{
  "permissions": {
    "allow": [
      "Bash(git add:*)",
      "Bash(git commit:*)",
      "Bash(git push:*)",
      "Bash(npm i:*)",
      "Bash(claude --version)",
      "Bash(./local-build.sh:*)",
      "Bash(sudo apt-get install:*)",
      "Bash(FORCE=1 ./local-build.sh:*)",
      "Bash(rsync:*)",
      "Bash(make FORCE=1 package/feeds/secubox/luci-app-system-hub/compile:*)",
      "Bash(chmod:*)",
      "Bash(export PATH=\"$HOME/.local/bin:$PATH\")",
      "Bash(git status:*)",
      "Bash(./localbuild.sh:*)",
      "Bash(git tag:*)",
      "Bash(ls:*)",
      "Bash(grep:*)",
      "Bash(tar:*)",
      "Bash(git reset:*)",
      "Bash(git checkout:*)",
      "Bash(git rm:*)",
      "Bash(ssh:*)",
      "WebFetch(domain:github.com)",
      "WebFetch(domain:raw.githubusercontent.com)",
      "Bash(find:*)",
      "Bash(git check-ignore:*)",
      "Bash(git config:*)",
      "Bash(./scripts/feeds update:*)",
      "Bash(./scripts/feeds install:*)",
      "Bash(xargs:*)",
      "Bash(make defconfig:*)",
      "Bash(make:*)",
      "Bash(bash -n:*)",
      "Bash(./scripts/feeds uninstall crowdsec-firewall-bouncer)",
      "Bash(./scripts/feeds uninstall:*)",
      "Bash(curl:*)",
      "Bash(ln:*)",
      "Bash(./scripts/feeds search:*)",
      "Bash(cat:*)",
      "Bash(tee:*)",
      "Bash(apt list:*)",
      "Bash(pgrep:*)",
      "Bash(openwrt/staging_dir/host/bin/rsync --version)",
      "Bash(/usr/bin/rsync:*)",
      "Bash(flatpak-spawn --host which:*)",
      "Bash(flatpak-spawn --host rsync:*)",
      "Bash(echo:*)",
      "Bash(~/.bashrc)",
      "Bash(source ~/.bashrc)",
      "Bash($HOME/.local/bin/rsync --version)",
      "Bash(./secubox-tools/local-builds.sh:*)",
      "Bash(./secubox-tools/local-build.sh:*)",
      "Bash(yes:*)",
      "Bash(bison:*)",
      "Bash(flex:*)",
      "Bash(g++:*)",
      "Bash(ldd:*)",
      "Bash(export PATH=\"/home/reepost/CyberMindStudio/_files/secubox-openwrt/secubox-tools/sdk/staging_dir/host/bin:$PATH\":*)",
      "Bash(sudo ln:*)",
      "Bash(git -C /home/reepost/CyberMindStudio/_files/secubox-openwrt/secubox-tools ls-tree:*)",
      "WebFetch(domain:secubox.cybermood.eu)",
      "WebFetch(domain:docs.cybermind.fr)",
      "WebFetch(domain:lyrion.org)",
      "Bash(git pull:*)",
      "Bash(git stash:*)",
      "Bash(./secubox-tools/localbuild.sh:*)",
      "Bash(./scripts/sync-to-feed.sh:*)",
      "Bash(sh:*)",
      "Bash(dash:*)",
      "Bash(scp:*)",
      "Bash(/home/reepost/CyberMindStudio/_files/secubox-openwrt/secubox-tools/local-build.sh:*)",
      "Bash(ping:*)",
      "WebFetch(domain:docs.mitmproxy.org)",
      "WebSearch",
      "WebFetch(domain:forum.openwrt.org)",
      "WebFetch(domain:nicolargo.github.io)",
      "Bash(ssh-keygen:*)",
      "Bash(scripts/build-packages.sh:*)",
      "Bash(readlink:*)",
      "Bash(ROUTER_IP=\"192.168.8.191\":*)",
      "Bash(PKG_PATH=\"/home/reepost/CyberMindStudio/_files/secubox-openwrt/secubox-tools/build/aarch64_cortex-a72/secubox-app-webapp_1.1.0-r1_all.ipk\")",
      "Bash(__NEW_LINE_cfb353d51df65726__ echo \"Deploying to router $ROUTER_IP...\")",
      "Bash(__NEW_LINE_cfb353d51df65726__ echo \"Installing package on router...\")",
      "Bash(ROUTER_IP=\"192.168.8.1\")",
      "Bash(__NEW_LINE_63a99eb14feaadfb__ echo \"Deploying to router $ROUTER_IP...\")",
