@kuznai/inception-engine 0.15.0 → 0.17.0

package/README.md

@@ -50,7 +50,9 @@ Managed skills overwrite their previous version. If a target exists but was not
 | Config patch (JSON merge) | All agents via manifest and CLI | All agents |
 | MCP Servers | claude-code, gemini-cli, codex, antigravity, opencode; github-copilot repo-scoped surfaces are warned and skipped | claude-code, gemini-cli, codex, antigravity, opencode |
 | Global/Repo Rules Files | All agents (antigravity uses repo-local `.agents/rules/`); github-copilot reads CLAUDE.md natively (deploy via claude-code) | All agents |
-| `init` manifest generation | Scans `SKILL.md` directories (`skills`), `.md` files with Claude-first agent mapping (`agentRules`), and `mcp-servers.json` (`mcpServers`); emits hints for `files/` and `configs/` directories | N/A |
+| Permissions / Approval Config | claude-code (`~/.claude/settings.json`), codex (`~/.codex/config.toml`); other agents are warned and skipped | claude-code, codex |
+| Agent Definitions | claude-code (`{repo}/.claude/agents/{name}.md`), gemini-cli (`{repo}/.gemini/agents/{name}.md`), antigravity (`{repo}/.agents/rules/{name}.md`), opencode (`{repo}/.opencode/agents/{name}.md`), github-copilot (`{repo}/.github/agents/{name}.agent.md`); codex is warned and skipped | All supported agents |
+| `init` manifest generation | Scans `SKILL.md` directories (`skills`), `.md` files with Claude-first agent mapping (`agentRules`), `mcp-servers.json` (`mcpServers`), and agent-definition Markdown files (`agentDefinitions`); emits hints for `files/` and `configs/` directories | N/A |
 
 Features that depend on agent-specific config surfaces are intentionally conservative: if a target path or schema is not implemented with enough confidence, inception-engine warns and skips it rather than guessing.
 
