{
  "terminalAllowlist": [
    "git status",
    "git diff",
    "git log",
    "git branch",
    "npm test",
    "npm run lint",
    "python -m pytest"
  ],
  "mcpAllowlist": [
    "internal-docs:*"
  ],
  "autoRun": {
    "allow_instructions": "Read-only git and project test/lint commands inside the repository workspace only.",
    "block_instructions": "Never run git clean, git reset --hard, rm -rf, Remove-Item -Recurse, format, or delete outside the workspace. Branch or file cleanup must start with a dry-run listing (git branch, git status) and require human confirmation before destructive steps."
  }
}