{ "sandbox": { "enabled": true, "failIfUnavailable": true, "allowUnsandboxedCommands": false, "excludedCommands": [], "network": { "allowedDomains": [ "code.claude.com", "docs.claude.com", "zed.dev", "github.com", "api.github.com", "registry.npmjs.org" ] } }, "permissions": { "allow": [ "Read", "Write", "Edit", "WebSearch", "Bash(AGENTS/**/*.sh*)", "Bash(bash AGENTS/**/*.sh*)", "Bash(bash AGENTS/**/*.sh* | sed *)", "Bash(bash AGENTS/**/*.sh* | grep *)", "Bash(ls)", "Bash(ls *)", "Bash(pwd)", "Bash(cd *)", "Bash(stat *)", "Bash(file *)", "Bash(du *)", "Bash(df *)", "Bash(wc *)", "Bash(md5 *)", "Bash(which *)", "Bash(command -v *)", "Bash(realpath *)", "Bash(basename *)", "Bash(dirname *)", "Bash(cat *)", "Bash(head *)", "Bash(tail *)", "Bash(diff *)", "Bash(grep *)", "Bash(/usr/bin/grep *)", "Bash(rg *)", "Bash(awk *)", "Bash(sed -n *)", "Bash(find *)", "Bash(sort *)", "Bash(uniq *)", "Bash(cut *)", "Bash(tr *)", "Bash(comm *)", "Bash(jq *)", "Bash(echo *)", "Bash(printf *)", "Bash(date*)", "Bash(env)", "Bash(uname *)", "Bash(whoami)", "Bash(top -l 1*)", "Bash(mkdir *)", "Bash(touch *)", "Bash(cp *)", "Bash(npm run*)", "Bash(npm test*)", "Bash(npm ls*)", "Bash(npm list*)", "Bash(npm ci --ignore-scripts*)", "Bash(npm install --ignore-scripts*)", "Bash(pnpm run*)", "Bash(pnpm test*)", "Bash(pnpm ls*)", "Bash(pnpm list*)", "Bash(pnpm install --ignore-scripts*)", "Bash(yarn run*)", "Bash(yarn test*)", "Bash(tsc*)", "Bash(eslint*)", "Bash(prettier*)", "Bash(shellcheck *)", "Bash(vitest*)", "Bash(jest*)", "Bash(playwright test*)", "Bash(node *)", "Bash(python3 *)", "Bash(bash -n *)", "Bash(make *)", "Bash(git status*)", "Bash(git diff*)", "Bash(git log*)", "Bash(git show*)", "Bash(git blame*)", "Bash(git grep *)", "Bash(git shortlog*)", "Bash(git range-diff*)", "Bash(git ls-files*)", "Bash(git ls-tree*)", "Bash(git ls-remote*)", "Bash(git for-each-ref*)", "Bash(git rev-parse*)", "Bash(git rev-list*)", "Bash(git merge-base*)", "Bash(git merge-tree*)", "Bash(git describe*)", "Bash(git name-rev*)", "Bash(git cat-file*)", "Bash(git diff-tree*)", "Bash(git diff-index*)", "Bash(git diff-files*)", "Bash(git check-ignore*)", "Bash(git check-attr*)", "Bash(git count-objects*)", "Bash(git verify-commit*)", "Bash(git verify-tag*)", "Bash(git branch)", "Bash(git branch -a*)", "Bash(git branch -r*)", "Bash(git branch -v*)", "Bash(git branch --list*)", "Bash(git branch --all*)", "Bash(git branch --remotes*)", "Bash(git branch --contains*)", "Bash(git branch --merged*)", "Bash(git branch --no-merged*)", "Bash(git branch --show-current*)", "Bash(git tag)", "Bash(git tag -l*)", "Bash(git tag -n*)", "Bash(git tag --list*)", "Bash(git tag --contains*)", "Bash(git tag --points-at*)", "Bash(git remote)", "Bash(git remote -v*)", "Bash(git remote show*)", "Bash(git remote get-url*)", "Bash(git stash list*)", "Bash(git stash show*)", "Bash(git reflog)", "Bash(git reflog show*)", "Bash(git fetch*)", "Bash(git version*)", "Bash(git stash push -u -m 'auto-stash: @git-continue')", "Bash(git stash pop)", "Bash(git stash push -u -m 'git-fresh-*')", "Bash(git merge --ff-only origin/main)", "Bash(git merge --ff-only origin/master)", "Bash(git switch main)", "Bash(git switch master)" ], "ask": [ "Bash(dangerouslyDisableSandbox:true)", "Edit(README.md)", "Write(README.md)", "Edit(AGENTS.md)", "Write(AGENTS.md)", "Edit(AGENTS/**)", "Write(AGENTS/**)", "Bash(npx*)", "Bash(bunx*)", "Bash(uvx*)", "Bash(pnpm