{
  "$ref": "#/definitions/GuardrailsConfig",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "definitions": {
    "AllowedPath": {
      "anyOf": [
        {
          "additionalProperties": false,
          "properties": {
            "kind": {
              "const": "file",
              "type": "string"
            },
            "path": {
              "type": "string"
            }
          },
          "required": [
            "kind",
            "path"
          ],
          "type": "object"
        },
        {
          "additionalProperties": false,
          "properties": {
            "kind": {
              "const": "directory",
              "type": "string"
            },
            "path": {
              "type": "string"
            }
          },
          "required": [
            "kind",
            "path"
          ],
          "type": "object"
        }
      ],
      "description": "A path grant with an explicit kind.\n\n`file` matches the exact path only. `directory` matches the directory itself and any descendant (boundary/prefix match).\n\nThis replaces the previous trailing-slash convention on a flat `string[]`, where the kind was inferred from whether a path ended in `/`."
    },
    "AuditConfig": {
      "additionalProperties": false,
      "properties": {
        "enabled": {
          "description": "Append blocked/prompted/risk events to a JSONL audit log. Default true.",
          "type": "boolean"
        },
        "path": {
          "description": "Audit log file path. Supports ~/ for home.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "DangerousPattern": {
      "additionalProperties": false,
      "description": "Permission gate pattern. When regex is false (default), the pattern is matched as substring against the raw command string. When regex is true, uses full regex against the raw string.",
      "properties": {
        "description": {
          "description": "Optional description surfaced to the agent when the pattern triggers (e.g. auto-deny reason).",
          "type": "string"
        },
        "pattern": {
          "type": "string"
        },
        "regex": {
          "type": "boolean"
        }
      },
      "required": [
        "description",
        "pattern"
      ],
      "type": "object"
    },
    "GuardrailsConfig": {
      "additionalProperties": false,
      "properties": {
        "$schema": {
          "description": "JSON Schema URL for editor autocomplete and validation. Added automatically when Guardrails writes the file.",
          "type": "string"
        },
        "applyBuiltinDefaults": {
          "description": "When true, include Guardrails built-in policy rules before user rules are merged.",
          "type": "boolean"
        },
        "audit": {
          "$ref": "#/definitions/AuditConfig",
          "description": "Audit log of guardrails decisions."
        },
        "enabled": {
          "description": "Enable or disable all Guardrails checks.",
          "type": "boolean"
        },
        "features": {
          "additionalProperties": false,
          "description": "Enable or disable individual Guardrails feature extensions.",
          "properties": {
            "pathAccess": {
              "type": "boolean"
            },
            "permissionGate": {
              "type": "boolean"
            },
            "policies": {
              "type": "boolean"
            },
            "workspaceRoots": {
              "type": "boolean"
            }
          },
          "type": "object"
        },
        "onboarding": {
          "additionalProperties": false,
          "description": "Tracks whether the setup wizard has been completed. Usually managed by Guardrails.",
          "properties": {
            "completed": {
              "description": "Whether onboarding is complete.",
              "type": "boolean"
            },
            "completedAt": {
              "description": "ISO timestamp for when onboarding completed.",
              "type": "string"
            }
          },
          "type": "object"
        },
        "pathAccess": {
          "$ref": "#/definitions/PathAccessConfig",
          "description": "Outside-workspace path access settings."
        },
        "permissionGate": {
          "additionalProperties": false,
          "description": "Dangerous bash command detection and confirmation settings.",
          "properties": {
            "allowedPatterns": {
              "description": "Command patterns that bypass dangerous command prompts.",
              "items": {
                "$ref": "#/definitions/PatternConfig"
              },
              "type": "array"
            },
            "autoDenyPatterns": {
              "description": "Command patterns that are always blocked without prompting.",
              "items": {
                "$ref": "#/definitions/PatternConfig"
              },
              "type": "array"
            },
            "customPatterns": {
              "description": "If set, replaces the default dangerous command patterns entirely.",
              "items": {
                "$ref": "#/definitions/DangerousPattern"
              },
              "type": "array"
            },
            "patterns": {
              "description": "Additional dangerous command patterns.",
              "items": {
                "$ref": "#/definitions/DangerousPattern"
              },
              "type": "array"
            },
            "requireConfirmation": {
              "description": "When true, prompt before running dangerous commands. When false, only warn.",
              "type": "boolean"
            }
          },
          "type": "object"
        },
        "policies": {
          "additionalProperties": false,
          "description": "File protection policies.",
          "properties": {
            "rules": {
              "description": "Named policy rules. Rules with the same id override earlier rules across scopes.",
              "items": {
                "$ref": "#/definitions/PolicyRule"
              },
              "type": "array"
            }
          },
          "type": "object"
        },
        "workspaceRoots": {
          "$ref": "#/definitions/WorkspaceRootsConfig",
          "description": "Workspace roots: extra directories the agent knows about and may access."
