From 3cb05a96f8bf4d5a7effe8cb00659ceb0523956b Mon Sep 17 00:00:00 2001 From: Rockford lhotka Date: Fri, 24 Jul 2026 15:03:51 -0500 Subject: [PATCH] fix(distill): recommend Edit(...) not Write(...) for the catalog allow-rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude Code matches file permission checks against Edit(path) rules only — they cover every file-editing tool, including Write. A Write(path) allow rule never applies and Claude Code warns about it at startup: Permission allow rule (settings.json): Write(~/.claudesync/distilled/**) is not matched by file permission checks — only Edit(path) rules are. `claude-memsync init` was printing exactly that rule as its setup hint, and docs/distilling-memories.md carried the same snippet, so anyone following setup added a dead rule and got the warning on every launch. Switch both to Edit(...), explain the distinction where it's stated, and add a troubleshooting entry for users who already have the old rule. Co-Authored-By: Claude Opus 5 (1M context) --- cmd/claude-memsync/init.go | 7 +++++-- docs/distilling-memories.md | 11 ++++++++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/cmd/claude-memsync/init.go b/cmd/claude-memsync/init.go index a761488..c0bb744 100644 --- a/cmd/claude-memsync/init.go +++ b/cmd/claude-memsync/init.go @@ -179,7 +179,10 @@ func bootstrap(cfg config.Config, force bool) error { // printDistillPermissionHint suggests the one-time Claude Code permission rule // that lets the /distill and /distill-apply skills read and write the shared -// catalog without prompting under default (non-bypass) permissions. We only +// catalog without prompting under default (non-bypass) permissions. The write +// side must be spelled Edit(path), not Write(path): Claude Code matches file +// permission checks against Edit rules only (they cover every file-editing +// tool), and warns at startup about any Write(path) allow rule. We only // advise — editing the user's global settings.json is left to them (or the // update-config skill), since it is theirs to own. func printDistillPermissionHint(cfg config.Config) { @@ -188,7 +191,7 @@ func printDistillPermissionHint(cfg config.Config) { fmt.Fprintln(os.Stderr, "To let the /distill skills use the catalog without permission prompts,") fmt.Fprintln(os.Stderr, "add this to ~/.claude/settings.json (permissions.allow):") fmt.Fprintf(os.Stderr, " \"Read(%s/**)\",\n", dir) - fmt.Fprintf(os.Stderr, " \"Write(%s/**)\"\n", dir) + fmt.Fprintf(os.Stderr, " \"Edit(%s/**)\"\n", dir) } // tryClone attempts `git clone `. Returns (true, nil) on success, diff --git a/docs/distilling-memories.md b/docs/distilling-memories.md index 7745c97..710aa14 100644 --- a/docs/distilling-memories.md +++ b/docs/distilling-memories.md @@ -78,10 +78,15 @@ You only do this once per machine. ```jsonc { "permissions": { "allow": [ "Read(~/.claudesync/distilled/**)", - "Write(~/.claudesync/distilled/**)" + "Edit(~/.claudesync/distilled/**)" ] } } ``` + Use `Edit(...)`, not `Write(...)`, for the write side: Claude Code matches + file permission checks against `Edit` rules only (they cover every + file-editing tool, including `Write`), and warns at startup about a + `Write(path)` allow rule. + Without this, the skills still work but Claude will ask permission each time it reads or writes the catalog (expected in default, non-bypass mode). @@ -174,6 +179,10 @@ to know what belongs. - **Claude keeps asking permission to read/write the catalog.** The allow-rule in setup step 3 isn't in place. Add it to `~/.claude/settings.json`. +- **Claude warns at startup that a `Write(...)` allow rule "is not matched by + file permission checks".** An older setup used `Write(...)` for the catalog. + Replace it with `Edit(...)` (see setup step 3); the warning goes away and the + rule starts actually applying. - **`/distill` promoted something too project-specific.** Tell Claude to remove that entry from `~/.claudesync/distilled/` and un-tag the original; or delete the `.md` and run `claude-memsync distill --prune`.