@@ -98,6 +100,25 @@ Create an `inception.json` file at the root of your skills directory:
       "path": "rules/CLAUDE.md",
       "agents": ["claude-code"]
     }
+  ],
+  "permissions": [
+    {
+      "name": "safety-defaults",
+      "agents": ["claude-code"],
+      "config": {
+        "permissions": {
+          "allow": ["Read", "Glob"],
+          "deny": ["Bash(rm:*)"]
+        }
+      }
+    }
+  ],
+  "agentDefinitions": [
+    {
+      "name": "code-reviewer",
+      "path": "agents/code-reviewer.md",
+      "agents": ["claude-code", "opencode", "github-copilot"]
+    }
   ]
 }
 ```
@@ -145,6 +166,64 @@ Each **agentRules** entry deploys a Markdown instruction file to an agent's supp
 
 Instruction rule deployment is supported for all agents. For most agents, this targets a single global rules file (e.g., `~/.claude/CLAUDE.md` for `claude-code`, `~/.codex/AGENTS.md` for `codex`, `~/.gemini/GEMINI.md` for `gemini-cli`, and `~/.config/opencode/AGENTS.md` for `opencode`). For `antigravity`, inception-engine deploys to repo-local instruction surfaces at `{repo}/.agents/rules/{name}.md`. For `github-copilot`, no separate deployment is needed because Copilot reads `CLAUDE.md` natively — target it via the `claude-code` agentRules entry and it reaches Copilot automatically. Revert removes the deployed rules file.
 
+Each **permissions** entry deploys execution and safety-oriented configuration to an agent's permission or approval surface:
+
+- **name** - Unique identifier (same format as skill names)
+- **agents** - Array of agent IDs to deploy this entry to
+- **config** - Permission config payload; shape is validated per agent (see below)
+
+Permission deployment is currently supported for `claude-code` and `codex`. Other agents emit a warning and are skipped.
+
+For `claude-code`, the config is merged into `~/.claude/settings.json`. Only the `permissions` key is accepted:
+
+```json
+{
+  "name": "safety-defaults",
+  "agents": ["claude-code"],
+  "config": {
+    "permissions": {
+      "allow": ["Read", "Glob", "Bash(git:*)"],
+      "deny": ["Bash(rm:*)"]
+    }
+  }
+}
+```
+
+Both `allow` and `deny` are optional string arrays. Tool patterns follow Claude Code's permission glob syntax (e.g., `Bash(git:*)` to allow all git commands).
+
+For `codex`, the config is merged into `~/.codex/config.toml`. Only the `approval_policy` key is accepted:
+
+```json
+{
+  "name": "codex-approval",
+  "agents": ["codex"],
+  "config": {
+    "approval_policy": "suggest"
+  }
+}
+```
+
+Valid `approval_policy` values are `"auto"`, `"manual"`, `"suggest"`, and `"on-failure"`.
+
+Revert restores the previous config values using the undo patch recorded at deploy time.
+
+Each **agentDefinitions** entry deploys a Markdown agent-definition file to the repo-local agent-definitions directory of each targeted agent:
+
+- **name** - Unique identifier (same format as skill names); used as the definition filename
+- **path** - Relative path to the source Markdown file within the repo; must be a `.md` or `.markdown` file
+- **agents** - Array of agent IDs to deploy this definition to
+
+Agent-definition deployment is supported for `claude-code`, `gemini-cli`, `antigravity`, `opencode`, and `github-copilot`. For `codex`, inception-engine emits a warning and skips the entry — use `agentRules` to deploy persona instructions to Codex instead.
+
+All targets are repo-local (they land inside the repository being deployed, not the user's home directory):
+- **claude-code**: `{repo}/.claude/agents/{name}.md`
+- **gemini-cli**: `{repo}/.gemini/agents/{name}.md`
+- **antigravity**: `{repo}/.agents/rules/{name}.md`
+- **opencode**: `{repo}/.opencode/agents/{name}.md`
+- **github-copilot**: `{repo}/.github/agents/{name}.agent.md` (note the `.agent.md` suffix)
+
+Revert removes the deployed agent-definition file.
+
 ## Creating Skills
 
 Each skill is a directory containing at minimum a `SKILL.md` file with YAML frontmatter:
@@ -175,12 +254,15 @@ Current `init` behavior:
 - Supports `--dry-run` so you can inspect the generated manifest before writing it
 - Discovers agent-rules Markdown files in the root and conventional subdirectories (`rules/`, `instructions/`, `.github/`, `.agents/rules/`), mapping them to agents using Claude-first portability conventions: `copilot-instructions.md` maps to `claude-code` (Copilot reads `CLAUDE.md` natively), and the fallback for unrecognized files excludes agents whose agentRules surface is unsupported
 - Reads `mcp-servers.json` from the repo root (if present) and generates `mcpServers` entries; invalid entries are warned and skipped
-- Emits guidance when a `files/` or `configs/` directory is detected at the repo root
+- Reads `files-manifest.json` from the repo root (if present) and generates `files` entries; invalid entries are warned and skipped
+- Reads `configs-manifest.json` from the repo root (if present) and generates `configs` entries; invalid entries are warned and skipped
+- Reads `agent-definitions-manifest.json` from the repo root (if present) and generates `agentDefinitions` entries; if absent, auto-discovers agent-definition Markdown files from `.claude/agents/`, `.gemini/agents/`, `.agents/rules/`, `.opencode/agents/`, and `.github/agents/`; invalid entries are warned and skipped
+- Emits guidance to create a sidecar manifest when a `files/` or `configs/` directory is detected but the corresponding sidecar file is absent
 
 Current `init` limitations:
 
 - It does not reconcile generated manifest entries against `SKILL.md` frontmatter values
-- `files` and `configs` entries cannot be inferred automatically since deployment targets are system-specific; add them manually after `init`
+- `files` and `configs` target paths are deployment-system-specific and cannot be inferred; they must be provided explicitly in `files-manifest.json` and `configs-manifest.json`
 
 ### Repo Conventions Recognized by `init`
 
@@ -196,6 +278,48 @@ Place a `mcp-servers.json` file at the repo root to have `init` populate the `mc
 ]
 ```
 
