{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "_comment": "crefft standard Claude Code configuration - https://github.com/agh/crefft",
  "_comment_secrets": [
    "Secret paths are denied for Read as well as Edit: a Read deny also blocks",
    "Edit and Write, and covers the file commands Claude Code recognizes in Bash.",
    "NotebookEdit is not covered by a Read deny, so the Edit denies are kept.",
    "The *secret*, *password*, *credential* and *token* patterns are deliberately",
    "broad and also match source files such as tokenizer.ts; narrow them per",
    "project when that blocks legitimate reads."
  ],

  "attribution": {
    "commit": "",
    "pr": ""
  },

  "permissions": {
    "allow": [
      "Bash(npm run:*)",
      "Bash(npx:*)",
      "Bash(bun run:*)",
      "Bash(pnpm:*)",
      "Bash(yarn:*)",
      "Bash(uv run:*)",
      "Bash(cargo:*)",
      "Bash(go run:*)",
      "Bash(go test:*)",
      "Bash(go build:*)",
      "Bash(bundle exec:*)",
      "Bash(rails:*)",
      "Bash(rake:*)",
      "Bash(pytest:*)",
      "Bash(python -m pytest:*)",
      "Bash(git status:*)",
      "Bash(git diff:*)",
      "Bash(git log:*)",
      "Bash(git branch:*)",
      "Bash(git checkout:*)",
      "Bash(git switch:*)",
      "Bash(git add:*)",
      "Bash(git commit:*)",
      "Bash(git stash:*)",
      "Bash(git show:*)",
      "Bash(cat:*)",
      "Bash(ls:*)",
      "Bash(find:*)",
      "Bash(grep:*)",
      "Bash(rg:*)",
      "Bash(head:*)",
      "Bash(tail:*)",
      "Bash(wc:*)",
      "Bash(sort:*)",
      "Bash(uniq:*)",
      "Bash(diff:*)",
      "Bash(which:*)",
      "Bash(echo:*)",
      "Bash(pwd)",
      "Bash(date)",
      "Read",
      "Glob",
      "Grep",
      "Edit(src/**)",
      "Edit(lib/**)",
      "Edit(app/**)",
      "Edit(tests/**)",
      "Edit(test/**)",
      "Edit(spec/**)",
      "Edit(docs/**)",
      "Edit(*.md)",
      "Edit(*.json)",
      "Edit(*.yaml)",
      "Edit(*.yml)",
      "Edit(*.toml)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(rm -r /:*)",
      "Bash(sudo:*)",
      "Bash(chmod 777:*)",
      "Bash(chmod -R 777:*)",
      "Bash(chown -R:*)",
      "Bash(dd if=:*)",
      "Bash(mkfs:*)",
      "Bash(fdisk:*)",
      "Bash(git push --force:*)",
      "Bash(git reset --hard:*)",
      "Read(.env)",
      "Read(.env.*)",
      "Read(**/secrets/**)",
      "Read(**/*secret*)",
      "Read(**/*password*)",
      "Read(**/*credential*)",
      "Read(**/*token*)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/id_rsa*)",
      "Edit(.env)",
      "Edit(.env.*)",
      "Edit(**/secrets/**)",
      "Edit(**/*secret*)",
      "Edit(**/*password*)",
      "Edit(**/*credential*)",
      "Edit(**/*token*)",
      "Edit(**/*.pem)",
      "Edit(**/*.key)",
      "Edit(**/id_rsa*)"
    ],
    "blockReadsOutsideWorkingDirectories": true,
    "defaultMode": "auto"
  },

  "fallbackModel": [
    "claude-opus-4-8"
  ],

  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "credentials": {
      "files": [
        { "path": ".env", "mode": "deny" },
        { "path": "**/.env", "mode": "deny" },
        { "path": "**/*.pem", "mode": "deny" },
        { "path": "**/*.key", "mode": "deny" },
        { "path": "~/.ssh", "mode": "deny" },
        { "path": "~/.aws/credentials", "mode": "deny" },
        { "path": "~/.config/gh/hosts.yml", "mode": "deny" },
        { "path": "~/.config/sops/age/keys.txt", "mode": "deny" },
        { "path": "~/.docker/config.json", "mode": "deny" },
        { "path": "~/.netrc", "mode": "deny" },
        { "path": "~/.npmrc", "mode": "deny" }
      ],
      "envVars": [
        { "name": "ANTHROPIC_API_KEY", "mode": "deny" },
        { "name": "AWS_ACCESS_KEY_ID", "mode": "deny" },
        { "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" },
        { "name": "AWS_SESSION_TOKEN", "mode": "deny" },
        { "name": "GH_TOKEN", "mode": "deny" },
        { "name": "GITHUB_TOKEN", "mode": "deny" },
        { "name": "NPM_TOKEN", "mode": "deny" },
        { "name": "SOPS_AGE_KEY", "mode": "deny" }
      ]
    },
    "network": {
      "allowUnixSockets": [
        "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"
      ]
    }
  }
}