diff --git a/mbchc-local.user.js b/mbchc-local.user.js
index bfe8249..1e31b87 100644
--- a/mbchc-local.user.js
+++ b/mbchc-local.user.js
@@ -274,6 +274,7 @@ var bcModSdk=function(){"use strict";const o="1.0.2";function e(o){alert("Mod ER
             window.ChatRoomMessage({Sender: window.Player.cid, Type: "Action", Content: `You've bought data for $${cost} and sent it to ${char.dn}.`, Dictionary: [{Tag: "MISSING PLAYER DIALOG: ", Text: ""}]})
         },
         run_activity: function(char, ag, action) { try {
+            if (!window.ServerChatRoomGetAllowItem(window.Player, char)) throw "no permissions"
             char.FocusGroup = this.ensure("invalid AssetGroup", () => window.AssetGroupGet(char.AssetFamily, ag))
             let activity = this.ensure("invalid activity", () => window.ActivityAllowedForGroup(char, char.FocusGroup.Name, true).find(a => a.Name === action))
             if (activity.Name.endsWith("Item")) {
@@ -442,12 +443,12 @@ var bcModSdk=function(){"use strict";const o="1.0.2";function e(o){alert("Mod ER
         },
         comp_hint_visible: function() {return(this.COMP_HINT.parentElement && "flex" === this.COMP_HINT.style.display)},
         complete_hint_hide: function(options) {if (!this.comp_hint_visible()) return; this.COMP_HINT.style.display = "none"; window.ChatRoomResize(false)},
-        complete_target: function(token, me2 = true) {
+        complete_target: function(token, me2 = true, check_perms = false) {
             let locase = token.toLocaleLowerCase()
             let found = {}
             for (let c of window.ChatRoomCharacter) {
                 let [n, nn, cid] = [c.Name.toLocaleLowerCase(), c.Nickname.toLocaleLowerCase(), c.cid.toString()]
-                if (!c.IsPlayer() || me2) [n, nn, cid, `@${n}`, `@${nn}`, `=${cid}`].forEach(s => {if (s.startsWith(locase)) found[s] = true})
+                if (!c.IsPlayer() || me2) [n, nn, cid, `@${n}`, `@${nn}`, `=${cid}`].forEach(s => {if (s.startsWith(locase) && (!check_perms || window.ServerChatRoomGetAllowItem(window.Player, c))) found[s] = true})
             }
             this.complete(Object.keys(found))
         },
@@ -468,10 +469,9 @@ var bcModSdk=function(){"use strict";const o="1.0.2";function e(o){alert("Mod ER
         },
         complete_do_target: function(actions, token) {
             if (!actions) return
-            if (actions.self.length > 0) {
-                if (actions.others.length < 1) return(this.complete([window.Player.cid.toString()])) // target is always the player
-                this.complete_target(token, true)
-            } else this.complete_target(token, false)
+            let me2 = (actions.self.length > 0)
+            if (me2 && actions.others.length < 1) return(this.complete([window.Player.cid.toString()])) // target is always the player
+            this.complete_target(token, me2, true)
         },
         complete_do: function(args, locase, cmdline) { const [mbchc, input, tokens] = window.MBCHC.complete_common(); // `this` is command object
             if (tokens.length < 1) return