dlx*)", "Bash(pnpm -* dlx*)", "Bash(yarn dlx*)", "Bash(yarn -* dlx*)", "Bash(bun x*)", "Bash(bun -* x*)", "Bash(pipx run*)", "Bash(pipx -* run*)", "Bash(uv tool run*)", "Bash(uv -* tool run*)", "Bash(deno run*)", "Bash(deno -* run*)", "Bash(go run*)", "Bash(go -* run*)", "Bash(find * -exec *)" ], "deny": [ "Write(~/.claude/**)", "Edit(~/.claude/**)", "Write(.claude/**)", "Edit(.claude/**)", "Bash(sudo *)", "Bash(mkfs*)", "Bash(dd *)", "Bash(rm -rf *)", "Bash(rm -fr *)", "Bash(rm -R *)", "Bash(rm -r *)", "Bash(chmod -R *)", "Bash(chown -R *)", "Bash(shred *)", "Bash(find * -delete*)", "Bash(eval *)", "Bash(node -e *)", "Bash(node --eval *)", "Bash(python -c *)", "Bash(python3 -c *)", "Bash(perl -e *)", "Bash(ruby -e *)", "Bash(curl * | bash)", "Bash(curl * | sh)", "Bash(curl * | python*)", "Bash(wget * | bash)", "Bash(wget * | sh)", "Bash(wget * | python*)", "Bash(*fs.rm*)", "Bash(*fs.unlink*)", "Bash(*fs.rmdir*)", "Bash(*rimraf*)", "Bash(git -c *)", "Bash(git -C *)", "Bash(git --exec-path*)", "Bash(git --git-dir*)", "Bash(git --work-tree*)", "Bash(git --namespace*)", "Bash(git * --output*)", "Bash(git shell*)", "Bash(git credential*)", "Bash(git config*)", "Bash(git daemon*)", "Bash(git instaweb*)", "Bash(git http-backend*)", "Bash(git upload-pack*)", "Bash(git receive-pack*)", "Bash(git cvsserver*)", "Bash(git remote-ext*)", "Bash(git remote-fd*)", "Bash(git web--browse*)", "Bash(git imap-send*)", "Bash(git send-email*)", "Bash(git request-pull*)", "Bash(git difftool*)", "Bash(git mergetool*)", "Bash(git push*)", "Bash(gh repo delete*)", "Bash(gh repo archive*)", "Bash(gh release delete*)", "Bash(gh auth *)", "Bash(gh ssh-key *)", "Bash(gh gpg-key *)", "Bash(gh secret *)", "Bash(gh variable *)", "Bash(git filter-branch*)", "Bash(git filter-repo*)", "Bash(git fast-import*)", "Bash(git fast-export*)", "Bash(git rebase*)", "Bash(git cherry-pick*)", "Bash(git revert*)", "Bash(git replace*)", "Bash(git am*)", "Bash(git apply*)", "Bash(git quiltimport*)", "Bash(git commit)", "Bash(git commit *)", "Bash(git commit-tree*)", "Bash(git merge)", "Bash(git merge-file*)", "Bash(git pull*)", "Bash(git reset*)", "Bash(git restore*)", "Bash(git checkout*)", "Bash(git switch)", "Bash(git switch -c*)", "Bash(git switch -C*)", "Bash(git switch -d*)", "Bash(git switch -f*)", "Bash(git switch -t*)", "Bash(git switch --create*)", "Bash(git switch --force-create*)", "Bash(git switch --force*)", "Bash(git switch --detach*)", "Bash(git switch --discard-changes*)", "Bash(git switch --orphan*)", "Bash(git switch --track*)", "Bash(git switch --guess*)", "Bash(git switch --ignore-other-worktrees*)", "Bash(git clean*)", "Bash(git rm*)", "Bash(git mv*)", "Bash(git add*)", "Bash(git bisect*)", "Bash(git sparse-checkout*)", "Bash(git worktree*)", "Bash(git submodule*)", "Bash(git rerere*)", "Bash(git stash)", "Bash(git stash save*)", "Bash(git stash apply*)", "Bash(git stash drop*)", "Bash(git stash clear*)", "Bash(git stash branch*)", "Bash(git stash create*)", "Bash(git stash store*)", "Bash(git branch -d*)", "Bash(git branch -D*)", "Bash(git branch -f*)", "Bash(git branch -m*)", "Bash(git branch -M*)", "Bash(git branch -c*)", "Bash(git branch -C*)", "Bash(git branch --delete*)", "Bash(git branch --force*)", "Bash(git branch --move*)", "Bash(git branch --copy*)", "Bash(git