{
  "_what": "Claude Code 權限白名單（permissions.allow）的唯一清單——本機與雲端都從這裡讀，不各養一份（inkstone/ISEP#130）",
  "_why": [
    "leo 09-07 親手把四個 Gitea 正門工具（ticket／mainline／gate-ok／gitea-pr-merge）加進本機 InkStoneCo/.claude/settings.json，auto mode 的分類器才不擋。",
    "雲端 session 沒有那四條，同樣的動作照樣被擋（09-04 progress-guard run log：permission_denials=6）。",
    "薄殼 repo（GitHub）要 D20 開閘才推得動 ⇒ 白名單住 ISEP，`scripts/settings-allow-sync` 開工時寫進那台機器的 ~/.claude/settings.json。",
    "以後加規則只改這個檔、出一版，雲端下一趟就有。"
  ],
  "_rules": [
    "開頭的 `~` 由 settings-allow-sync 換成那台機器的家目錄（本機 /Users/…、雲端 /root），其餘一字不改。",
    "只放「正門工具」：每一條都要說得出它是哪支腳本的哪種呼叫形狀。不放 Bash(python3 *) 這種整類放行。",
    "同一支工具幾種呼叫形狀就幾條（快取路徑／$CLAUDE_PLUGIN_ROOT／相對路徑）——權限規則是逐條完全比對，形狀差一個字就落在規則之外（scripts/gate-ok 檔頭記過這一課）。"
  ],
  "allow": [
    "Bash(python3 ~/.claude/plugins/cache/inkstone/isep/*/scripts/ticket *)",
    "Bash(python3 \"$CLAUDE_PLUGIN_ROOT/scripts/ticket\" *)",
    "Bash(python3 \"$CLAUDE_PLUGIN_ROOT\"/scripts/ticket *)",
    "Bash(python3 scripts/ticket *)",
    "Bash(python3 ~/.claude/plugins/cache/inkstone/isep/*/scripts/mainline *)",
    "Bash(python3 \"$CLAUDE_PLUGIN_ROOT/scripts/mainline\" *)",
    "Bash(python3 \"$CLAUDE_PLUGIN_ROOT\"/scripts/mainline *)",
    "Bash(python3 scripts/mainline *)",
    "Bash(bash ~/.claude/plugins/cache/inkstone/isep/*/scripts/gate-ok *)",
    "Bash(bash \"$CLAUDE_PLUGIN_ROOT/scripts/gate-ok\" *)",
    "Bash(bash \"$CLAUDE_PLUGIN_ROOT\"/scripts/gate-ok *)",
    "Bash(bash scripts/gate-ok *)",
    "Bash(bash scripts/gitea-pr-merge.sh *)"
  ]
}