed the title ~~feat: add permissions feature for Claude Code, OpenCode, and Codex CLI~~ feat(permissions): support kilo, augmentcode, cline, qwencode Apr 29, 2026

dyoshikawa mentioned this pull request Apr 30, 2026

feat(permissions): support kilo, augmentcode, cline, qwencode #1585

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(permissions): support kilo, augmentcode, cline, qwencode#1338

feat(permissions): support kilo, augmentcode, cline, qwencode#1338
dyoshikawa wants to merge 3 commits into
mainfrom
permissions

dyoshikawa commented Mar 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

dyoshikawa commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dyoshikawa commented Mar 17, 2026 •

edited

Loading