diff --git a/package-lock.json b/package-lock.json
index e20cb6a..6e44250 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "opencode-presets",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "opencode-presets",
-      "version": "0.2.1",
+      "version": "0.2.2",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0",
diff --git a/package.json b/package.json
index 4ae922e..9dbe35c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "opencode-presets",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Interactive CLI that patches opencode.json with curated config presets — LSP, MCP, permissions.",
   "type": "module",
   "bin": {
diff --git a/presets/permissions-git-safe.conf b/presets/permissions-git-safe.conf
index 38015e4..40f5674 100644
--- a/presets/permissions-git-safe.conf
+++ b/presets/permissions-git-safe.conf
@@ -6,11 +6,13 @@
 //   outside git's object store. Composes with other permission modules
 //   via @mode: merge.
 // @author: Jan <jan@trick77.com>
-// @version: 0.1.0
+// @version: 0.1.2
 // @path: permission.bash
 // @mode: merge
 {
+  "git status":                "allow",
   "git status *":              "allow",
+  "git diff":                  "allow",
   "git diff *":                "allow",
 
   "git log *":                 "allow",
@@ -22,6 +24,7 @@
   "git merge-base *":          "allow",
 
   "git ls-files *":            "allow",
+  "git ls-tree *":             "allow",
   "git blame *":               "allow",
   "git grep *":                "allow",
   "git check-ignore *":        "allow",