{
  "enabledPlugins": {
    "rust-analyzer-lsp@claude-plugins-official": true
  },
  "tui": "fullscreen",
  "theme": "dark",
  "autoMode": {
    "soft_deny": [
      "$defaults",
      "Bash(podman rm:*) in /home/connor/docs/projects/runway \u2014 destructive container removal",
      "Bash(rm -rf:*) targeting baikal test containers in crates/runway-caldav/tests/baikal",
      "Bash(podman rm -f:*) \u2014 destructive podman container removal, frequently used CLI in this environment",
      "Bash(rm -rf ~/.env*) \u2014 sensitive credential files (.env, .env.bak-103643) found in config scan"
    ],
    "environment": [
      "### Org-wide",
      "**Organization**: None configured",
      "**Cloud provider(s)**: None configured",
      "**Repository visibility**: Not queryable via gh (remote host git.rcjohnstone.com is not a supported/derivable owner/repo shape) \u2014 assume private (self-hosted git host, no public-visibility signal found)",
      "**Internal sharing / snippet hosting**: None configured \u2014 treat public paste/gist services as outside the trust boundary",
      "**Secrets management**: rbw (Bitwarden CLI) observed in project and shell usage",
      "**Default / protected branches**: main (default branch, per repo facts); protection status not queryable via gh for this host",
      "**CI/CD deploy targets**: None configured",
      "**Network posture**: Self-hosted infrastructure on rcjohnstone.com domain and local network (10.x addresses observed); no cloud provider signals",
      "**Source control**: ssh://git.rcjohnstone.com:2222/connor/runway.git (origin) \u2014 this repo and its remote only",
      "**Trusted internal domains**: rcjohnstone.com (baikal.rcjohnstone.com, runway.rcjohnstone.com, auth.rcjohnstone.com, jellyfin.rcjohnstone.com, git.rcjohnstone.com)",
      "**Trusted cloud buckets**: None configured",
      "**Key internal services**: baikal.rcjohnstone.com (CalDAV test server), runway-backend (container/service host), immich.rcjohnstone.com, jellyfin.rcjohnstone.com, auth.rcjohnstone.com",
      "**Internal package registry**: None configured",
      "**Sensitive data locations & audiences**: .env / .env.local files (gitignored); any file or store holding personal data, confidential business data, credentials, regulated data, or similarly sensitive material \u2014 share only with audiences cleared at the named+specifics bar",
      "**Data retention / declassification**: None configured",
      "**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment",
      "**Protected deployment namespaces / environments**: None configured \u2014 fall back to the Sensitive remote targets heuristic",
      "**Protected IaC scopes**: IAM, RBAC, networking, quota, and node-pool resources; anything whose name or tag carries `prod` or `production` as a whole word or name segment",
      "**Repository visibility**: assume private unless the remote host and repo name indicate otherwise, or a visibility check in the transcript shows public",
      "**Secrets management**: rbw (Bitwarden CLI) used routinely in shell history and project transcripts",
      "**Default / protected branches**: not queryable \u2014 repo has no configured remote",
      "**Network posture**: home-lab/self-hosted services under rcjohnstone.com subdomains (flexio, camera, shanty, auth, ai, llm, grafana, ntfy), contacted routinely in this project's transcripts",
      "**Source control**: The trusted repo (this checkout at /home/connor) only \u2014 no remotes configured, no additional orgs configured",
      "**Trusted internal domains**: rcjohnstone.com and its subdomains (flexio., camera., shanty., auth., ai., llm., grafana., ntfy.) \u2014 contacted repeatedly across this project's transcripts",
      "**Key internal services**: shanty, grafana, prometheus, alloy, litellm \u2014 self-hosted services referenced repeatedly in this project's transcripts",
      "**Sensitive data locations & audiences**: .env and .env.bak-103643 (credential-bearing files found in config scan); rbw (password manager) vault contents; preserve exact handles when known and share only with audiences cleared at the [named+specifics] bar",
      "**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment (hyphen/underscore/dot-delimited)",
      "### User-specific",
      "**Primary use of Claude Code**: software development (Rust/Leptos/Axum CalDAV client)",
      "**Trusted repo**: /home/connor/docs/projects/runway (working directory) and its remote ssh://git.rcjohnstone.com:2222/connor/runway.git \u2014 visibility assumed private per above, so confidential material is fine to commit here but secrets are never cleared into it by visibility alone",
      "**Org-specific CLIs**: None configured",
      "routine podman/systemctl/journalctl operations under this project's local/self-hosted infra",
      "**Primary use of Claude Code**: personal/hobby systems administration \u2014 home-lab container management (podman/podman-compose), self-hosted services (rcjohnstone.com subdomains), and local system maintenance",
      "**Trusted repo**: The git repository at /home/connor (its working directory) \u2014 no remotes configured, so scope is local-only; treat as private by default",
      "**Org-specific CLIs**: None configured \u2014 but note routine personal use of podman, podman-compose, rbw, systemctl, journalctl, act_runner, ddns/ddns_update, sunshine, caddy in this environment",
      "No \"routine under <user>/ prefix\" qualifiers found"
    ]
  },
  "statusLine": {
    "type": "command",
    "command": "python3 /home/connor/.claude/quota-statusline.py",
    "refreshInterval": 60
  }
}