{
  "_comment": "Allowlist for unattended Grok. mode=dontAsk denies anything not listed. Rule syntax must be confirmed against `grok --help` on install (install-grok.ps1 step 0); fix the rules here, never switch to bypassPermissions.",
  "mode": "dontAsk",
  "allow": [
    "Read",
    "Edit",
    "Write",
    "Glob",
    "Grep",
    "Bash(git status:*)",
    "Bash(git log:*)",
    "Bash(git show:*)",
    "Bash(git diff:*)",
    "Bash(git add:*)",
    "Bash(git commit:*)",
    "Bash(git rev-parse:*)",
    "Bash(git ls-remote:*)",
    "Bash(git ls-files:*)",
    "Bash(git grep:*)",
    "Bash(git fetch:*)",
    "Bash(git push origin HEAD:refs/heads/codex/*)",
    "Bash(npm run lint:*)",
    "Bash(npm run test:db:*)",
    "Bash(node node_modules/tsx/dist/cli.mjs --test:*)",
    "Bash(frontend\\node_modules\\.bin\\tsc:*)",
    "Bash(.venv\\Scripts\\python -m pytest:*)",
    "Bash(docker info:*)"
  ],
  "deny": [
    "Bash(git push --force:*)",
    "Bash(git push -f:*)",
    "Bash(git push --no-verify:*)",
    "Bash(git config:*)",
    "Bash(git reset --hard:*)",
    "Bash(git stash:*)",
    "Read(~/.config/jyotisha-agent/**)",
    "Read(~/.git-credentials)"
  ]
}