christianandClaude Opus 5.5
371a6af0b4
Enable the Bash sandbox with writes limited to the project, block reads of credential and personal folders, and protect the settings files from edits. git commit/push/fetch/pull run unsandboxed so GPG and SSH work; network git commands always ask first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
80 lines
1.7 KiB
JSON
80 lines
1.7 KiB
JSON
{
|
|
"$schema": "https://json.schemastore.org/claude-code-settings.json",
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(npm test)",
|
|
"Bash(npm start:*)",
|
|
"Bash(node --test:*)",
|
|
"Bash(git status)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git log:*)"
|
|
],
|
|
"deny": [
|
|
"Bash(git push --force:*)",
|
|
"Read(./.env)",
|
|
"Read(~/.ssh/**)",
|
|
"Read(~/.aws/**)",
|
|
"Read(~/.gnupg/**)",
|
|
"Edit(.claude/settings.json)",
|
|
"Edit(.claude/settings.local.json)"
|
|
],
|
|
"blockReadsOutsideWorkingDirectories": true,
|
|
"ask": [
|
|
"Bash(git push:*)",
|
|
"Bash(git fetch:*)",
|
|
"Bash(git pull:*)"
|
|
]
|
|
},
|
|
"sandbox": {
|
|
"enabled": true,
|
|
"autoAllowBashIfSandboxed": true,
|
|
"allowUnsandboxedCommands": false,
|
|
"filesystem": {
|
|
"denyRead": [
|
|
"~/.ssh",
|
|
"~/.aws",
|
|
"~/.gnupg",
|
|
"~/.config",
|
|
"~/.docker",
|
|
"~/.kube",
|
|
"~/.netrc",
|
|
"~/Library/Keychains",
|
|
"~/Documents",
|
|
"~/Desktop",
|
|
"~/Downloads"
|
|
],
|
|
"denyWrite": [
|
|
".claude/settings.json",
|
|
".claude/settings.local.json"
|
|
],
|
|
"allowRead": [
|
|
"~/.config/git"
|
|
]
|
|
},
|
|
"network": {
|
|
"allowedDomains": [
|
|
"registry.npmjs.org"
|
|
]
|
|
},
|
|
"excludedCommands": [
|
|
"git push:*",
|
|
"git fetch:*",
|
|
"git pull:*",
|
|
"git commit:*"
|
|
]
|
|
},
|
|
"hooks": {
|
|
"PostToolUse": [
|
|
{
|
|
"matcher": "Edit|Write",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "f=$(jq -r '.tool_input.file_path // empty'); case \"$f\" in *.js) node --check \"$f\" || { echo \"Syntax error in $f\" >&2; exit 2; } ;; esac"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|