{
  "permissions": {
    "allow": [
      "WebSearch",
      "WebFetch(domain:docs.opentakserver.io)",
      "WebFetch(domain:docs.goauthentik.io)",
      "Bash(grep -nE '^#{1,3} ' fleet-patch-audit.md)",
      "Bash(ssh *)",
      "Bash(tailscale debug *)",
      "Bash(tailscale status *)",
      "Bash(python3 -c \"import sys,json; d=json.load\\(sys.stdin\\); print\\('ControlURL:', d.get\\('Self',{}\\).get\\('ControlURL','n/a'\\) if 'Self' in d else 'no Self key'\\); [print\\(k,':',v\\) for k,v in d.items\\(\\) if 'control' in k.lower\\(\\)]\")",
      "Read(//etc/default/**)",
      "Bash(systemctl cat *)",
      "Bash(timeout 5 bash -c 'cat < /dev/null > /dev/tcp/5.189.158.149/25')",
      "Bash(dig +short vpn.echo6.co)",
      "Bash(nslookup vpn.echo6.co)",
      "Bash(timeout 5 bash -c 'cat < /dev/null > /dev/tcp/5.189.158.149/443')",
      "Bash(dig +short MX echo6.co)",
      "Bash(dig +short mail.echo6.co)",
      "Bash(dig +short A mail.echo6.co)",
      "Bash(dig +short TXT echo6.co)"
    ]
  }
}