      "Bash(__NEW_LINE_63a99eb14feaadfb__ echo \"Installing package on router...\")",
      "Bash(__NEW_LINE_dd8ac110f380441b__ echo \"Deploying to router $ROUTER_IP...\")",
      "Bash(__NEW_LINE_dd8ac110f380441b__ echo \"Installing package on router...\")",
      "Bash(ROUTER_IP=\"192.168.255.1\":*)",
      "Bash(__NEW_LINE_23d0cf42d6f3e749__ echo \"Deploying to router $ROUTER_IP...\")",
      "Bash(__NEW_LINE_23d0cf42d6f3e749__ echo \"Installing package on router...\")",
      "Bash(PKG_PATH=\"/home/reepost/CyberMindStudio/_files/secubox-openwrt/secubox-tools/build/aarch64_cortex-a72/secubox-app-webapp_1.2.0-r1_all.ipk\":*)",
      "Bash(__NEW_LINE_149ef654235bfc1e__ echo \"Deploying v1.2.0 to router $ROUTER_IP...\")",
      "Bash(__NEW_LINE_149ef654235bfc1e__ echo \"Installing package on router...\")",
      "Bash(PKG_PATH=\"/home/reepost/CyberMindStudio/_files/secubox-openwrt/secubox-tools/build/aarch64_cortex-a72/secubox-app-webapp_1.3.0-r1_all.ipk\")",
      "Bash(__NEW_LINE_00785cf715958748__ echo \"Deploying optimized v1.3.0 to router $ROUTER_IP...\")",
      "Bash(__NEW_LINE_00785cf715958748__ echo \"Installing package on router...\")",
      "Bash(wc:*)",
      "WebFetch(domain:api.github.com)",
      "Bash(./build.sh:*)",
      "Bash(cd /home/reepost/CyberMindStudio/_files/secubox-openwrt/secubox-tools/sdk ./scripts/feeds update secubox)",
      "Bash(./staging_dir/host/bin/ipkg-build:*)",
      "Bash(./scripts/ipkg-build:*)",
      "WebFetch(domain:hub.docker.com)",
      "WebFetch(domain:localai.io)",
      "WebFetch(domain:downloads.lms-community.org)",
      "Bash(./secubox-tools/sdk/build-package.sh:*)",
      "Bash(./secubox-tools/scripts/expand-openwrt-image.sh:*)",
      "Bash(parted:*)",
      "Bash(fdisk:*)",
      "Bash(sudo ./secubox-tools/scripts/expand-openwrt-image.sh:*)",
      "Bash(gunzip:*)",
      "Bash(xxd:*)",
      "Bash(sfdisk:*)",
      "Bash(xzcat:*)",
      "Bash(head:*)",
      "Bash(docker search:*)",
      "Bash(git merge:*)",
      "Bash(gh run:*)",
      "Bash(dig:*)",
      "Bash(nslookup:*)",
      "Bash(host:*)",
      "Bash(git fetch:*)",
      "Bash(/home/reepost/CyberMindStudio/secubox-openwrt/secubox-tools/deploy-remote.sh:*)",
      "Bash(for i in 1 2 3 4 5)",
      "Bash(do echo \"Attempt $i...\")",
      "Bash(if ssh -o ConnectTimeout=10 root@192.168.255.1 'echo \"\"Connected\"\"; df -h /')",
      "Bash(then break)",
      "Bash(fi)",
      "Bash(done)",
      "Bash(for i in 1 2 3 4 5 6)",
      "Bash(do echo \"Checking... \\($i\\)\")",
      "Bash(if ssh -o ConnectTimeout=10 root@192.168.255.1 'df -h / /overlay 2>/dev/null')",
      "Bash(./secubox-tools/deploy-remote.sh:*)",
      "Bash(do)",
      "Bash(if ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no root@192.168.255.1 \"echo ''Router is back!''\")",
      "Bash(then)",
      "Bash(exit 0)",
      "Bash(if ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no root@192.168.255.1 \"echo ''Router online!''\")",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt log --oneline --all --grep=streamlit)",
      "Bash(tree:*)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt log --oneline --all -20 --decorate)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt show d6861fe --stat)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt show:*)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt log -p d6861fe -1 -- package/secubox/luci-app-streamlit/Makefile)",