+Place a `files-manifest.json` file at the repo root to have `init` populate the `files` section automatically. The file must be a JSON array of file entries using the same schema as the `files` field in `inception.json`:
+
+```json
+[
+  {
+    "name": "my-settings",
+    "path": "files/settings.json",
+    "target": "{home}/.claude/settings.json",
+    "agents": ["claude-code"]
+  }
+]
+```
+
+Place a `configs-manifest.json` file at the repo root to have `init` populate the `configs` section automatically. The file must be a JSON array of config entries using the same schema as the `configs` field in `inception.json`:
+
+```json
+[
+  {
+    "name": "enable-feature",
+    "target": "{home}/.claude/settings.json",
+    "patch": { "someFeature": true },
+    "agents": ["claude-code"]
+  }
+]
+```
+
+Invalid entries are warned and skipped; the rest are written into the generated manifest verbatim.
+
+Place an `agent-definitions-manifest.json` file at the repo root to have `init` populate the `agentDefinitions` section automatically. The file must be a JSON array of agent-definition entries using the same schema as the `agentDefinitions` field in `inception.json`:
+
+```json
+[
+  {
+    "name": "code-reviewer",
+    "path": "agents/code-reviewer.md",
+    "agents": ["claude-code", "opencode", "github-copilot"]
+  }
+]
+```
+
+If no `agent-definitions-manifest.json` is present, `init` auto-discovers agent-definition Markdown files from five conventional subdirectories: `.claude/agents/`, `.gemini/agents/`, `.agents/rules/`, `.opencode/agents/`, and `.github/agents/`. Each discovered file is mapped to the owning agent(s). GitHub Copilot files named `{name}.agent.md` have the `.agent` infix stripped to derive the manifest name (e.g., `foo.agent.md` → name `foo`).
+
 Invalid entries are warned and skipped; the rest are written into the generated manifest verbatim.
 
