{
  "permissions": {
    "allow": [
      "Bash(go build *)",
      "Bash(go test *)",
      "Bash(go vet *)",
      "Bash(go run *)",
      "Bash(go mod *)",
      "Bash(go get *)",
      "Bash(go install *)",
      "Bash(go env *)",
      "Bash(go tool *)",
      "Bash(go doc *)",
      "Bash(go list *)",
      "Bash(go version *)",
      "Bash(gofmt *)",
      "Bash(gofumpt *)",
      "Bash(golangci-lint run *)",
      "Bash(golangci-lint --version)",
      "Bash(./bin/manager* --version)",
      "Bash(make -n *)",
      "Bash(make manifests *)",
      "Bash(make test *)",
      "Bash(make test-integration-kvm *)",
      "Bash(make run-dev *)",
      "Bash(make docker-build *)",
      "Bash(make deploy *)",
      "Bash(make kvm-ssh-secret *)",
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git branch)",
      "Bash(git branch -a)",
      "Bash(git branch --show-current)",
      "Bash(git add *)",
      "Bash(git commit *)",
      "Bash(git fetch *)",
      "Bash(git pull *)",
      "Bash(git worktree list *)",
      "Bash(git config --get *)",
      "Bash(git config --list *)",
      "Bash(git merge-tree *)",
      "Bash(git ls-remote *)",
      "Bash(git -c credential.helper='!f\\(\\) { echo username=kacerr; echo \"password=$\\(tr -d \"[:space:]\" < ~/.config/gitea-token\\)\"; }; f' push origin feat/kvm-provider)",
      "Bash(git -c credential.helper='!f\\(\\) { echo username=kacerr; echo \"password=$\\(tr -d \"[:space:]\" < ~/.config/gitea-token\\)\"; }; f' push -q origin feat/kvm-provider)",
      "Bash(git -c credential.helper='!f\\(\\) { echo username=kacerr; echo \"password=$\\(tr -d \"[:space:]\" < ~/.config/gitea-token\\)\"; }; f' push -u origin feat/kvm-provider)",
      "Bash(tea pr create *)",
      "Bash(tea pr list *)",
      "Bash(curl -sL https://go.dev/dl/?mode=json)",
      "Bash(curl -s --max-time 10 https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/*)",
      "Bash(curl -s --max-time 10 'https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/*')",
      "Bash(curl -sI --max-time 10 https://gitea.home.hrajfrisbee.cz/v2/kacerr/egress-proxies-operator/*)",
      "Bash(curl -s -H \"Authorization: token $\\(tr -d '[:space:]' < ~/.config/gitea-token\\)\" https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/pulls/5)",
      "Bash(kubectl get *)",
      "Bash(kubectl wait *)",
      "Bash(kubectl kustomize *)",
      "Bash(kubectl apply *)",
      "Bash(kubectl run *)",
      "Bash(kubectl config current-context)",
      "Bash(kubectl config get-contexts *)",
      "Bash(kubectl config view *)",
      "Bash(kubectl -n egress-proxies-operator-system get *)",
      "Bash(kubectl -n egress-proxies-operator-system logs *)",
      "Bash(kubectl -n egress-proxies-operator-system rollout status *)",
      "Bash(kubectl -n egress-proxies-operator-system rollout restart *)",
      "Bash(kind get *)",
      "Bash(kind load *)",
      "Bash(kind version *)",
      "Bash(docker version *)",
      "Bash(docker info *)",
      "Bash(docker image ls *)",
      "Bash(docker image inspect *)",
      "Bash(docker manifest inspect *)",
      "Bash(docker history *)",
      "Bash(docker save *)",
      "Bash(docker run *)",
      "Bash(docker exec *)",
      "Bash(virsh -c qemu:///system list *)",
      "Bash(virsh -c qemu:///system net-list *)",
      "Bash(virsh -c qemu:///system net-dumpxml *)",
      "Bash(virsh -c qemu:///system pool-list *)",
      "Bash(virsh -c qemu:///system pool-dumpxml *)",
      "Bash(virsh -c qemu:///system vol-list *)",
