settings.example.json

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "env": {
    "DISABLE_TELEMETRY": "1",
    "DO_NOT_TRACK": "1",
    "BASH_DEFAULT_TIMEOUT_MS": "300000"
  },
  "editorMode": "vim",
  "permissions": {
    "defaultMode": "default",
    "allow": [
      "Read",
      "Grep",
      "Glob",
      "WebSearch",
      "WebFetch",

      "Bash(git status:*)",
      "Bash(git log:*)",
      "Bash(git diff:*)",
      "Bash(git show:*)",
      "Bash(git branch:*)",
      "Bash(git blame:*)",
      "Bash(git remote:*)",
      "Bash(git tag:*)",
      "Bash(git stash list)",
      "Bash(git reflog:*)",
      "Bash(git describe:*)",
      "Bash(git rev-parse:*)",
      "Bash(git ls-files:*)",
      "Bash(git shortlog:*)",
      "Bash(git fetch:*)",
      "Bash(git cat-file:*)",
      "Bash(git rev-list:*)",
      "Bash(git ls-tree:*)",
      "Bash(git ls-remote:*)",
      "Bash(git show-ref:*)",
      "Bash(git for-each-ref:*)",
      "Bash(git diff-tree:*)",
      "Bash(git diff-index:*)",
      "Bash(git name-rev:*)",
      "Bash(git merge-base:*)",
      "Bash(git whatchanged:*)",
      "Bash(git count-objects:*)",
      "Bash(git grep:*)",
      "Bash(git var:*)",

      "Bash(file:*)",
      "Bash(tree:*)",
      "Bash(ls:*)",
      "Bash(cat:*)",
      "Bash(echo:*)",
      "Bash(head:*)",
      "Bash(tail:*)",
      "Bash(grep:*)",
      "Bash(wc:*)",
      "Bash(stat:*)",
      "Bash(du:*)",
      "Bash(diff:*)",
      "Bash(which:*)",
      "Bash(pwd)",
      "Bash(rg:*)",
      "Bash(fd:*)",
      "Bash(df:*)",
      "Bash(realpath:*)",
      "Bash(dirname:*)",
      "Bash(basename:*)",
      "Bash(readlink:*)",
      "Bash(printenv:*)",
      "Bash(ps:*)",
      "Bash(lsof:*)",
      "Bash(uname:*)",
      "Bash(date:*)",
      "Bash(tr:*)",
      "Bash(xxd:*)",
      "Bash(od:*)",
      "Bash(strings:*)",
      "Bash(column:*)",
      "Bash(tac:*)",
      "Bash(nl:*)",
      "Bash(rev:*)",
      "Bash(comm:*)",
      "Bash(cmp:*)",
      "Bash(hexdump:*)",
      "Bash(cksum:*)",
      "Bash(shasum:*)",
      "Bash(md5sum:*)",
      "Bash(sha256sum:*)",
      "Bash(base64:*)",
      "Bash(jq:*)",
      "Bash(sort:*)",
      "Bash(uniq:*)",
      "Bash(cut:*)",
      "Bash(mkdir:*)",
      "Bash(touch:*)",

      "Bash(node:*)",
      "Bash(npm:*)",
      "Bash(npx:*)",
      "Bash(pnpm:*)",
      "Bash(bun:*)",
      "Bash(make:*)",

