{
  "model": "opusplan",
  "permissions": {
    "allow": [
      "Bash(pytest:*)",
      "Bash(npm test:*)",
      "Bash(cargo test:*)",
      "Bash(ruff:*)",
      "Bash(terraform plan:*)",
      "Bash(terraform validate:*)",
      "Bash(ansible-playbook:--check*)",
      "Bash(git status:*)",
      "Bash(git diff:*)",
      "Bash(git log:*)"
    ],
    "deny": [
      "Bash(rm -rf /*)",
      "Bash(terraform apply:--auto-approve*)",
      "Bash(terraform destroy:*)",
      "Bash(git push:--force*)",
      "Bash(git reset:--hard*)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/check-secrets.sh"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/auto-format.sh"
          }
        ]
      }
    ]
  },
  "env": {
    "COVERAGE_THRESHOLD": "80",
    "TDD_STRICT": "true"
  }
}