      "Bash(ssh -i ~/.ssh/proxy-operator_ed25519 * novakj@beelink.tail8c69c.ts.net *)",
      "Bash(ip -br *)",
      "Bash(getent hosts *)",
      "Bash(tailscale status *)",
      "Bash(python3 *)",
      "Bash(grep *)",
      "Bash(echo \"*$?\")",
      "Bash(date *)",
      "Bash(env)",
      "Bash(command -v *)",
      "Bash(cat >> *)",
      "Bash(tar -tf *)",
      "Bash(bash -n *)",
      "Bash(mkdir -p docs/*)",
      "Read(//home/novakj/**)",
      "Read(//Users/jan.novak/.claude/**)",
      "Read(//tmp/**)",
      "Read(//private/tmp/**)",
      "Read(//etc/**)",
      "Read(//dev/**)",
      "Read(//run/libvirt/**)",
      "WebSearch",
      "WebFetch(domain:gitlab.com)",
      "WebFetch(domain:bugs.debian.org)",
      "WebFetch(domain:tracker.debian.org)",
      "WebFetch(domain:cloud.debian.org)",
      "WebFetch(domain:alioth-lists.debian.net)",
      "WebFetch(domain:www.mail-archive.com)",
      "WebFetch(domain:forum.proxmox.com)",
      "Bash(curl -s --max-time 10 'https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/pulls?state=open')",
      "Bash(python3 -c 'import json,sys; [print\\(p[\"number\"], p[\"head\"][\"ref\"], \"->\", p[\"base\"][\"ref\"], \"|\", p[\"title\"]\\) for p in json.load\\(sys.stdin\\)]')",
      "Bash(curl -s --max-time 10 'https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/pulls/5')",
      "Bash(python3 -c 'import json,sys; p=json.load\\(sys.stdin\\); print\\(p[\"state\"], \"merged=\", p[\"merged\"], p.get\\(\"merge_commit_sha\"\\)\\)')",
      "Read(//home/novakj/srv/egress-proxies-operator-simplify/origin/**)",
      "Bash(echo \"exit=$?\")",
      "Read(//home/novakj/srv/egress-proxies-operator-simplify/**)",
      "Bash(git -C /home/novakj/srv/egress-proxies-operator-simplify diff 82eeeef -- internal/controller/proxy_controller.go internal/provider/kvm/errors.go)",
      "Bash(git switch *)",
      "Bash(git -C /home/novakj/srv/egress-proxies-operator-simplify add -A)",
      "Bash(git -C /home/novakj/srv/egress-proxies-operator-simplify commit -q -m 'WIP: uncommitted simplify-pass edits preserved before worktree removal *)",
      "Bash(git -C /home/novakj/srv/egress-proxies-operator-simplify log --oneline -1)",
      "Bash(git worktree *)",
      "Bash(git branch *)",
      "Bash(git stash *)",
      "Bash(make generate *)",
      "Bash(bin/kustomize build *)",
      "Bash(grep -Ev \"^\\\\s*$\")",
      "Bash(make lint *)",
      "Bash(command -v kind docker)",
      "Bash(bin/golangci-lint version *)",
      "Bash(make test-e2e *)",
      "Bash(echo \"make test-e2e exit=$?\")",
      "Bash(ls \"$\\(go env GOMODCACHE\\)/golang.org/\")",
      "Bash(ls \"$\\(go env GOMODCACHE\\)/golang.org/toolchain@\"* -d)",
      "Bash(ps -eo pid,ppid,etime,args)",
      "Bash(kubectl config *)",
      "Bash(git commit -q -m 'Plan the provider blueprint document *)",
      "Bash(grep -nE '^#{1,3} ' docs/architecture.md; echo ---; sed -n '/Implemented providers/,/^## /p' README.md | head -30; echo ---; sed -n 140,180p config/manager/manager.yaml; echo ---; cat Dockerfile; echo ---; ls -a | grep -i golangci; echo ---; grep -nE 'Placement|placement|Region|Zone|MachineType|Image ' api/v1alpha1/proxy_types.go | head -40; echo ---; grep -nE 'Type|type' api/v1alpha1/providerhealth_types.go | head -20; echo ---; grep -n -i 'placement' docs/api.md | head; echo ---; grep -nE 'WithTimeout|Deadline|timeout' internal/controller/proxy_controller.go internal/gc/gc.go internal/providerhealth/monitor.go | head -20; echo ---; cat .gitea/workflows/build.yaml | sed -n 1,60p)",
      "WebFetch(domain:pve.proxmox.com)",
