Sandbox Claude Code to the project folder

Enable the Bash sandbox with writes limited to the project, block reads
of credential and personal folders, and protect the settings files from
edits. git commit/push/fetch/pull run unsandboxed so GPG and SSH work;
network git commands always ask first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/settings.json

@@ -11,7 +11,56 @@
     ],
     "deny": [
       "Bash(git push --force:*)",
-      "Read(./.env)"
+      "Read(./.env)",
+      "Read(~/.ssh/**)",
+      "Read(~/.aws/**)",
+      "Read(~/.gnupg/**)",
+      "Edit(.claude/settings.json)",
+      "Edit(.claude/settings.local.json)"
+    ],
+    "blockReadsOutsideWorkingDirectories": true,
+    "ask": [
+      "Bash(git push:*)",
+      "Bash(git fetch:*)",
+      "Bash(git pull:*)"
+    ]
+  },
+  "sandbox": {
+    "enabled": true,
+    "autoAllowBashIfSandboxed": true,
+    "allowUnsandboxedCommands": false,
+    "filesystem": {
+      "denyRead": [
+        "~/.ssh",
+        "~/.aws",
+        "~/.gnupg",
+        "~/.config",
+        "~/.docker",
+        "~/.kube",
+        "~/.netrc",
+        "~/Library/Keychains",
+        "~/Documents",
+        "~/Desktop",
+        "~/Downloads"
+      ],
+      "denyWrite": [
+        ".claude/settings.json",
+        ".claude/settings.local.json"
+      ],
+      "allowRead": [
+        "~/.config/git"
+      ]
+    },
+    "network": {
+      "allowedDomains": [
+        "registry.npmjs.org"
+      ]
+    },
+    "excludedCommands": [
+      "git push:*",
+      "git fetch:*",
+      "git pull:*",
+      "git commit:*"
     ]
   },
   "hooks": {