{
  "_comment": "Reference only — setup.sh generates and writes these exact rules itself, so this file is no longer read during setup. Kept here for auditing/documentation: this is what /obsidian-vault-kb:setup will add to your permissions.allow, with <SKILL_DIR> substituted for the real, symlink-resolved skills/obsidian-vault-kb path. Only the three read-only wrapper scripts are whitelisted, each pinned to its exact absolute path — no generic Bash(find:*), Bash(rg:*), Bash(cat:*), etc. The wrapper scripts themselves resolve the vault path only from ~/.agent-skills/obsidian-vault-kb/config.json and refuse to operate outside it, so whitelisting them does not grant filesystem access beyond the configured vault.",
  "permissions": {
    "allow": [
      "Bash(<SKILL_DIR>/scripts/vault_index.sh:*)",
      "Bash(<SKILL_DIR>/scripts/vault_search.sh:*)",
      "Bash(<SKILL_DIR>/scripts/vault_backlinks.sh:*)",
      "Read(~/.agent-skills/obsidian-vault-kb/config.json)"
    ],
    "_deliberately_not_whitelisted": [
      "No generic Bash(find:*), Bash(rg:*), Bash(grep:*), Bash(cat:*), Bash(sed:*), etc. — these would allow reading anywhere on the filesystem, not just the vault.",
      "No write/append command targeting the vault or the config file — creating or editing config.json, and any 'append'/'maintain' mode writes into vault notes, keep prompting for confirmation each time by design.",
      "No wildcard on the whole scripts/ directory — only the three specific script files are whitelisted, not the whole folder, so no other script could be dropped in and silently gain the same trust."
    ]
  }
}