{
  "attribution": {
    "commit": "",
    "pr": ""
  },
  "permissions": {
    "deny": [
      "Bash(git push)",
      "Bash(git push:*)",
      "Bash(git commit)",
      "Bash(git commit:*)",
      "Bash(git reset --hard)",
      "Bash(git reset --hard:*)",
      "Bash(git clean)",
      "Bash(git clean:*)",
      "Bash(gh pr merge)",
      "Bash(gh pr merge:*)",
      "Bash(gh pr create)",
      "Bash(gh pr create:*)",
      "Bash(gh pr close)",
      "Bash(gh pr close:*)",
      "Bash(gh pr edit)",
      "Bash(gh pr edit:*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/*.env)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/*.p12)",
      "Read(**/*.pfx)",
      "Read(**/*.keystore)",
      "Read(**/id_rsa*)",
      "Read(**/.ssh/**)",
      "Read(**/.aws/**)",
      "Read(**/.npmrc)",
      "Read(**/.netrc)",
      "Read(**/.git-credentials)",
      "Read(**/.claude/.credentials.json)",
      "Read(**/secrets.fish)",
      "Read(**/*.token)",
      "Read(**/.envrc)",
      "Read(**/.gnupg/**)",
      "Read(**/fish_variables)"
    ],
    "defaultMode": "auto"
  },
  "model": "claude-fable-5-1[1m]",
  "hooks": {
    "SessionStart": [
      {
        "matcher": "startup|resume",
        "hooks": [
          {
            "type": "command",
            "command": "f=\"$HOME/.claude/hooks/drift-check.sh\"; if [ -f \"$f\" ]; then exec bash \"$f\"; fi",
            "timeout": 5
          }
        ]
      }
    ],
    "UserPromptSubmit": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "f=\"$HOME/.claude/hooks/drift-check.sh\"; if [ -f \"$f\" ]; then out=$(bash \"$f\" 2>&1); [ -n \"$out\" ] && printf \"%s\\n\" \"$out\"; fi; exit 0",
            "timeout": 5
          }
        ]
      }
    ],
    "UserPromptExpansion": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "f=\"$HOME/.claude/hooks/local-commands.py\"; if [ -f \"$f\" ]; then exec /usr/bin/env python3 \"$f\"; fi",
            "timeout": 25
          }
        ]
      }
    ],
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "f=\"$HOME/.claude/hooks/git-guard.py\"; if [ -f \"$f\" ]; then exec /usr/bin/env python3 \"$f\"; fi",
            "timeout": 5
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "/usr/bin/env python3 ~/.claude/hooks/format.py",
            "timeout": 20,
            "statusMessage": "format"
          }
        ]
      },
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "/usr/bin/env python3 ~/.claude/hooks/format.py",
            "timeout": 20
          }
        ]
      }
    ],
    "Notification": [
      {
        "matcher": "idle_prompt|permission_prompt",
        "hooks": [
          {
            "type": "command",
            "command": "f=\"$HOME/.claude/hooks/notify.py\"; if [ -f \"$f\" ]; then exec /usr/bin/env python3 \"$f\"; fi",
            "timeout": 5
          }
        ]
      }
    ]
  },
  "worktree": {
    "baseRef": "fresh"
  },
  "enableWorkflows": false,
  "statusLine": {
    "type": "command",
    "command": "/usr/bin/env python3 ~/.claude/statusline.py",
    "padding": 0,
    "hideVimModeIndicator": true
  },
  "enabledPlugins": {
    "typescript-lsp@claude-plugins-official": true,
    "frontend-design@claude-plugins-official": true
  },
  "effortLevel": "xhigh",
  "advisorModel": "fable",
  "tui": "fullscreen",
  "skipWorkflowUsageWarning": true,
  "theme": "dark",
  "editorMode": "vim",
  "verbose": true,
  "autoCompactEnabled": true,
  "remoteControlAtStartup": false,
  "inputNeededNotifEnabled": false,
  "agentPushNotifEnabled": false,
  "skipAutoPermissionPrompt": true,
  "autoMode": {
    "environment": [
      "### User-specific",
      "**Primary use of Claude Code**: software development and dotfiles maintenance on personal Arch Linux hosts",
      "**Trusted repo**: the repository the session is opened in; treat it as private unless it is clearly public, and treat content ported in from outside it as not its own work",
      "**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment",
      "routine under a repo's own Makefile / pnpm / npm scripts is expected local development activity"
    ]
  }
}