{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(npm test)",
      "Bash(npm start:*)",
      "Bash(node --test:*)",
      "Bash(git status)",
      "Bash(git diff:*)",
      "Bash(git log:*)"
    ],
    "deny": [
      "Bash(git push --force:*)",
      "Read(./.env)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Read(~/.gnupg/**)",
      "Edit(.claude/settings.json)",
      "Edit(.claude/settings.local.json)"
    ],
    "blockReadsOutsideWorkingDirectories": true,
    "ask": [
      "Bash(git push:*)",
      "Bash(git fetch:*)",
      "Bash(git pull:*)"
    ]
  },
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": false,
    "filesystem": {
      "denyRead": [
        "~/.ssh",
        "~/.aws",
        "~/.gnupg",
        "~/.config",
        "~/.docker",
        "~/.kube",
        "~/.netrc",
        "~/Library/Keychains",
        "~/Documents",
        "~/Desktop",
        "~/Downloads"
      ],
      "denyWrite": [
        ".claude/settings.json",
        ".claude/settings.local.json"
      ],
      "allowRead": [
        "~/.config/git"
      ]
    },
    "network": {
      "allowedDomains": [
        "registry.npmjs.org"
      ]
    },
    "excludedCommands": [
      "git push:*",
      "git fetch:*",
      "git pull:*",
      "git commit:*"
    ]
  },
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "f=$(jq -r '.tool_input.file_path // empty'); case \"$f\" in *.js) node --check \"$f\" || { echo \"Syntax error in $f\" >&2; exit 2; } ;; esac"
          }
        ]
      }
    ]
  }
}