      "Bash(git -c credential.helper='!f\\(\\) { echo username=kacerr; echo \"password=$\\(tr -d \"[:space:]\" < ~/.config/gitea-token\\)\"; }; f' push -u origin feat/provider-blueprint)",
      "Bash(curl -s -H \"Authorization: token $\\(tr -d '[:space:]' < ~/.config/gitea-token\\)\" \"https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/pulls?state=open\")",
      "Bash(curl -s -H \"Authorization: token $\\(tr -d '[:space:]' < ~/.config/gitea-token\\)\" \"https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/pulls/7\")",
      "Bash(curl -s -X PATCH -H \"Authorization: token $\\(tr -d '[:space:]' < ~/.config/gitea-token\\)\" -H 'Content-Type: application/json' -d @/tmp/claude-1000/-home-novakj-srv-egress-proxies-operator/7662ab9d-4540-4676-a943-0874ac6b081d/scratchpad/pr7.json \"https://gitea.home.hrajfrisbee.cz/api/v1/repos/kacerr/egress-proxies-operator/pulls/7\")",
      "Bash(bin/golangci-lint run *)",
      "Bash(awk '/^## The image cache/,/^## [^T]/' docs/kvm-provider.md)",
      "Bash(awk '/^#+ .*Step 11/,0' docs/plans/2026-09-16-1333-kvm2-provider.md)",
      "Bash(sort -t: -k2 -u)",
      "Bash(awk '/kvm2/&&/^#/{f=1} f' docs/testing.md)",
      "Bash(awk -F'\"' '{print $2}')",
      "Bash(sed -n '/targets:/,/type: object/p' config/crd/bases/*providerhealths.yaml | sed -n 1,45p)",
      "Bash(ssh -i ~/.ssh/proxy-operator_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=10 -o UserKnownHostsFile=~/.ssh/kvm_known_hosts -o StrictHostKeyChecking=yes novakj@beelink 'hostname; id -un; virsh -c qemu:///system version; virsh -c qemu:///system pool-list --all; virsh -c qemu:///system list --all')",
      "Bash(awk '{print $1, $2}' ~/.ssh/kvm_known_hosts)",
      "Bash(ssh-keygen -F beelink -f ~/.ssh/kvm_known_hosts)",
      "Bash(ssh -i ~/.ssh/proxy-operator_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=10 -o UserKnownHostsFile=~/.ssh/kvm_known_hosts -o StrictHostKeyChecking=yes novakj@beelink.tail8c69c.ts.net 'hostname; id -un; id -Gn; virsh -c qemu:///system version; virsh -c qemu:///system pool-list --all --details; virsh -c qemu:///system list --all; command -v qemu-img')",
      "Bash(qemu-img --version)",
      "Bash(./probe)",
      "Bash(./probe -proxyrcv 8192)",
      "Bash(./probe -small)",
      "Bash(sysctl net.ipv4.tcp_wmem net.ipv4.tcp_retries2)",
      "Bash(GOFLAGS=-mod=mod GOPROXY=off go build -o probe .)",
      "Bash(./probe -clientsnd 131072 -proxyrcv 8192)",
      "Bash(truncate -s 64M gpt.raw)",
      "Bash(sfdisk -l gptshort.raw)",
      "Bash(sgdisk -v gptshort.raw)",
      "Bash(mkdir -p /tmp/claude-1000/-home-novakj-srv-egress-proxies-operator/8db56daf-938c-48b8-8a17-084f3e1dea44/scratchpad)",
      "Bash(curl -sS -m 30 -o storage_driver.c https://raw.githubusercontent.com/libvirt/libvirt/v11.6.0/src/storage/storage_driver.c)",
      "Bash(GOFLAGS=-mod=mod GOPROXY=off go vet ./...)",
      "Bash(GOFLAGS=-mod=mod GOPROXY=off go test -count=1 -run TestLeak -v . -args -n 1000 -transport unix)",
      "Bash(curl -sS -m 30 -o storage_util.c https://raw.githubusercontent.com/libvirt/libvirt/v11.6.0/src/storage/storage_util.c)",
      "Bash(awk '/^virStorageBackendVolUploadLocal/,/^}/' storage_util.c)",
      "Bash(export GOFLAGS=-mod=mod GOPROXY=off)",
      "Bash(awk '/WARNING: DATA RACE/{c++} c==1' race_ssh.log)",
      "Bash(kubectl version *)",
      "Bash(timeout 5 kubectl cluster-info)"
    ],
    "additionalDirectories": [
      "/tmp",
      "/home/novakj/srv/egress-proxies-operator",
      "/home/novakj/srv/egress-proxies-operator/config/crd/bases"
    ]
  }
}