branch --edit-description*)", "Bash(git branch --set-upstream*)", "Bash(git tag -d*)", "Bash(git tag -f*)", "Bash(git tag -a*)", "Bash(git tag -s*)", "Bash(git tag --delete*)", "Bash(git tag --force*)", "Bash(git tag --sign*)", "Bash(git update-ref*)", "Bash(git symbolic-ref*)", "Bash(git notes*)", "Bash(git remote add*)", "Bash(git remote remove*)", "Bash(git remote rm*)", "Bash(git remote set-url*)", "Bash(git remote set-head*)", "Bash(git remote set-branches*)", "Bash(git remote rename*)", "Bash(git remote prune*)", "Bash(git remote update*)", "Bash(git update-index*)", "Bash(git read-tree*)", "Bash(git write-tree*)", "Bash(git hash-object*)", "Bash(git checkout-index*)", "Bash(git mktree*)", "Bash(git mktag*)", "Bash(git pack-objects*)", "Bash(git unpack-objects*)", "Bash(git index-pack*)", "Bash(git pack-refs*)", "Bash(git prune-packed*)", "Bash(git update-server-info*)", "Bash(git gc*)", "Bash(git prune*)", "Bash(git repack*)", "Bash(git maintenance*)", "Bash(git fsck*)", "Bash(git reflog expire*)", "Bash(git reflog delete*)", "Bash(git clone*)", "Bash(git init*)", "Bash(git bundle*)", "Bash(git archive*)", "Bash(git format-patch*)", "Bash(git bugreport*)", "Bash(git diagnose*)", "Bash(git svn*)", "Bash(git p4*)", "Bash(git cvsimport*)", "Bash(git cvsexportcommit*)", "Bash(dropdb *)", "Bash(db:drop*)", "Bash(prisma migrate reset*)", "Read(//**/.env*)", "Write(//**/.env*)", "Edit(//**/.env*)", "Read(~/**/*.pem)", "Write(~/**/*.pem)", "Edit(~/**/*.pem)", "Read(~/**/*.crt)", "Write(~/**/*.crt)", "Edit(~/**/*.crt)", "Read(//**/*.key)", "Write(//**/*.key)", "Edit(//**/*.key)", "Read(//**/*.p12)", "Write(//**/*.p12)", "Edit(//**/*.p12)", "Read(~/.ssh/**)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Read(~/.aws/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Read(~/.config/gcloud/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Read(~/.kube/**)", "Write(~/.kube/**)", "Edit(~/.kube/**)", "Read(~/.gnupg/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Read(~/.netrc)", "Write(~/.netrc)", "Edit(~/.netrc)", "Read(~/.npmrc)", "Write(~/.npmrc)", "Edit(~/.npmrc)", "Read(~/.bash_history)", "Write(~/.bash_history)", "Edit(~/.bash_history)", "Read(~/.zsh_history)", "Write(~/.zsh_history)", "Edit(~/.zsh_history)", "Read(~/Library/Keychains/**)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Read(~/.zshrc)", "Write(~/.zshrc)", "Edit(~/.zshrc)", "Read(~/.zshenv)", "Write(~/.zshenv)", "Edit(~/.zshenv)", "Read(~/.zprofile)", "Write(~/.zprofile)", "Edit(~/.zprofile)", "Read(~/.bashrc)", "Write(~/.bashrc)", "Edit(~/.bashrc)", "Read(~/.bash_profile)", "Write(~/.bash_profile)", "Edit(~/.bash_profile)", "Read(~/.profile)", "Write(~/.profile)", "Edit(~/.profile)", "Bash(launchctl *)", "Bash(osascript *)", "Bash(defaults write *)", "Bash(git config *core.hooksPath*)", "Bash(git config *alias.*)", "Bash(security *)", "Bash(nc *)", "Bash(ncat *)", "Bash(socat *)", "Bash(scp *)", "Bash(npm publish*)", "Bash(npm -* publish*)", "Bash(pnpm publish*)", "Bash(pnpm -* publish*)", "Bash(yarn publish*)", "Bash(yarn -* publish*)", "Bash(docker push*)", "Bash(docker -* push*)", "Bash(aws s3 rm *)", "Bash(aws -* s3 rm *)", "Bash(kubectl delete *)", "Bash(kubectl -* delete *)", "Bash(terraform destroy*)", "Bash(terraform -* destroy*)", "Edit(**/.git/**)", "Write(**/.git/**)", "Edit(webflow/**)", "Write(webflow/**)" ] }}