Repository navigation
feat(project-rules): add path-scoped project rules plugin (CLAUDE.md + .zcode/rules) - #143
Open
dominiclafleur wants to merge 1 commit into
Open
dominiclafleur wants to merge 1 commit into
dominiclafleur wants to merge 1 commit into
Conversation
dominiclafleur
requested review from
jacksonliuyn and
panda920
as code owners
October 30, 2026 14:54
…+ .zcode/rules) Community plugin answering feedback#209, zai-org#156, #931 while native support is evaluated. Hooks-based stopgap: SessionStart injects CLAUDE.md (when no AGENTS.md exists) and path-less rules; PreToolUse (Read/Edit/Write) injects .zcode/rules/*.md whose frontmatter paths globs match the touched file, once per session per content. No dependencies. Security-hardened (out-of-project symlinks skipped, linear glob matcher, inode-verified locks, per-user 0600 state, stdin and byte budgets); 45 tests including exploit repros. Standard plugin (no UI surfaces).
dominiclafleur
force-pushed
the
feat/project-rules
branch
from
October 30, 2026 15:29
14d1d62 to
931c105
Compare
Collaborator
|
✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plugin type
ui.surfaces)What it does
ZCode only auto-loads
AGENTS.md(apps/zcode-cli/packages/adapters/src/context/index.ts,DEFAULT_PRIORITY_FILES). This plugin gives migrating and multi-tool users their per-path instructions back:.zcode/rules/*.mdrule files with optional frontmatterpaths:globs (supports*,**,?,{a,b}, gitignore-style bare patterns, Cursor-styleglobs:key). A rule is injected as model-visible context when a Read/Edit/Write call touches a matching file, once per session per content.CLAUDE.mdfrom the project root on SessionStart when noAGENTS.mdexists.Community context: this is a hooks-based stopgap answering open requests zai-org/feedback#209 (path-scoped rules), #156 (rules auto-loading / Claude Code migration), and #931 (project instruction discovery) while native support is evaluated; #209 itself notes hooks are a compromise for rule text, so if/when native support lands this plugin can retire.
Components
hooks/hooks.json,noderuntime, zero npm dependencies.Side effects and safety
.zcode/rules/*.mdand rootCLAUDE.md/AGENTS.mdexistence; writes only its own state file. Security-hardened after adversarial review: symlinks resolving outside the project are skipped (exfiltration repro tested), linear glob matcher (no regex blowup; differential-tested on 500k random inputs), lock files verified by inode before unlink (undeletable-lock spin repro tested), per-user state dir with 0600 temp writes, 1 MiB stdin cap, per-file/aggregate byte budgets, 30 KB stdout cap under the hook limit.Testing
plugins marketplace add <dir>+plugins install project-rules@project-rules-marketplace); hooks take effect on new sessions per the frozen hook-snapshot rule; hook-level e2e verified directly (SessionStart injection; PreToolUse injection with matching glob and dedupe).node test/test.mjs, no framework) including the two exploit repros, lock races, malformed state, caps, and EN/CN README-vs-code consistency checks. Marketplacevalidate.pypasses (53 plugins). Note:build_dist.pycurrently fails on cleanmainas well (excalidraw: incomplete build; run pnpm build first), unrelated to this addition.Licensing
MIT. No third-party code.