cuioss/tools-permission-sync

Marketplace Sync Skill

PURPOSE: Synchronize Claude Code permissions with marketplace bundles and manage the executor permission pattern.

Enforcement

Execution mode: Run scripts exactly as documented; use --dry-run before applying changes.

Prohibited actions:

• Do not modify settings files without dry-run verification first
• Do not invent script arguments not listed in the operations table
• Do not bypass the executor permission pattern with individual script permissions

Constraints:

• All commands use python3 .plan/execute-script.py plan-marshall:tools-permission-sync:marketplace-sync {command} {args}
• Always use --dry-run first to preview changes before applying

Script Reference

| Script | Notation | Purpose | |--------|----------|---------| | marketplace-sync | plan-marshall:tools-permission-sync:marketplace-sync | Marketplace permission synchronization |

Operations

generate-wildcards - Generate Permission Wildcards

Generate Skill and SlashCommand wildcards from marketplace inventory.

# Read inventory from stdin
python3 .plan/execute-script.py pm-plugin-development:tools-marketplace-inventory:scan-marketplace-inventory \
  --scope marketplace --resource-types skills,commands | \
python3 .plan/execute-script.py plan-marshall:tools-permission-sync:marketplace-sync generate-wildcards

# Or from file
python3 .plan/execute-script.py plan-marshall:tools-permission-sync:marketplace-sync generate-wildcards \
  --input inventory.json

Output (JSON):

{
  "statistics": {
    "bundles_scanned": 8,
    "skills_found": 28,
    "commands_found": 39,
    "wildcards_generated": 22
  },
  "permissions": {
    "skill_wildcards": ["Skill(pm-dev-builder:*)", "Skill(plan-marshall:*)"],
    "command_bundle_wildcards": ["SlashCommand(/pm-dev-builder:*)", "SlashCommand(/plan-marshall:*)"],
    "command_shortform": ["SlashCommand(/java-core:*)"]
  }
}

ensure-executor - Ensure Executor Permission

Ensure the executor permission exists in settings.

python3 .plan/execute-script.py plan-marshall:tools-permission-sync:marketplace-sync ensure-executor \
  --target global \
  --dry-run

Output (JSON):

{
  "executor_permission": "Bash(python3 .plan/execute-script.py *)",
  "settings_file": "/Users/name/.claude/settings.json",
  "action": "added",
  "success": true
}

cleanup-scripts - Remove Redundant Script Permissions

Remove individual script path permissions (redundant with executor pattern).

python3 .plan/execute-script.py plan-marshall:tools-permission-sync:marketplace-sync cleanup-scripts \
  --target global \
  --remove-broad-python \
  --dry-run

Output (JSON):

{
  "individual_script_permissions": ["Bash(python3 /path/to/scripts/foo.py:*)"],
  "individual_count": 5,
  "broad_python_found": true,
  "broad_python_removed": true,
  "action": "would_remove",
  "total_would_remove": 6
}

migrate-executor - Full Migration to Executor Pattern

Complete migration: add executor permission + cleanup redundant permissions.

python3 .plan/execute-script.py plan-marshall:tools-permission-sync:marketplace-sync migrate-executor \
  --target global \
  --remove-broad-python \
  --dry-run

Output (JSON):

{
  "success": true,
  "dry_run": true,
  "executor": {
    "permission": "Bash(python3 .plan/execute-script.py *)",
    "action": "added"
  },
  "cleanup": {
    "individual_removed": 5,
    "broad_python_removed": true
  },
  "summary": "Migrated to executor-only pattern: 1 permission replaces 5 individual script permissions"
}

Executor Permission Pattern

The executor pattern uses a single permission for all marketplace scripts:

• Bash(python3 .plan/execute-script.py *)

This replaces individual script path permissions because the executor invokes scripts via subprocess (not checked by Claude Code permissions).

Benefits

• Single permission instead of N permissions (one per script)
• Automatic coverage for new scripts when executor is regenerated
• No permission prompts when adding new skills/commands

Migration Path

1. Run ensure-executor to add the executor permission
2. Run cleanup-scripts to remove redundant individual permissions
3. Or run migrate-executor to do both in one step

Target Selection

| Target | File | |--------|------| | global | ~/.claude/settings.json | | project | .claude/settings.json or .claude/settings.local.json |

Integration with Plan Marshall

The plan-marshall skill uses this during setup:

1. Step 2: Generate Executor - Creates .plan/execute-script.py
2. Ensure Executor Permission - Adds Bash(python3 .plan/execute-script.py *) to global settings

python3 .plan/execute-script.py plan-marshall:tools-permission-sync:marketplace-sync ensure-executor \
  --target global

Error Handling

All operations return JSON with error details:

{
  "error": "Settings file not found: /path/to/settings.json",
  "success": false
}