      "Bash(openssl s_client:*)",
      "Bash(openssl x509:*)",
      "Bash(wget:*)",
      "Bash(/home/reepost/CyberMindStudio/secubox-openwrt/secubox-tools/sdk/staging_dir/host/go/bin/go version:*)",
      "Bash(/home/reepost/CyberMindStudio/secubox-openwrt/secubox-tools/sdk/staging_dir/host/go/bin/go env:*)",
      "Bash(go version:*)",
      "Bash(GOARM64=v8.0 go env:*)",
      "Bash(go env:*)",
      "Bash(snap list:*)",
      "Bash(snap info:*)",
      "Bash(aarch64-openwrt-linux-musl-objdump:*)",
      "Bash(/home/reepost/CyberMindStudio/secubox-openwrt/secubox-tools/sdk/staging_dir/toolchain-aarch64_cortex-a72_gcc-13.3.0_musl/bin/aarch64-openwrt-linux-musl-objdump:*)",
      "Bash(PATH=~/go120/bin:/usr/bin:/bin:$PATH)",
      "Bash(aarch64-linux-gnu-objdump:*)",
      "Bash(staging_dir/toolchain-aarch64_cortex-a72_gcc-13.3.0_musl/bin/aarch64-openwrt-linux-musl-readelf:*)",
      "Bash(git diff:*)",
      "Bash(git log:*)",
      "Bash(nc:*)",
      "Bash(pkill:*)",
      "Bash(python3 -m json.tool:*)",
      "Bash(git restore:*)",
      "Bash(__NEW_LINE_80f7f5dbdf93db8a__ echo \"\")",
      "Bash(# Check for other service-like apps in other secubox menus echo \"\"=== Mitmproxy location ===\"\" grep -h ''\"\"admin/'' package/secubox/luci-app-mitmproxy/root/usr/share/luci/menu.d/*.json)",
      "Bash(ar -p:*)",
      "WebFetch(domain:openwrt.org)",
      "Bash(ar -t:*)",
      "Bash(zstd:*)",
      "Bash(source /home/reepost/CyberMindStudio/secubox-openwrt/secubox-tools/local-build.sh)",
      "Bash(strip_libc_from_ipk:*)",
      "Bash(sort:*)",
      "Bash(FEED=\"/home/reepost/CyberMindStudio/secubox-openwrt/package/secubox/secubox-app-bonus/root/www/secubox-feed\" grep:*)",
      "Bash(zcat:*)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt add package/secubox/*/Makefile package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt add package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-core_*.ipk git -C /home/reepost/CyberMindStudio/secubox-openwrt status --short)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt commit -m \"$\\(cat <<''EOF''\nfix\\(deps\\): Remove libubox/libubus/libuci from all SecuBox package dependencies\n\nThese base OpenWrt libraries are always present on the system but their\nversions in the SDK-built feed don''t match the router''s installed versions,\ncausing opkg to fail with \"Cannot satisfy dependencies\" errors.\n\nFixed packages \\(18 total\\):\n- secubox-core: removed libubox, libubus, libuci\n- luci-app-ksm-manager: removed libubus, libubox\n- luci-app-mqtt-bridge: removed libuci\n- secubox-app-adguardhome: removed uci, libuci\n- secubox-app-auth-logger: removed libubox-lua\n- secubox-app-domoticz: removed uci, libuci\n- secubox-app-gitea: removed uci, libuci\n- secubox-app-glances: removed uci, libuci\n- secubox-app-hexojs: removed uci, libuci\n- secubox-app-lyrion: removed uci, libuci\n- secubox-app-magicmirror2: removed uci, libuci\n- secubox-app-mailinabox: removed uci, libuci\n- secubox-app-mitmproxy: removed uci, libuci\n- secubox-app-nextcloud: removed uci, libuci\n- secubox-app-ollama: removed uci, libuci\n- secubox-app-picobrew: removed uci, libuci\n- secubox-app-streamlit: removed uci, libuci\n- secubox-app-zigbee2mqtt: removed uci, libuci\n\nThe packages still work because these libs are implicitly available.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt push origin release/v0.15.0)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt add package/secubox/secubox-core/Makefile package/secubox/luci-app-secubox-admin/Makefile package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages* package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-core_*.ipk package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-admin_*.ipk)",