 ## CLI Reference

package/dist/config/agents.js

@@ -17,6 +17,8 @@ export const AGENT_REGISTRY = [
             detectBinary: "documented",
             mcpConfig: "documented",
             agentRules: "documented",
+            permissions: "documented",
+            agentDefinitions: "documented",
         },
         mcpSupport: {
             status: "supported",
@@ -34,6 +36,22 @@ export const AGENT_REGISTRY = [
                 windows: ["{home}", ".claude", "CLAUDE.md"],
             },
         },
+        permissionsSupport: {
+            status: "supported",
+            schemaLabel: "JSON permissions config",
+            path: {
+                posix: ["{home}", ".claude", "settings.json"],
+                windows: ["{home}", ".claude", "settings.json"],
+            },
+        },
+        agentDefinitionsSupport: {
+            status: "supported",
+            schemaLabel: "repo-local agent definition Markdown file",
+            path: {
+                posix: ["{repo}", ".claude", "agents", "{name}.md"],
+                windows: ["{repo}", ".claude", "agents", "{name}.md"],
+            },
+        },
     },
     {
         id: "codex",
@@ -52,6 +70,7 @@ export const AGENT_REGISTRY = [
             detectPaths: "documented",
             detectBinary: "documented",
             agentRules: "documented",
+            permissions: "documented",
         },
         mcpSupport: {
             status: "supported",
@@ -69,6 +88,19 @@ export const AGENT_REGISTRY = [
                 windows: ["{home}", ".codex", "AGENTS.md"],
             },
         },
+        permissionsSupport: {
+            status: "supported",
+            schemaLabel: "TOML approval policy config",
+            path: {
+                posix: ["{home}", ".codex", "config.toml"],
+                windows: ["{home}", ".codex", "config.toml"],
+            },
+        },
+        agentDefinitionsSupport: {
+            status: "unsupported",
+            schemaLabel: "dedicated agent definition directory",
+            reason: "OpenAI Codex does not expose a documented dedicated per-agent definition directory surface separate from AGENTS.md and config.toml — use agentRules to deploy persona instructions instead",
+        },
     },
     {
         id: "gemini-cli",
@@ -88,6 +120,7 @@ export const AGENT_REGISTRY = [
             detectBinary: "documented",
             mcpConfig: "documented",
             agentRules: "documented",
+            agentDefinitions: "implementation-only",
         },
         mcpSupport: {
             status: "supported",
@@ -105,6 +138,19 @@ export const AGENT_REGISTRY = [
                 windows: ["{home}", ".gemini", "GEMINI.md"],
             },
         },
+        permissionsSupport: {
+            status: "unsupported",
+            schemaLabel: "global permissions surface",
+            reason: "Gemini CLI does not expose a documented global per-user permission or approval config surface",
+        },
+        agentDefinitionsSupport: {
+            status: "supported",
+            schemaLabel: "repo-local agent definition Markdown file",
+            path: {
+                posix: ["{repo}", ".gemini", "agents", "{name}.md"],
+                windows: ["{repo}", ".gemini", "agents", "{name}.md"],
+            },
+        },
     },
     {
         id: "antigravity",
@@ -122,6 +168,8 @@ export const AGENT_REGISTRY = [
             skills: "implementation-only",
             detectPaths: "implementation-only",
             detectBinary: "provisional",
+            agentRules: "documented",
+            agentDefinitions: "documented",
         },
         mcpSupport: {
             status: "supported",
@@ -139,6 +187,19 @@ export const AGENT_REGISTRY = [
                 windows: ["{repo}", ".agents", "rules", "{name}.md"],
             },
         },
+        permissionsSupport: {
+            status: "unsupported",
+            schemaLabel: "global permissions surface",
+            reason: "Antigravity does not expose a documented global per-user permission or approval config surface",
+        },
+        agentDefinitionsSupport: {
+            status: "supported",
+            schemaLabel: "repo-local agent definition Markdown file",
+            path: {
+                posix: ["{repo}", ".agents", "rules", "{name}.md"],
+                windows: ["{repo}", ".agents", "rules", "{name}.md"],
+            },
+        },
     },
     {
         id: "opencode",
@@ -157,6 +218,7 @@ export const AGENT_REGISTRY = [
             detectPaths: "documented",
             detectBinary: "documented",
             agentRules: "documented",
+            agentDefinitions: "documented",
         },
         mcpSupport: {
             status: "supported",
@@ -175,35 +237,62 @@ export const AGENT_REGISTRY = [
                 windows: ["{appdata}", "opencode", "AGENTS.md"],
             },
         },
+        permissionsSupport: {
+            status: "unsupported",
+            schemaLabel: "global permissions surface",
+            reason: "OpenCode does not expose a documented global per-user permission or approval config surface",
+        },
+        agentDefinitionsSupport: {
+            status: "supported",
+            schemaLabel: "repo-local agent definition Markdown file",
+            path: {
+                posix: ["{repo}", ".opencode", "agents", "{name}.md"],
+                windows: ["{repo}", ".opencode", "agents", "{name}.md"],
+            },
+        },
     },
     {
         id: "github-copilot",
         displayName: "GitHub Copilot",
-        skills: {
-            posix: ["{home}", ".copilot", "skills", "{name}"],
-            windows: ["{home}", ".copilot", "skills", "{name}"],
-        },
+        // No `skills` field: GitHub Copilot natively executes Claude-style skills
+        // from `.claude/skills/` (the same path used by claude-code). Deploying
+        // via the `claude-code` skills target automatically covers Copilot — no
+        // separate `~/.copilot/skills/` path is needed or maintained.
         detectPaths: {
             posix: ["{home}", ".copilot"],
             windows: ["{home}", ".copilot"],
         },
         detectBinary: "github-copilot",
         provenance: {
-            skills: "documented",
             detectPaths: "documented",
             detectBinary: "documented",
+            agentDefinitions: "documented",
         },
         mcpSupport: {
-            status: "unsupported",
+            status: "planned",
             schemaLabel: "repo-scoped MCP surfaces",
-            reason: "GitHub Copilot MCP support depends on repo-scoped files such as devcontainer or agent-frontmatter mappings, which are not translated here",
+            plannedSurface: "devcontainer (.devcontainer/devcontainer.json) and agent-frontmatter (.github/agents/*.agent.md)",
+            reason: "GitHub Copilot MCP support will be implemented via repo-scoped devcontainer features and agent-frontmatter mappings — surfaces that are genuinely Copilot-specific and not covered by other agent targets",
         },
         agentRulesSupport: {
             status: "unsupported",
             schemaLabel: "Claude-native shared instructions",
             reason: 'GitHub Copilot reads CLAUDE.md natively, so deploy via the "claude-code" agentRules target instead of a separate rules surface',
         },
-        policyNote: "Organization policies may override locally deployed skills. Verify with your GitHub org admin if deployed skills are not active.",
+        permissionsSupport: {
+            status: "unsupported",
+            schemaLabel: "global permissions surface",
+            reason: "GitHub Copilot permissions are managed via organization policy, not a deployable per-user config surface",
+        },
+        agentDefinitionsSupport: {
+            status: "supported",
+            schemaLabel: "repo-local agent definition Markdown file",
+            path: {
+                posix: ["{repo}", ".github", "agents", "{name}.agent.md"],
+                windows: ["{repo}", ".github", "agents", "{name}.agent.md"],
+            },
+        },
+        policyNote: "Organization policies may override locally deployed configuration. Verify with your GitHub org admin if deployed skills or rules are not active.",
     },
 ];
 export const AGENT_REGISTRY_BY_ID = Object.fromEntries(AGENT_REGISTRY.map((a) => [a.id, a]));

