openobserve/opencode.ci.jsonc

{
  // ci-full, loaded from the trusted base checkout: keep in step with opencode.jsonc except agent permissions (file tools, shell allowlist, no prompts).
  "$schema": "https://opencode.ai/config.json",

  // Nothing here may reach into the PR tree: no `instructions`, no `skills`, no plugins.
  "update": "disable",
  "share": "disabled",
  "snapshots": false,
  // LSP servers would build the PR (rust-analyzer runs build scripts and proc macros).
  "lsp": false,
  "formatter": false,

  // Policies refuse every other provider, including the bundled free ones; a review talks to one endpoint only.
  "policies": [
    { "action": "provider.use", "resource": "*", "effect": "deny" },
    { "action": "provider.use", "resource": "anthropic-review", "effect": "allow" }
  ],

  "providers": {
    "anthropic-review": {
      "name": "Anthropic (review)",
      // Bundled in the opencode binary; its default endpoint is https://api.anthropic.com/v1.
      "package": "@opencode/ai/providers/anthropic",
      // Not ANTHROPIC_API_KEY, so no other provider opencode knows about can pick the key up.
      "env": ["ANTHROPIC_REVIEW_API_KEY"],
      "models": {
        "claude-sonnet-5-5": {
          "name": "Claude Sonnet 5.5",
          // REVIEW_MODEL_VARIANT and REVIEW_COORDINATOR_VARIANT pick one; opencode sends adaptive thinking and "output_config": { "effort": "<id>" }.
          "variants": [
            { "id": "low", "settings": { "thinking": { "type": "adaptive" }, "effort": "low" } },
            { "id": "medium", "settings": { "thinking": { "type": "adaptive" }, "effort": "medium" } },
            { "id": "high", "settings": { "thinking": { "type": "adaptive" }, "effort": "high" } },
            { "id": "xhigh", "settings": { "thinking": { "type": "adaptive" }, "effort": "xhigh" } },
            { "id": "max", "settings": { "thinking": { "type": "adaptive" }, "effort": "max" } }
          ],
          "limit": { "context": 1000000, "output": 128000 }
        }
      }
    },
    // Denied by the policy above; kept so switching back needs no new provider block.
    "deepseek-review": {
      "name": "DeepSeek (review)",
      // Bundled in the opencode binary, so nothing is installed at run time.
      "package": "@opencode/ai/providers/openai-compatible",
      "env": ["DEEPSEEK_API_KEY"],
      "settings": { "baseURL": "https://api.deepseek.com" },
      // DeepSeek reads max_tokens and returns its reasoning as reasoning_content.
      "compatibility": { "maxTokensField": "max_tokens", "reasoningField": "reasoning_content" },
      "models": {
        "deepseek-flash": {
          "name": "DeepSeek-V4.1-Flash",
          // Selected with REVIEW_MODEL_VARIANT=max; opencode sends "reasoning_effort": "max".
          "variants": [{ "id": "max", "settings": { "reasoningEffort": "max" } }],
          "limit": { "context": 1048576, "output": 393216 }
        }
      }
    }
  },

  "model": "anthropic-review/claude-sonnet-5-5",

  // Last match wins after opencode's built-in defaults, so nothing asks; the shell allowlist guards cost, not secrets (see README).
  "agents": {
    "ai-review-security": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-correctness": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-code-quality": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-performance": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-documentation": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-release": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-frontend": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-qa": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    },
    "ai-review-coordinator": {
      "mode": "primary",
      "model": "anthropic-review/claude-sonnet-5-5",
      "permissions": [
        { "action": "*", "resource": "*", "effect": "allow" },
        { "action": "webfetch", "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent", "resource": "*", "effect": "deny" },
        { "action": "question", "resource": "*", "effect": "deny" },
        { "action": "execute", "resource": "*", "effect": "deny" },
        { "action": "skill", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "*", "effect": "deny" },
        { "action": "shell", "resource": "git diff *", "effect": "allow" },
        { "action": "shell", "resource": "git log *", "effect": "allow" },
        { "action": "shell", "resource": "git show *", "effect": "allow" },
        { "action": "shell", "resource": "git blame *", "effect": "allow" },
        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git status *", "effect": "allow" },
        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
        { "action": "shell", "resource": "rg *", "effect": "allow" },
        { "action": "shell", "resource": "grep *", "effect": "allow" },
        { "action": "shell", "resource": "cat *", "effect": "allow" },
        { "action": "shell", "resource": "ls *", "effect": "allow" },
        { "action": "shell", "resource": "head *", "effect": "allow" },
        { "action": "shell", "resource": "tail *", "effect": "allow" },
        { "action": "shell", "resource": "find *", "effect": "allow" },
        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
        { "action": "shell", "resource": "wc *", "effect": "allow" },
        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
        { "action": "shell", "resource": "cat /*", "effect": "deny" },
        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
        { "action": "shell", "resource": "head /*", "effect": "deny" },
        { "action": "shell", "resource": "head * /*", "effect": "deny" },
        { "action": "shell", "resource": "head *../*", "effect": "deny" },
        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
        { "action": "shell", "resource": "tail /*", "effect": "deny" },
        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
        { "action": "shell", "resource": "grep /*", "effect": "deny" },
        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
        { "action": "shell", "resource": "rg /*", "effect": "deny" },
        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
        { "action": "shell", "resource": "sed /*", "effect": "deny" },
        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
        { "action": "shell", "resource": "wc /*", "effect": "deny" },
        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
        { "action": "shell", "resource": "*>*", "effect": "deny" }
      ]
    }
  }
}