      "Bash(__NEW_LINE_9c0ea50a93f8f5be__ git -C /home/reepost/CyberMindStudio/secubox-openwrt commit -m \"$\\(cat <<''EOF''\nfix\\(deps\\): Remove ALL dependencies from secubox-core and luci-app-secubox-admin\n\nEven rpcd, bash, jsonfilter, jq depend on libc themselves. Since these\npackages are always present on a working OpenWrt/SecuBox system, we should\nnot declare any dependencies at all.\n\n- secubox-core 0.10.0-r9: DEPENDS:= \\(empty\\)\n- luci-app-secubox-admin 1.0.0-r19: LUCI_DEPENDS:= \\(empty\\)\n\nThis prevents opkg from trying to resolve any feed packages and their\ncascading libc dependencies.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
      "Bash(gzip:*)",
      "Bash(python3:*)",
      "WebFetch(domain:192.168.255.1)",
      "Bash(ssh-add:*)",
      "Bash(SSH_AUTH_SOCK=\"\" ssh -i ~/.ssh/id_rsa root@192.168.255.1 'grep \"\"s.anonymous\"\" /www/luci-static/resources/view/cdn-cache/settings.js')",
      "Bash(SSH_AUTH_SOCK=\"\" ssh -i ~/.ssh/id_rsa root@192.168.255.1 'grep \"\"s.anonymous\"\" /www/luci-static/resources/view/cdn-cache/settings.js; rm -f /tmp/luci-indexcache*')",
      "Bash(SSH_AUTH_SOCK=\"\" ssh -i ~/.ssh/id_ed25519 root@192.168.255.1 'grep \"\"s.anonymous\"\" /www/luci-static/resources/view/cdn-cache/settings.js; rm -f /tmp/luci-indexcache*')",
      "Bash(SSH_AUTH_SOCK=\"\" ssh -i ~/.ssh/id_ed25519 root@192.168.255.1 'echo \"\"=== CrowdSec Decisions ===\"\"; cscli decisions list 2>/dev/null | head -10; echo \"\"\"\"; echo \"\"=== Auth Guardian Status ===\"\"; ubus call luci.auth-guardian status 2>/dev/null | head -20')",
      "Bash(for:*)",
      "Bash(if [ -d \"package/secubox/$pkg\" ])",
      "Bash(SSH_ASKPASS=\"\" SSH_AUTH_SOCK=\"\" ssh:*)",
      "Bash(.venv/bin/python:*)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt log --oneline -3)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt push origin master)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt pull --rebase origin master)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt stash)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt stash pop)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt diff package/secubox/luci-app-metablogizer/root/usr/libexec/rpcd/luci.metablogizer)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt add package/secubox/luci-app-metablogizer/root/usr/libexec/rpcd/luci.metablogizer)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt commit -m \"$\\(cat <<''EOF''\nfix\\(metablogizer\\): Skip frontend HTTP checks for DNS mismatch sites\n\nWhen a site''s DNS doesn''t point to our public IP, skip the external\nHTTP check to avoid 5-second timeouts. This significantly speeds up\nthe get_hosting_status API call which was causing XHR timeouts in\nthe LuCI frontend.\n\nSites with DNS mismatch now show frontend_status: \"dns_mismatch\"\ninstead of timing out.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt status --short package/secubox/luci-app-metablogizer/)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt log --oneline -5)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt status -sb)",