package/dist/config/manifest.js

@@ -42,6 +42,8 @@ function validateManifest(data, filePath) {
         if (issuePath.length === 1 &&
             (issuePath[0] === "mcpServers" ||
                 issuePath[0] === "agentRules" ||
+                issuePath[0] === "agentDefinitions" ||
+                issuePath[0] === "permissions" ||
                 issuePath[0] === "files" ||
                 issuePath[0] === "configs")) {
             throw new UserError("MANIFEST_INVALID", `${filePath}: "${issuePath[0]}" must be an array`);

package/dist/core/adapters/agent-definitions.d.ts

@@ -0,0 +1,20 @@
+import type { AgentDefinitionEntry } from "../../schemas/manifest.ts";
+import type { AgentId, FileWriteDeployAction, FileWriteRevertAction, PlanWarning } from "../../types.ts";
+export interface AgentDefinitionsAdapterResult {
+    actions: FileWriteDeployAction[];
+    warnings: PlanWarning[];
+}
+/**
+ * Compiles deploy actions for agentDefinitions manifest entries.
+ *
+ * Agent definition files are Markdown files (typically with YAML frontmatter)
+ * that define custom agents or subagents for a given platform. Unlike
+ * agentRules (which target a single shared global file per agent), each
+ * definition entry produces a separate file named after the entry in the
+ * agent's dedicated agent-definitions directory (repo-local).
+ *
+ * Target paths use the `{repo}` placeholder so definitions land in the
+ * repository being deployed, not the user's home directory.
+ */
+export declare function compileAgentDefinitionActions(entry: AgentDefinitionEntry, sourceDir: string, resolvedSourceDir: string, realRoot: string, detectedAgents: AgentId[], home: string, repo?: string): Promise<AgentDefinitionsAdapterResult>;
+export declare function compileAgentDefinitionReverts(entry: AgentDefinitionEntry, agentFilter: AgentId[] | null, home: string, repo?: string): FileWriteRevertAction[];

