# --allowedTools (one per line, joined with commas by run-step.ps1)
# Allowed tools for every metered session, one per line (joined with commas into one
# --allowedTools value by run-step.ps1). Seeded from SERIES-SPEC.md "Session protocol" step 3;
# the dry run on step 0 of a disposable React clone (Nov 4) settled the list: it added rm, mv,
# cmp, diff, touch, sed, sort, tr, cut, awk, sleep, which, netstat, tasklist and three read-only
# git commands after the session was denied cp+rm and cp+cmp chains. taskkill and kill stay
# denied (the API and the test runner's dev server belong to the harness).
Read
Edit
Write
Glob
Grep
Bash(npm:*)
Bash(npx:*)
Bash(node:*)
Bash(dotnet:*)
Bash(git status:*)
Bash(git diff:*)
Bash(curl:*)
Bash(ls:*)
Bash(cat:*)
Bash(dir:*)
Bash(cd:*)
Bash(pwd)
Bash(echo:*)
Bash(grep:*)
Bash(find:*)
Bash(head:*)
Bash(tail:*)
Bash(wc:*)
Bash(mkdir:*)
Bash(cp:*)
Bash(tsc:*)
Bash(rm:*)
Bash(mv:*)
Bash(cmp:*)
Bash(diff:*)
Bash(touch:*)
Bash(sed:*)
Bash(sort:*)
Bash(tr:*)
Bash(cut:*)
Bash(awk:*)
Bash(sleep:*)
Bash(which:*)
Bash(netstat:*)
Bash(tasklist:*)
Bash(git log:*)
Bash(git show:*)
Bash(git ls-files:*)

# --disallowedTools
# Denied outright in every metered session (SERIES-SPEC.md "Session protocol" step 3).
# A denied attempt still shows in the transcript and is counted; run-step.ps1 also reverts any
# change under e2e/ or shared/ made some other way and records it as test_edit.
Edit(e2e/**)
Write(e2e/**)
Edit(shared/**)
Write(shared/**)
# The PowerShell tool is removed entirely: in October's transcripts the model reached for it and
# was denied 10 times in 12, which would count against the framework instead of the harness.
# Every session has the Bash tool (Git Bash on this PC) with the commands in allowed-tools.txt.
PowerShell