      "Bash(cd /CHANGE-ME/to/your/projects/root*)"
    ],
    "deny": [
      "Read(.env)",
      "Read(.env.*)",
      "Read(//**/.env)",
      "Read(//**/.env.*)",
      "Read(//**/.env.local)",
      "Read(//**/.env.*.local)",
      "Read(~/.ssh/**)",
      "Read(//**/.ssh/**)",
      "Read(//**/id_rsa)",
      "Read(//**/id_ed25519)",
      "Read(//**/id_ecdsa)",
      "Read(//**/id_dsa)",
      "Read(//**/*.pem)",
      "Read(//**/*.key)",
      "Read(//**/*.p12)",
      "Read(//**/*.pfx)",
      "Read(//**/*.keystore)",
      "Read(~/.aws/**)",
      "Read(//**/.aws/**)",
      "Read(~/.config/gcloud/**)",
      "Read(~/.azure/**)",
      "Read(~/.kube/**)",
      "Read(//**/.kube/**)",
      "Read(~/.gnupg/**)",
      "Read(~/.netrc)",
      "Read(~/.npmrc)",
      "Read(~/.config/gh/hosts.yml)",
      "Read(//**/.git-credentials)",
      "Read(//**/credentials)",
      "Read(//**/.docker/config.json)",
      "Read(//**/service-account*.json)",
      "Read(//**/*-service-account*.json)",
      "Read(//**/secrets/**)",
      "Read(//**/*.secret)",
      "Edit(.env)",
      "Edit(.env.*)",
      "Edit(//**/.env)",
      "Edit(//**/.env.*)",
      "Write(.env)",
      "Write(.env.*)",
      "Write(//**/.env)",
      "Write(//**/.env.*)",
      "Edit(~/.ssh/**)",
      "Edit(//**/.ssh/**)",
      "Edit(//**/*.pem)",
      "Edit(//**/*.key)",
      "Edit(~/.aws/**)",
      "Edit(~/.gnupg/**)",
      "Edit(//**/.git-credentials)",
      "Edit(/.git/hooks/**)",
      "Bash(sudo:*)",
      "Bash(su:*)",
      "Bash(doas:*)",
      "Bash(git commit --no-verify:*)",
      "Bash(git commit -n:*)",
      "Bash(git push --mirror:*)",
      "Bash(rm -rf /)",
      "Bash(rm -fr /)",
      "Bash(rm -rf ~)",
      "Bash(rm -rf ~/)",
      "Bash(rm -rf --no-preserve-root*)",
      "Bash(rm -rf /etc*)",
      "Bash(rm -rf /usr*)",
      "Bash(rm -rf /bin*)",
      "Bash(rm -rf /sbin*)",
      "Bash(rm -rf /var*)",
      "Bash(rm -rf /lib*)",
      "Bash(rm -rf /opt*)",
      "Bash(rm -rf /boot*)",
      "Bash(rm -rf /System*)",
      "Bash(rm -rf /Library*)",
      "Bash(rm -rf /Applications*)",
      "Bash(rm -rf /private*)",
      "Bash(chmod -R 777 /*)",
      "Bash(mkfs*)",
      "Bash(wipefs*)",
      "Bash(dd of=/dev/*)",
      "Bash(shutdown:*)",
      "Bash(reboot:*)",
      "Bash(halt:*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(git push --force:*)",
      "Bash(git push -f:*)",
      "Bash(git push --force-with-lease:*)",
      "Bash(git reset --hard:*)",
      "Bash(git rebase:*)",
      "Bash(git filter-branch:*)",
      "Bash(git clean -fd:*)",
      "Bash(git clean -f:*)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/deny-secret-access.sh\"",
            "statusMessage": "Checking for secret access"
          },
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/ask-on-package-install.sh\"",
            "statusMessage": "Checking for package install"
          },
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/git-flag-guard.sh\"",
            "statusMessage": "Checking git global flags"
          },
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/allow-localhost-curl.sh\"",
            "statusMessage": "Checking localhost curl"
          },
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/find-guard.sh\"",
            "statusMessage": "Checking find"
          },
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/allow-readonly-pipeline.sh\"",
            "statusMessage": "Checking read-only pipeline"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/record-ts-edit.sh\""
          }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$HOME/.claude/hooks/typecheck-on-stop.sh\"",
            "statusMessage": "Typechecking edited TS projects"
          }
        ]
      }
    ],
    "Notification": [
      {
        "matcher": "idle_prompt",
        "hooks": [
          {
            "type": "command",
            "command": "osascript -e 'display notification \"Ready for your input\" with title \"Claude Code\"'"
          }
        ]
      }
    ]
  }
}