fix(distill): recommend Edit(...) not Write(...) for the catalog allow-rule

cmd/claude-memsync/init.go

@@ -179,7 +179,10 @@ func bootstrap(cfg config.Config, force bool) error {
 
 // printDistillPermissionHint suggests the one-time Claude Code permission rule
 // that lets the /distill and /distill-apply skills read and write the shared
-// catalog without prompting under default (non-bypass) permissions. We only
+// catalog without prompting under default (non-bypass) permissions. The write
+// side must be spelled Edit(path), not Write(path): Claude Code matches file
+// permission checks against Edit rules only (they cover every file-editing
+// tool), and warns at startup about any Write(path) allow rule. We only
 // advise — editing the user's global settings.json is left to them (or the
 // update-config skill), since it is theirs to own.
 func printDistillPermissionHint(cfg config.Config) {
@@ -188,7 +191,7 @@ func printDistillPermissionHint(cfg config.Config) {
 	fmt.Fprintln(os.Stderr, "To let the /distill skills use the catalog without permission prompts,")
 	fmt.Fprintln(os.Stderr, "add this to ~/.claude/settings.json (permissions.allow):")
 	fmt.Fprintf(os.Stderr, "  \"Read(%s/**)\",\n", dir)
-	fmt.Fprintf(os.Stderr, "  \"Write(%s/**)\"\n", dir)
+	fmt.Fprintf(os.Stderr, "  \"Edit(%s/**)\"\n", dir)
 }
 
 // tryClone attempts `git clone <url> <dir>`. Returns (true, nil) on success,

docs/distilling-memories.md

@@ -78,10 +78,15 @@ You only do this once per machine.
    ```jsonc
    { "permissions": { "allow": [
      "Read(~/.claudesync/distilled/**)",
-     "Write(~/.claudesync/distilled/**)"
+     "Edit(~/.claudesync/distilled/**)"
    ] } }
    ```
 
+   Use `Edit(...)`, not `Write(...)`, for the write side: Claude Code matches
+   file permission checks against `Edit` rules only (they cover every
+   file-editing tool, including `Write`), and warns at startup about a
+   `Write(path)` allow rule.
+
    Without this, the skills still work but Claude will ask permission each time
    it reads or writes the catalog (expected in default, non-bypass mode).
 
@@ -174,6 +179,10 @@ to know what belongs.
 
 - **Claude keeps asking permission to read/write the catalog.** The allow-rule
   in setup step 3 isn't in place. Add it to `~/.claude/settings.json`.
+- **Claude warns at startup that a `Write(...)` allow rule "is not matched by
+  file permission checks".** An older setup used `Write(...)` for the catalog.
+  Replace it with `Edit(...)` (see setup step 3); the warning goes away and the
+  rule starts actually applying.
 - **`/distill` promoted something too project-specific.** Tell Claude to remove
   that entry from `~/.claudesync/distilled/` and un-tag the original; or delete
   the `<slug>.md` and run `claude-memsync distill --prune`.