feat(permissions): add kiro-scoped override for shell auto-trust flags, aws services, and web_fetch domain trust

[dyoshikawa]

Summary

Implements item 2 of #2132: a tool-scoped kiro permissions override namespace (per #2127) for Kiro's agent-config toolsSettings knobs that have no canonical allow/ask/deny category. (Item 1 — mapping the canonical grep/glob categories — already shipped in #2170.)

Scope

The override authors the Kiro-specific surfaces that live in the agent config (.kiro/agents/<name>.json) this permissions translator already writes:

• Shell auto-trust flags — toolsSettings.shell.autoAllowReadonly / denyByDefault
• aws built-in tool — toolsSettings.aws.allowedServices / deniedServices (+ autoAllowReadonly)
• web_fetch domain trust — toolsSettings.web_fetch.trusted / blocked (regex host patterns; Kiro documents these for web_fetch only — web_search has no domain-trust surface)

Example:

{
  "permission": { "bash": { "git *": "allow" } },
  "kiro": {
    "toolsSettings": {
      "shell": { "autoAllowReadonly": true },
      "aws": { "allowedServices": ["s3"], "deniedServices": ["eks"] },
      "web_fetch": { "trusted": [".*github\\.com.*"] }
    }
  }
}

Behavior

• Generate — the override is deep-merged per toolsSettings key (override wins at the leaf), so authoring shell.autoAllowReadonly keeps the canonical-generated shell.allowedCommands. Non-canonical shell flags already present in the file are preserved across regenerate even without an override (previously a regenerate clobbered the whole shell object). Prototype-pollution keys are guarded before being used as object keys.
• Import — the Kiro-specific surfaces are lifted verbatim into the kiro override so they round-trip and become authorable; the canonical shell.{allowed,denied}Commands, read/write/grep/glob paths, and web_fetch/web_search allowedTools toggles are unchanged.
• looseObject at every level, so future Kiro toolsSettings fields pass through verbatim.

Primary-source verification

All shapes were verified against Kiro's official docs (rendered via a browser since kiro.dev is a SPA):

• Shell flags & aws services & web_fetch trusted/blocked: https://kiro.dev/docs/cli/reference/built-in-tools/
• Agent config schema & path: https://kiro.dev/docs/cli/custom-agents/configuration-reference/

Notable corrections vs. the issue's inferred shapes: the web domain arrays are regex patterns, not plain domains, and exist for web_fetch only.

Design decision (out of scope, deferred)

Kiro's MCP autoApprove / disabledTools lists — listed among the issue's proposed override keys — are not modeled here. They live in a separate file (.kiro/settings/mcp.json, under mcpServers.<name>), not the agent config this translator writes, and reconciling them with the canonical mcp__* allow/ask/deny model is a distinct design question (also flagged by the maintainer on the issue). Bundling a second-file write into the permissions override would be scope creep; it can be re-filed as its own focused issue.

Tests & docs

New tests cover authoring from the override, extraction on import, omission when absent, shell-flag preservation across regenerate, and a full round-trip. docs/reference/file-formats.md (+ synced skills/rulesync/) gains a "Kiro-only override" note including the MCP out-of-scope rationale.

Closes #2132

🤖 Generated with Claude Code

[dyoshikawa]

@dyoshikawa Thank you!