package/dist/core/adapters/agent-definitions.js

@@ -0,0 +1,90 @@
+import path from "node:path";
+import { AGENT_REGISTRY_BY_ID } from "../../config/agents.js";
+import { getPlatformKey, resolvePlaceholders } from "../resolve.js";
+import { validateAgentRuleMarkdownPath, validateSourceFile, validateSourcePath, } from "../validation.js";
+/**
+ * Compiles deploy actions for agentDefinitions manifest entries.
+ *
+ * Agent definition files are Markdown files (typically with YAML frontmatter)
+ * that define custom agents or subagents for a given platform. Unlike
+ * agentRules (which target a single shared global file per agent), each
+ * definition entry produces a separate file named after the entry in the
+ * agent's dedicated agent-definitions directory (repo-local).
+ *
+ * Target paths use the `{repo}` placeholder so definitions land in the
+ * repository being deployed, not the user's home directory.
+ */
+export async function compileAgentDefinitionActions(entry, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home, repo) {
+    const actions = [];
+    const warnings = [];
+    const platform = getPlatformKey();
+    const targetAgents = entry.agents.filter((agentId) => detectedAgents.includes(agentId));
+    const supportedTargets = [];
+    if (targetAgents.length === 0) {
+        return { actions, warnings };
+    }
+    for (const agentId of targetAgents) {
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        const support = agent?.agentDefinitionsSupport;
+        if (!support || support.status === "unsupported") {
+            warnings.push({
+                kind: "confidence",
+                message: `agentDefinitions: agent "${agentId}" uses ${support?.schemaLabel ?? "an unsupported agent-definition schema"} and ${support?.status === "unsupported" ? support.reason : "does not expose a supported agent-definitions adapter"} — skipping "${entry.name}"`,
+            });
+            continue;
+        }
+        if (support.status === "planned") {
+            warnings.push({
+                kind: "confidence",
+                message: `agentDefinitions: agent "${agentId}" agent-definitions support is planned via ${support.plannedSurface} — skipping "${entry.name}" until that surface is implemented`,
+            });
+            continue;
+        }
+        supportedTargets.push({
+            agentId,
+            confidence: agent.provenance.agentDefinitions ?? "provisional",
+            target: resolvePlaceholders(support.path[platform], entry.name, home, repo),
+        });
+    }
+    if (supportedTargets.length === 0) {
+        return { actions, warnings };
+    }
+    // Validate the shared source file only when at least one target is active.
+    const source = path.resolve(sourceDir, entry.path);
+    await validateSourcePath(source, entry.path, resolvedSourceDir, realRoot);
+    await validateSourceFile(source, entry.path);
+    for (const target of supportedTargets) {
+        validateAgentRuleMarkdownPath(entry.path, target.agentId);
+        actions.push({
+            kind: "file-write",
+            skill: entry.name,
+            agent: target.agentId,
+            source,
+            target: target.target,
+            confidence: target.confidence,
+        });
+    }
+    return { actions, warnings };
+}
+export function compileAgentDefinitionReverts(entry, agentFilter, home, repo) {
+    const actions = [];
+    const platform = getPlatformKey();
+    for (const agentId of entry.agents) {
+        if (agentFilter && !agentFilter.includes(agentId))
+            continue;
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        const support = agent?.agentDefinitionsSupport;
+        if (!support ||
+            support.status === "unsupported" ||
+            support.status === "planned")
+            continue;
+        const target = resolvePlaceholders(support.path[platform], entry.name, home, repo);
+        actions.push({
+            kind: "file-write",
+            skill: entry.name,
+            agent: agentId,
+            target,
+        });
+    }
+    return actions;
+}

