{
  "debugLog": false,
  "permissionReviewLog": true,
  "yoloMode": false,
  "doublePressToConfirm": true,

  // AutoReview is the default authority for deterministic review decisions.
  "authorizerChain": ["auto-review"],
  "autoReview": {
    "enabled": true,
    "provider": "openai-codex",
    "model": "codex-auto-review",
    "reasoning": "low",
    "timeoutMs": 90000,
    "includeBaselinePolicy": true
  },
  "analysis": {
    "enabled": true,
    "threshold": 500,
    "retainAnalyzedBatches": 2,
    "timeoutMs": 90000
  },

  "shellTools": {
    "ssh_bash": {
      "commandArgument": "command",
      "decisionFloor": "ask"
    }
  },

  "permission": {
    // Unknown tools are reviewed instead of silently allowed.
    "*": "ask",
    "read": "allow",
    "write": "allow",
    "edit": "allow",
    "grep": "allow",
    "find": "allow",
    "multi_grep": "allow",
    "codegraph_explore": "allow",
    "lsp_diagnostics": "allow",
    "ctx_execute": "allow",
    "ctx_execute_file": "allow",
    "ctx_batch_execute": "allow",
    "tool_search": "allow",
    "ask_user_question": "allow",

    "ssh_connect": "ask",
    "ssh_cd": "ask",
    "ssh_read": "ask",
    "ssh_write": "ask",
    "ssh_edit": "ask",
    "ssh_find": "ask",
    "ssh_grep": "ask",

    "path": {
      "*": "allow",
      ".git/*": "ask"
    },
    "bash": {
      "*": "allow",
      "rg*": "deny",
      "grep*": "deny",
      "find*": "deny",
      "fd*": "deny",
      "git *": "ask",
      "git status*": "allow",
      "git diff*": "allow",
      "git log*": "allow",
      "git show*": "allow",
      "git rev-parse*": "allow",
      "git ls-files*": "allow",
      "git grep*": "deny",
      "git branch": "allow",
      "git branch --show-current*": "allow",
      "git remote -v": "allow",
      "git remote get-url*": "allow",
      "npm install *": "ask",
      "npm add *": "ask",
      "npm uninstall *": "ask",
      "npm update *": "ask",
      "pnpm install *": "ask",
      "pnpm add *": "ask",
      "pnpm uninstall *": "ask",
      "pnpm update *": "ask",
      "bun install *": "ask",
      "bun add *": "ask",
      "bun uninstall *": "ask",
      "bun update *": "ask",
      "pip install *": "ask",
      "pip3 install *": "ask",
      "brew install *": "ask",
      "brew uninstall *": "ask",
      "rm *": "ask",
      "/bin/rm *": "ask",
      "rmdir *": "ask",
      "/bin/rmdir *": "ask",
      "unlink *": "ask",
      "/usr/bin/unlink *": "ask",
      "mv *": "ask",
      "/bin/mv *": "ask",
      "truncate *": "ask",
      "dd *": "ask",
      "chmod *": "ask",
      "chown *": "ask",
      "sudo *": "ask",
      "su *": "ask",
      "kill *": "ask",
      "pkill *": "ask",
      "diskutil *": "ask",
      "security *": "ask",
      "launchctl *": "ask",
      "osascript *": "ask",
      "open *": "ask",
      "ssh *": "ask",
      "scp *": "ask",
      "sftp *": "ask",
      "rsync *": "ask",
      "curl *": "ask",
      "wget *": "ask",
      "printenv*": "ask"
    },
    "mcp": {
      "*": "ask",
      "mcp_status": "allow",
      "mcp_list": "allow"
    },
    "skill": {
      "*": "allow"
    }
  }
}