diff --git a/CLAUDE.md b/CLAUDE.md
index fc53abb..cd3134f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -32,7 +32,7 @@ Discard:
   - Auth: ChatGPT login, creds in `~/.codex/auth.json`. Only run `codex login --device-auth` (SSH-friendly) if `codex login status` says you are logged out — a valid `auth.json` may already exist even when the binary is missing.
   - Config: `~/.codex/config.toml` plus `<name>.config.toml` per profile, generated by the `codex-ops-kit` repo (`~/codex-ops-kit`, `slaguru666/codex-ops-kit`) — edit the templates there, not the live files, or the next install overwrites them. Profiles: `codex --profile economy|balanced|deep`; plain `codex` uses balanced defaults.
   - Use via the `codex@openai-codex` plugin (`/codex:*` commands) or directly: `codex exec "<prompt>"` (add `--skip-git-repo-check` outside a git repo).
-- The user runs Claude Code on multiple machines: `timevans-MINI-S` (Linux, Zorin OS 18.1; static LAN IP `192.168.1.6`, key-only SSH — see the `infra-minis-remote-access` memory) and a Mac Mini (`tims-mac-mini-local`). Check the hostname to know which one you're on.
+- The user runs Claude Code on multiple machines: `timevans-MINI-S` (Linux, Zorin OS 18.1; static LAN IP `192.168.1.6`, key-only SSH — see the `infra-minis-remote-access` memory), a Mac Mini (`tims-mac-mini-local`), and `tim-ThinkPad-X1-NanoTS` (Lenovo ThinkPad X1 Nano laptop, Linux Mint 22 "Wilma" XFCE on Ubuntu 24.04 base, x86_64; package managers apt/flatpak/brew — note `/usr/local/bin/apt` is a wrapper shadowing the real `/usr/bin/apt`). Check the hostname to know which one you're on.
 - The user adds `$HOME/bin` to PATH in `.bashrc`.
 
 ## Memory Protocol
diff --git a/settings.json b/settings.json
index 04cbb7e..36e36ba 100644
--- a/settings.json
+++ b/settings.json
@@ -11,7 +11,78 @@
       "Bash(mj-capture-command *)",
       "Bash(/Users/timevans/bin/mj-gen *)",
       "Bash(/Users/timevans/bin/mj-auth-check *)",
-      "Bash(/Users/timevans/bin/mj-capture-command *)"
+      "Bash(/Users/timevans/bin/mj-capture-command *)",
+      "Read",
+      "Edit",
+      "Write",
+      "Glob",
+      "Grep",
+      "Bash(git status)",
+      "Bash(git diff)",
+      "Bash(git log)",
+      "Bash(git add )",
+      "Bash(git commit )",
+      "Bash(git push)",
+      "Bash(git pull)",
+      "Bash(git branch)",
+      "Bash(git checkout )",
+      "Bash(git stash)",
+      "Bash(git fetch)",
+      "Bash(npm run )",
+      "Bash(npm install)",
+      "Bash(npm test)",
+      "Bash(npm ci)",
+      "Bash(npx )",
+      "Bash(node )",
+      "Bash(ls)",
+      "Bash(dir)",
+      "Bash(mkdir )",
+      "Bash(mv )",
+      "Bash(cp )",
+      "Bash(touch )",
+      "Bash(cat )",
+      "Bash(head )",
+      "Bash(tail )",
+      "Bash(wc )",
+      "Bash(find )",
+      "Bash(grep )",
+      "Bash(sort )",
+      "Bash(uniq )",
+      "Bash(diff )",
+      "Bash(which )",
+      "Bash(where )",
+      "Bash(echo )",
+      "Bash(pwd)",
+      "Bash(cd )",
+      "Bash(type )",
+      "Bash(file )",
+      "Bash(whoami)",
+      "Bash(hostname)",
+      "Bash(date)",
+      "Bash(yarn )",
+      "Bash(pnpm )",
+      "Bash(python )",
+      "Bash(python3 )",
+      "Bash(pip )",
+      "Bash(pip3 )",
+      "Bash(cargo )",
+      "Bash(go )",
+      "Bash(dotnet )"
+    ],
+    "deny": [
+      "Bash(rm -rf )",
+      "Bash(rm -r )",
+      "Bash(rmdir /s)",
+      "Bash(del /s)",
+      "Bash(sudo )",
+      "Bash(chmod 777)",
+      "Bash(format )",
+      "Read(.env)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/credentials*)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)"
     ]
   },
   "model": "opus",