Add Agent Permission Policy schema (.agents/permissions.json)

[Mearman]

Summary

Adds the Agent Permission Policy schema for .agents/permissions.json and .agents/permissions.local.json files.

This is a cross-agent permission policy format for AI coding agents (Claude Code, Pi, OpenCode, Codex, Cursor, etc.). The schema defines what tools agents may use, under what conditions, and how subagents are constrained.

• Self-hosted schema: raw.githubusercontent.com/Mearman/agent-permissions/main/agent-permissions.schema.json
• npm package: agent-perms — Zod schemas, validators, and bidirectional codecs for each agent
• Repository: Mearman/agent-permissions

File matches

• **/.agents/permissions.json — team-shared policy (committed to git)
• **/.agents/permissions.local.json — personal overrides (gitignored)

Schema highlights

• Deny-first evaluation (deny rules short-circuit before allow)
• Compatible with Claude Code permission syntax (Tool(pattern), prefix:*, wildcards)
• Conditional rules with when.cwd / when.branch conditions
• MCP tool wildcards (mcp__server, mcp__*__tool*)
• Agent delegation controls (subagent constraints, per-agent overrides)
• Sandbox and network configuration
• Named permission profiles

Validation

• node cli.js check passes ✓

[github-actions]

Thanks for the PR!

This section of the codebase is owned by @madskristensen and @hyperupcall - if they write a comment saying "LGTM" then it will be merged.

[Copilot]

Pull request overview

Adds a new SchemaStore catalog entry for the Agent Permission Policy format so editors/tools can associate .agents/permissions.json and .agents/permissions.local.json files with the upstream, self-hosted JSON Schema.

Changes:

• Registered “Agent Permission Policy” in the schema catalog with file patterns for shared and local override policy files.
• Pointed the catalog entry to the upstream hosted schema URL.

[Mearman]

The entry is placed directly before "AgentCore CLI" (line 9722), which is the correct alphabetical position — "Agent Permission Policy" < "AgentCore CLI". The catalog has hundreds of existing alphabetical violations throughout, and this placement is correct relative to its immediate neighbours.