{
  "permissions": {
    "allow": [
      "Bash(gh auth status *)",
      "Bash(gh browse *)",
      "Bash(gh cache list *)",
      "Bash(gh codespace list *)",
      "Bash(gh codespace logs *)",
      "Bash(gh codespace view *)",
      "Bash(gh extension list *)",
      "Bash(gh gist list *)",
      "Bash(gh gist view *)",
      "Bash(gh issue list *)",
      "Bash(gh issue status *)",
      "Bash(gh issue view *)",
      "Bash(gh label list *)",
      "Bash(gh org list *)",
      "Bash(gh pr checks *)",
      "Bash(gh pr diff *)",
      "Bash(gh pr list *)",
      "Bash(gh pr status *)",
      "Bash(gh pr view *)",
      "Bash(gh project item-list *)",
      "Bash(gh project list *)",
      "Bash(gh project view *)",
      "Bash(gh release download *)",
      "Bash(gh release list *)",
      "Bash(gh release view *)",
      "Bash(gh repo list *)",
      "Bash(gh repo view *)",
      "Bash(gh ruleset list *)",
      "Bash(gh ruleset view *)",
      "Bash(gh run download *)",
      "Bash(gh run list *)",
      "Bash(gh run view *)",
      "Bash(gh run watch *)",
      "Bash(gh search code *)",
      "Bash(gh search commits *)",
      "Bash(gh search issues *)",
      "Bash(gh search prs *)",
      "Bash(gh search repos *)",
      "Bash(gh secret list *)",
      "Bash(gh ssh-key list *)",
      "Bash(gh status *)",
      "Bash(gh variable list *)",
      "Bash(gh workflow list *)",
      "Bash(gh workflow view *)",
      "Bash(npm install)",
      "Bash(npm run test*)",
      "Bash(npm run lint*)",
      "Bash(npm run format*)",
      "Bash(npm run build*)",
      "Bash(npm run type-check*)"
    ],
    "deny": ["Read(.env)"]
  },
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "excludedCommands": ["gh:*", "npm run *", "git push *"]
  }
}