package/dist/core/adapters/index.d.ts

@@ -1,11 +1,13 @@
-import type { AgentRuleEntry, McpServerEntry } from "../../schemas/manifest.ts";
+import type { AgentDefinitionEntry, AgentRuleEntry, McpServerEntry, PermissionsEntry } from "../../schemas/manifest.ts";
 import type { AgentId, ConfigPatchDeployAction, FileWriteDeployAction, FrontmatterEmitDeployAction, PlanWarning, TomlPatchDeployAction } from "../../types.ts";
+import { compileAgentDefinitionReverts } from "./agent-definitions.ts";
 import { compileMcpServerReverts } from "./mcp.ts";
+import { compilePermissionsReverts } from "./permissions.ts";
 import { compileAgentRuleReverts } from "./rules.ts";
-export { compileAgentRuleReverts, compileMcpServerReverts };
+export { compileAgentDefinitionReverts, compileAgentRuleReverts, compileMcpServerReverts, compilePermissionsReverts, };
 export type AdapterAction = ConfigPatchDeployAction | FileWriteDeployAction | TomlPatchDeployAction | FrontmatterEmitDeployAction;
 export interface AdapterResult {
     actions: AdapterAction[];
     warnings: PlanWarning[];
 }
-export declare function compileAdapterActions(mcpServers: McpServerEntry[], agentRules: AgentRuleEntry[], sourceDir: string, resolvedSourceDir: string, realRoot: string, detectedAgents: AgentId[], home: string, repo?: string): Promise<AdapterResult>;
+export declare function compileAdapterActions(mcpServers: McpServerEntry[], agentRules: AgentRuleEntry[], permissions: PermissionsEntry[], sourceDir: string, resolvedSourceDir: string, realRoot: string, detectedAgents: AgentId[], home: string, repo?: string, agentDefinitions?: AgentDefinitionEntry[]): Promise<AdapterResult>;

package/dist/core/adapters/index.js

@@ -1,7 +1,9 @@
+import { compileAgentDefinitionActions, compileAgentDefinitionReverts, } from "./agent-definitions.js";
 import { compileMcpServerActions, compileMcpServerReverts } from "./mcp.js";
+import { compilePermissionsActions, compilePermissionsReverts, } from "./permissions.js";
 import { compileAgentRuleActions, compileAgentRuleReverts } from "./rules.js";
-export { compileAgentRuleReverts, compileMcpServerReverts };
-export async function compileAdapterActions(mcpServers, agentRules, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home, repo) {
+export { compileAgentDefinitionReverts, compileAgentRuleReverts, compileMcpServerReverts, compilePermissionsReverts, };
+export async function compileAdapterActions(mcpServers, agentRules, permissions, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home, repo, agentDefinitions) {
     const actions = [];
     const warnings = [];
     for (const entry of mcpServers) {
@@ -14,5 +16,15 @@ export async function compileAdapterActions(mcpServers, agentRules, sourceDir, r
         actions.push(...r.actions);
         warnings.push(...r.warnings);
     }
+    for (const entry of permissions) {
+        const r = compilePermissionsActions(entry, detectedAgents, home);
+        actions.push(...r.actions);
+        warnings.push(...r.warnings);
+    }
+    for (const entry of agentDefinitions ?? []) {
+        const r = await compileAgentDefinitionActions(entry, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home, repo);
+        actions.push(...r.actions);
+        warnings.push(...r.warnings);
+    }
     return { actions, warnings };
 }

package/dist/core/adapters/mcp.js

@@ -62,6 +62,13 @@ export function compileMcpServerActions(entry, detectedAgents, home, repo) {
             });
             continue;
         }
+        if (support.status === "planned") {
+            warnings.push({
+                kind: "confidence",
+                message: `mcpServers: agent "${agentId}" MCP support is planned via ${support.plannedSurface} — skipping "${entry.name}" until that surface is implemented`,
+            });
+            continue;
+        }
         validateMcpServerConfigShape(entry.config, entry.name, agentId);
         const rawTarget = resolvePlaceholders(support.path[platform], entry.name, home, repo);
         const resolvedTarget = path.resolve(rawTarget);
@@ -79,7 +86,9 @@ export function compileMcpServerReverts(entry, agentFilter, home, repo) {
             continue;
         const agent = AGENT_REGISTRY_BY_ID[agentId];
         const support = agent?.mcpSupport;
-        if (!support || support.status === "unsupported")
+        if (!support ||
+            support.status === "unsupported" ||
+            support.status === "planned")
             continue;
         const rawTarget = resolvePlaceholders(support.path[platform], entry.name, home, repo);
         const target = path.resolve(rawTarget);

