Claude Code guardrails — settings.json (permissions, hooks, autoMode rules)

settings.json

{
  "env": {
    "ENABLE_CLAUDEAI_MCP_SERVERS": "false"
  },
  "permissions": {
    "allow": [
      "Bash(*)",
      "Bash(rm -rf /tmp/*)",
      "Bash(gh repo create:*)",
      "Read",
      "WebFetch",
      "WebSearch"
    ],
    "deny": [
      "Bash(git push --force *)",
      "Bash(git reset --hard *)",
      "Bash(git checkout .)",
      "Bash(git restore *)"
    ],
    "ask": [
      "Bash(rm -rf *)",
      "Bash(git push *)",
      "Bash(git push)",
      "Bash(curl *)",
      "Bash(wget *)"
    ],
    "defaultMode": "acceptEdits"
  },
  "hooks": {
    "UserPromptSubmit": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/auto-kickoff.sh",
            "timeout": 3
          }
        ]
      },
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo \"Current time: $(date '+%Y-%m-%d %H:%M %Z') | $(TZ='America/New_York' date '+%H:%M %Z') ET\"",
            "timeout": 2
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/post-edit-stub-check.py",
            "timeout": 3
          },
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/post-edit-secret-scan.py",
            "timeout": 3
          }
        ]
      },
      {
        "matcher": "Write",
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/post-write-serve.sh",
            "timeout": 10
          }
        ]
      }
    ],
    "StopFailure": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/stop-failure-throttle.sh",
            "timeout": 5
          }
        ]
      }
    ],
    "SessionEnd": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/session-end-snapshot.sh",
            "timeout": 30
          }
        ]
      }
    ],
    "PreToolUse": [
      {
        "matcher": "WebFetch|WebSearch",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/pre-web-rfip.py",
            "timeout": 2
          }
        ]
      }
    ]
  },
  "statusLine": {
    "type": "command",
    "command": "bash ~/.claude/statusline-command.sh"
  },
  "model": "claude-opus-4-7[1m]",
  "autoMode": {
    "allow": [
      "$defaults",
      "Creating new GitHub repositories under the PropterMalone account (gh repo create PropterMalone/*) is in scope. PropterMalone is the pseudonymous GitHub identity for public-facing work; new repo creation under that account is part of normal workflow, not a high-risk action.",
      "Switching the active gh user between <personal-account> and PropterMalone (gh auth switch --user *) is in scope. The publish flow requires switching to PropterMalone for public-repo operations and switching back to <personal-account> after — both directions are routine."
    ]
  },
  "enabledPlugins": {
    "ed3d-00-getting-started@ed3d-plugins": false,
    "ed3d-basic-agents@ed3d-plugins": false,
    "ed3d-extending-claude@ed3d-plugins": false,
    "ed3d-hook-claudemd-reminder@ed3d-plugins": false,
    "ed3d-hook-skill-reinforcement@ed3d-plugins": false,
    "ed3d-house-style@ed3d-plugins": false,
    "ed3d-plan-and-execute@ed3d-plugins": false,
    "ed3d-playwright@ed3d-plugins": false,
    "ed3d-hook-security-hardening@ed3d-plugins": false,
    "ed3d-research-agents@ed3d-plugins": false,
    "polish-skills@local": true
  },
  "effortLevel": "xhigh"
}