{
  "permissions": {
    "deny": [
      "Bash(curl *sap/bc/adt*)",
      "Bash(curl *sap/bc/soap*)",
      "Bash(curl *sap/bc/webdynpro*)",
      "Bash(python -c *requests*sap/bc*)",
      "Bash(python -c *urllib*sap/bc*)"
    ],
    "allow": [
      "Bash(python main.py *)",
      "Bash(python -m sapcli *)",
      "Bash(python -m unittest *)",
      "Bash(python -m pytest *)",
      "Bash(python -m json.tool)",
      "Bash(git *)",
      "Bash(cat *)",
      "Bash(ls *)",
      "Bash(python tests/test_e2e.py*)",
      "Read",
      "Edit",
      "Write"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qiE 'curl.*(sap/bc/adt|sap/bc/soap|sap/bc/webdynpro)'; then echo '⛔ BLOCKED: Direct ADT/SOAP/WebDynpro access is prohibited. Use sap-cli commands (python main.py <command>).' && exit 2; fi"
          },
          {
            "type": "command",
            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qiE 'python.*-c.*(requests|urllib).*sap.*/bc/'; then echo '⛔ BLOCKED: Direct HTTP requests to SAP are prohibited. Use sap-cli commands (python main.py <command>).' && exit 2; fi"
          },
          {
            "type": "command",
            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qiE 'from sapcli.client import|from sapcli.client._'; then echo '⛔ BLOCKED: Importing sap-cli internal modules is prohibited for SAP operations. Use CLI commands (python main.py <command>).' && exit 2; fi"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Bash(python main.py sync*)",
        "hooks": [
          {
            "type": "command",
            "command": "echo '📋 Sync completed. Check output for activation status. If activation failed, try: python main.py activate --name <OBJ> --type <TYPE> --corr_nr <CORR_NR>'"
          }
        ]
      }
    ]
  }
}