{
  "_comment": "copse variant of tools/agent-loop/grok-permissions.json (same rules, plus Maven, pnpm, Python contract tests and the migration checker). Gitea calls only through gitea.ps1 with -Repo root/copse.",
  "mode": "dontAsk",
  "allow": [
    "Read",
    "Edit",
    "Write",
    "Glob",
    "Grep",
    "Bash(git status:*)",
    "Bash(git log:*)",
    "Bash(git show:*)",
    "Bash(git diff:*)",
    "Bash(git add:*)",
    "Bash(git commit:*)",
    "Bash(git rev-parse:*)",
    "Bash(git ls-remote:*)",
    "Bash(git ls-files:*)",
    "Bash(git grep:*)",
    "Bash(git fetch:*)",
    "Bash(git checkout:*)",
    "Bash(git push origin HEAD:refs/heads/codex/*)",
    "Bash(powershell -NoProfile -ExecutionPolicy Bypass -File C:\\Users\\74082\\.jyotisha-agent\\bin\\gitea.ps1:*)",
    "Bash(docker info:*)",
    "Bash(mvn --no-transfer-progress:*)",
    "Bash(mvn -q:*)",
    "Bash(pnpm install:*)",
    "Bash(pnpm lint:*)",
    "Bash(pnpm build:*)",
    "Bash(pnpm run:*)",
    "Bash(python -m pytest:*)",
    "Bash(python script/db/check_migrations.py:*)"
  ],
  "deny": [
    "Bash(git push --force:*)",
    "Bash(git push -f:*)",
    "Bash(git push --no-verify:*)",
    "Bash(git push origin HEAD:main:*)",
    "Bash(git push origin HEAD:refs/heads/main:*)",
    "Bash(git push origin HEAD:staging:*)",
    "Bash(git push origin HEAD:refs/heads/staging:*)",
    "Bash(git push origin main:*)",
    "Bash(git push origin staging:*)",
    "Bash(git push origin --delete:*)",
    "Bash(git config:*)",
    "Bash(git reset --hard:*)",
    "Bash(git stash:*)",
    "Read(~/.config/jyotisha-agent/**)",
    "Read(~/.git-credentials)"
  ]
}