{
  "permissions": {
    "allow": [
      "WebSearch",
      "WebFetch(domain:docs.opentakserver.io)",
      "WebFetch(domain:docs.goauthentik.io)",
      "Bash(grep -nE '^#{1,3} ' fleet-patch-audit.md)",
      "Bash(ssh *)",
      "Bash(tailscale debug *)",
      "Bash(tailscale status *)",
      "Bash(python3 -c \"import sys,json; d=json.load\\(sys.stdin\\); print\\('ControlURL:', d.get\\('Self',{}\\).get\\('ControlURL','n/a'\\) if 'Self' in d else 'no Self key'\\); [print\\(k,':',v\\) for k,v in d.items\\(\\) if 'control' in k.lower\\(\\)]\")",
      "Read(//etc/default/**)",
      "Bash(systemctl cat *)",
      "Bash(timeout 5 bash -c 'cat < /dev/null > /dev/tcp/5.189.158.149/25')",
      "Bash(dig +short vpn.echo6.co)",
      "Bash(nslookup vpn.echo6.co)",
      "Bash(timeout 5 bash -c 'cat < /dev/null > /dev/tcp/5.189.158.149/443')",
      "Bash(dig +short MX echo6.co)",
      "Bash(dig +short mail.echo6.co)",
      "Bash(dig +short A mail.echo6.co)",
      "Bash(dig +short TXT echo6.co)",
      "Bash(gh auth *)",
      "Bash(git clone *)",
      "Bash(git *)",
      "Bash(scp zvx@192.168.1.104:/opt/central/sql/migrations/036_add_avalanche_org_adapter.sql /tmp/claude-1000/-home-zvx-projects--ref/0b576082-6442-481f-ad79-12a39da62765/scratchpad/central/sql/migrations/036_add_avalanche_org_adapter.sql)",
      "Bash(gh pr create --title 'v0.14.6: commit orphaned migration 036 + fix stale README/version metadata' --body ' *)",
      "Bash(gh pr create --title 'eonet: bypass bbox filter for global disaster feed' --body ' *)",
      "Read(//tmp/central-clone/**)",
      "Bash(gh pr create --title 'supervisor: shrink sat dedup window + WAL cursors.db to cut CPU/IO' --body ' *)",
      "Bash(shellcheck --version)",
      "Read(//tmp/central-deploy-work/**)",
      "Read(//tmp/central-deploy-work/scripts/**)",
      "Bash(chmod +x /tmp/central-deploy-work/scripts/deploy.sh)",
      "Bash(bash -n /tmp/central-deploy-work/scripts/deploy.sh)",
      "Bash(gh pr create --title 'scripts/deploy.sh: one-command tag-based deploy with pre-flight backup + verify' --body ' *)",
      "Skill(update-config)",
      "Edit",
      "Write",
      "Read",
      "Glob",
      "Grep",
      "Bash(sudo *)",
      "Bash(psql *)",
      "Bash(systemctl *)",
      "Bash(journalctl *)",
      "Bash(curl *)",
      "Bash(uv *)",
      "Bash(pg_dump *)",
      "Bash(python3 *)",
      "Bash(scp *)",
      "Bash(gh *)"
    ],
    "defaultMode": "bypassPermissions"
  }
}