      "Bash(pip install:*)",
      "WebFetch(domain:secubox.maegia.tv)",
      "Bash(# Find the built packages echo \"\"=== Built packages ===\"\" ls -la secubox-tools/build/aarch64_cortex-a72/*.ipk)",
      "Bash(__NEW_LINE_2faeb2c9d4f26aa1__ git diff --cached --stat)",
      "Bash(ip addr:*)",
      "Bash(ip route:*)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt status --short)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt diff package/secubox/luci-app-dnsguard/root/usr/libexec/rpcd/luci.dnsguard)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt add package/secubox/luci-app-dnsguard/root/usr/libexec/rpcd/luci.dnsguard)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt commit -m \"$\\(cat <<''EOF''\nfix\\(dnsguard\\): Fix subshell issues in provider lookup methods\n\nReplace pipe-to-while loops with grep/cut to avoid subshell variable\nscope issues in method_status, method_get_providers, and method_set_provider.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
      "Bash(IPK_DIR=\"/home/reepost/CyberMindStudio/secubox-openwrt/secubox-tools/sdk/bin/packages/aarch64_cortex-a72/secubox\" ls:*)",
      "Bash(if ssh -o ConnectTimeout=10 root@192.168.255.1 'echo \"\"Router is back!\"\"; df -h / /boot')",
      "Bash(then exit 0)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt tag --sort=-v:refname)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt commit -m \"$\\(cat <<''EOF''\nfeat\\(mitmproxy\\): Disable LAN transparent proxy by default\n\nLAN transparent mode now requires explicit opt-in via transparent.enabled\nto prevent HTTPS certificate errors for LAN clients.\n\nChanges:\n- mitmproxyctl: Check transparent_enabled before setting up LAN firewall rules\n- LuCI settings: Add warning about certificate requirements for LAN mode\n- Default config already has transparent.enabled=''0''\n\nWAN protection mode remains active for incoming threat detection.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt tag -a v0.18.1 -m \"Release v0.18.1: mitmproxy LAN transparent mode disabled by default\")",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt push)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt push --tags)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt add package/secubox/secubox-app-mitmproxy/root/srv/mitmproxy/addons/secubox_analytics.py package/secubox/luci-app-secubox-security-threats/root/usr/libexec/rpcd/luci.secubox-security-threats)",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt commit -m \"$\\(cat <<''EOF''\nfeat\\(security\\): Add CVE-2025-15467 detection and mitmproxy threat integration\n\n- Add CVE-2025-15467 \\(OpenSSL CMS stack overflow\\) detection patterns\n- Detect S/MIME/CMS content types that may be exploited\n- Integrate mitmproxy threats into security-threats dashboard\n- Security threats page now shows real-time WAF detections\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
      "Bash(git -C /home/reepost/CyberMindStudio/secubox-openwrt tag -a v0.18.2 -m \"Release v0.18.2: CVE-2025-15467 detection and security dashboard integration\")"
    ]
  }
}