/** Rules added to the deny list for ANY git-initialized project. */
export const ALWAYS_DENY = [
    'Bash(git push --force*)',
    'Bash(git push -f *)',
    'Bash(git reset --hard origin/*)',
    'Bash(git branch -D main)',
    'Bash(git branch -D master)',
    'Bash(git branch -D develop)',
];
/** Only Planu MCP tools allowed, plus always-deny. */
export const BASE_ALLOW_MINIMAL = ['mcp__planu__*', 'mcp__planu_v*'];
/** Recommended allow list: dev tooling + git reads + FS reads + Claude Code native + Planu MCP. */
export const BASE_ALLOW_RECOMMENDED = [
    // Package managers & runtimes
    'Bash(npm *)',
    'Bash(pnpm *)',
    'Bash(yarn *)',
    'Bash(node *)',
    'Bash(bash scripts/*)',
    // Git (safe operations only — destructive ones are in ALWAYS_DENY)
    'Bash(git status*)',
    'Bash(git log*)',
    'Bash(git diff*)',
    'Bash(git add *)',
    'Bash(git commit -m *)',
    'Bash(git push origin *)',
    // Filesystem reads
    'Bash(ls *)',
    'Bash(cat *)',
    'Bash(find *)',
    'Bash(grep *)',
    'Bash(rg *)',
    // Claude Code native tools
    'Monitor',
    'Agent',
    'Read',
    'Write',
    'Edit',
    'Glob',
    'Grep',
    'TaskCreate',
    'TaskUpdate',
    'TaskList',
    'TaskGet',
    'TaskOutput',
    'Skill(*)',
    'ToolSearch',
    'SendMessage',
    'ScheduleWakeup',
    // Planu MCP
    'mcp__planu__*',
    'mcp__planu_v*',
];
/** Full mode adds a Bash(*) blanket (deny still wins). */
export const BASE_ALLOW_FULL = [...BASE_ALLOW_RECOMMENDED, 'Bash(*)'];
/** Template objects for easy lookup by mode. */
export const TEMPLATES = {
    minimal: {
        mode: 'minimal',
        allow: BASE_ALLOW_MINIMAL,
        deny: ALWAYS_DENY,
        defaultMode: 'acceptEdits',
    },
    recommended: {
        mode: 'recommended',
        allow: BASE_ALLOW_RECOMMENDED,
        deny: ALWAYS_DENY,
        defaultMode: 'acceptEdits',
    },
    full: {
        mode: 'full',
        allow: BASE_ALLOW_FULL,
        deny: ALWAYS_DENY,
        defaultMode: 'acceptEdits',
    },
};
export function getTemplate(mode) {
    const tpl = TEMPLATES[mode];
    if (tpl === undefined) {
        throw new Error(`Unknown permissions mode: ${mode}. Valid: minimal | recommended | full`);
    }
    return tpl;
}
//# sourceMappingURL=templates.js.map