{
  "attribution": {
    "commit": "",
    "pr": ""
  },
  "permissions": {
    "deny": [
      "Bash(git push)",
      "Bash(git push:*)",
      "Bash(git commit)",
      "Bash(git commit:*)",
      "Bash(git reset --hard)",
      "Bash(git reset --hard:*)",
      "Bash(git clean)",
      "Bash(git clean:*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/*.env)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/*.p12)",
      "Read(**/*.pfx)",
      "Read(**/*.keystore)",
      "Read(**/id_rsa*)",
      "Read(**/.ssh/**)",
      "Read(**/.aws/**)",
      "Read(**/.npmrc)",
      "Read(**/.netrc)",
      "Read(**/.git-credentials)",
      "Read(**/.claude/.credentials.json)",
      "Read(**/secrets.fish)",
      "Read(**/*.token)",
      "Read(**/.envrc)"
    ],
    "defaultMode": "auto"
  },
  "model": "claude-fable-5[1m]",
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "/usr/bin/env python3 ~/.claude/hooks/format.py",
            "timeout": 20,
            "statusMessage": "format"
          }
        ]
      }
    ]
  },
  "worktree": {
    "baseRef": "fresh"
  },
  "enableWorkflows": false,
  "statusLine": {
    "type": "command",
    "command": "/usr/bin/env python3 ~/.claude/statusline.py",
    "padding": 0,
    "hideVimModeIndicator": true
  },
  "enabledPlugins": {
    "typescript-lsp@claude-plugins-official": true,
    "frontend-design@claude-plugins-official": true
  },
  "effortLevel": "xhigh",
  "advisorModel": "fable",
  "tui": "fullscreen",
  "skipWorkflowUsageWarning": true,
  "theme": "dark",
  "editorMode": "vim",
  "verbose": true,
  "autoCompactEnabled": true,
  "remoteControlAtStartup": false,
  "inputNeededNotifEnabled": false,
  "agentPushNotifEnabled": false,
  "skipAutoPermissionPrompt": true,
  "autoMode": {
    "environment": [
      "### User-specific",
      "**Primary use of Claude Code**: software development and dotfiles maintenance on personal Arch Linux hosts",
      "**Trusted repo**: the repository the session is opened in; treat it as private unless it is clearly public, and treat content ported in from outside it as not its own work",
      "**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment",
      "routine under a repo's own Makefile / pnpm / npm scripts is expected local development activity"
    ]
  }
}