        }
      },
      "type": "object"
    },
    "PathAccessConfig": {
      "additionalProperties": false,
      "properties": {
        "allowedPaths": {
          "description": "Paths always allowed, regardless of cwd. Each entry carries an explicit `kind`: `file` matches the exact path, `directory` matches the directory and its descendants.",
          "items": {
            "$ref": "#/definitions/AllowedPath"
          },
          "type": "array"
        },
        "mode": {
          "$ref": "#/definitions/PathAccessMode"
        }
      },
      "type": "object"
    },
    "PathAccessMode": {
      "enum": [
        "allow",
        "ask",
        "block"
      ],
      "type": "string"
    },
    "PatternConfig": {
      "additionalProperties": false,
      "description": "A pattern with explicit matching mode. Default: glob for files, substring for commands. regex: true means full regex matching.",
      "properties": {
        "description": {
          "description": "Optional description surfaced to the agent when the pattern triggers (e.g. auto-deny reason).",
          "type": "string"
        },
        "pattern": {
          "type": "string"
        },
        "regex": {
          "type": "boolean"
        }
      },
      "required": [
        "pattern"
      ],
      "type": "object"
    },
    "PolicyRule": {
      "additionalProperties": false,
      "description": "A named policy rule. Matches files by patterns and enforces a protection level.",
      "properties": {
        "allowSourcing": {
          "description": "Allow loading the file with the shell `source` / `.` builtin even when access is otherwise blocked. The values become environment variables of that command without the file contents entering the agent's context. Default false.",
          "type": "boolean"
        },
        "allowedPatterns": {
          "description": "Optional exceptions.",
          "items": {
            "$ref": "#/definitions/PatternConfig"
          },
          "type": "array"
        },
        "blockMessage": {
          "description": "Message shown when blocked; supports {file} placeholder.",
          "type": "string"
        },
        "description": {
          "description": "Human-readable description.",
          "type": "string"
        },
        "enabled": {
          "description": "Per-rule toggle. Default true.",
          "type": "boolean"
        },
        "id": {
          "description": "Stable identifier used for deduplication across scopes.",
          "type": "string"
        },
        "name": {
          "description": "Optional display name for settings/UI.",
          "type": "string"
        },
        "onlyIfExists": {
          "description": "Block only when file exists on disk. Default true.",
          "type": "boolean"
        },
        "patterns": {
          "description": "File patterns to protect.",
          "items": {
            "$ref": "#/definitions/PatternConfig"
          },
          "type": "array"
        },
        "protection": {
          "$ref": "#/definitions/Protection",
          "description": "Protection level."
        }
      },
      "required": [
        "id",
        "patterns",
        "protection"
      ],
      "type": "object"
    },
    "Protection": {
      "description": "Protection level for a policy rule.",
      "enum": [
        "none",
        "readOnly",
        "noAccess"
      ],
      "type": "string"
    },
    "WorkspaceRootEntry": {
      "additionalProperties": false,
      "description": "A workspace root: a directory outside cwd the agent may treat as part of its workspace. Roots are announced in the system prompt and allowed by path-access.",
      "properties": {
        "alias": {
          "description": "Optional short name used in autocomplete and the system prompt.",
          "type": "string"
        },
        "path": {
          "description": "Directory path. Supports ~/ for home; relative paths resolve from cwd.",
          "type": "string"
        }
      },
      "required": [
        "path"
      ],
      "type": "object"
    },
    "WorkspaceRootsConfig": {
      "additionalProperties": false,
      "properties": {
        "roots": {
          "description": "Workspace root directories. Merged across scopes, deduplicated by path.",
          "items": {
            "$ref": "#/definitions/WorkspaceRootEntry"
          },
          "type": "array"
        }
      },
      "type": "object"
    }
  }
}