package/dist/core/adapters/permissions.d.ts

@@ -0,0 +1,8 @@
+import type { PermissionsEntry } from "../../schemas/manifest.ts";
+import type { AgentId, ConfigPatchDeployAction, ConfigPatchRevertAction, PlanWarning, TomlPatchDeployAction, TomlPatchRevertAction } from "../../types.ts";
+export interface PermissionsAdapterResult {
+    actions: Array<ConfigPatchDeployAction | TomlPatchDeployAction>;
+    warnings: PlanWarning[];
+}
+export declare function compilePermissionsActions(entry: PermissionsEntry, detectedAgents: AgentId[], home: string): PermissionsAdapterResult;
+export declare function compilePermissionsReverts(entry: PermissionsEntry, agentFilter: AgentId[] | null, home: string): Array<ConfigPatchRevertAction | TomlPatchRevertAction>;

package/dist/core/adapters/permissions.js

@@ -0,0 +1,90 @@
+import path from "node:path";
+import { AGENT_REGISTRY_BY_ID } from "../../config/agents.js";
+import { getPlatformKey, resolvePlaceholders } from "../resolve.js";
+import { validatePermissionsConfigShape } from "../validation.js";
+function isTomlTarget(targetPath) {
+    return path.extname(targetPath).toLowerCase() === ".toml";
+}
+export function compilePermissionsActions(entry, detectedAgents, home) {
+    const actions = [];
+    const warnings = [];
+    const platform = getPlatformKey();
+    for (const agentId of entry.agents) {
+        if (!detectedAgents.includes(agentId))
+            continue;
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        const support = agent?.permissionsSupport;
+        if (!support || support.status === "unsupported") {
+            warnings.push({
+                kind: "confidence",
+                message: `permissions: agent "${agentId}" ${support?.status === "unsupported" ? support.reason : "does not expose a supported permissions adapter"} — skipping "${entry.name}"`,
+            });
+            continue;
+        }
+        if (support.status === "planned") {
+            warnings.push({
+                kind: "confidence",
+                message: `permissions: agent "${agentId}" permissions support is planned via ${support.plannedSurface} — skipping "${entry.name}" until that surface is implemented`,
+            });
+            continue;
+        }
+        validatePermissionsConfigShape(entry.config, entry.name, agentId);
+        const rawTarget = resolvePlaceholders(support.path[platform], entry.name, home);
+        const resolvedTarget = path.resolve(rawTarget);
+        const confidence = agent.provenance.permissions ?? "provisional";
+        if (isTomlTarget(resolvedTarget)) {
+            actions.push({
+                kind: "toml-patch",
+                skill: entry.name,
+                agent: agentId,
+                target: resolvedTarget,
+                config: entry.config,
+                confidence,
+            });
+        }
+        else {
+            actions.push({
+                kind: "config-patch",
+                skill: entry.name,
+                agent: agentId,
+                target: resolvedTarget,
+                patch: entry.config,
+                confidence,
+            });
+        }
+    }
+    return { actions, warnings };
+}
+export function compilePermissionsReverts(entry, agentFilter, home) {
+    const actions = [];
+    const platform = getPlatformKey();
+    for (const agentId of entry.agents) {
+        if (agentFilter && !agentFilter.includes(agentId))
+            continue;
+        const agent = AGENT_REGISTRY_BY_ID[agentId];
+        const support = agent?.permissionsSupport;
+        if (!support ||
+            support.status === "unsupported" ||
+            support.status === "planned")
+            continue;
+        const rawTarget = resolvePlaceholders(support.path[platform], entry.name, home);
+        const target = path.resolve(rawTarget);
+        if (isTomlTarget(target)) {
+            actions.push({
+                kind: "toml-patch",
+                skill: entry.name,
+                agent: agentId,
+                target,
+            });
+        }
+        else {
+            actions.push({
+                kind: "config-patch",
+                skill: entry.name,
+                agent: agentId,
+                target,
+            });
+        }
+    }
+    return actions;
+}