{
  // Start every session on Sonnet 5
  "model": "claude-sonnet-5",
  // Reason more deeply than the default high level on models without a saved level; /effort saves a level per model, and --effort sets one for a single session
  "effortLevel": "xhigh",
  // Vim keybindings in the prompt
  "editorMode": "vim",
  // The colorblind-friendly light theme
  "theme": "light-daltonized",
  // A status line below the prompt: model name and context used
  "statusLine": {
    "type": "command",
    "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
    "padding": 2
  },
  // Hide the tips that rotate under the spinner
  "spinnerTipsEnabled": false,
  // Ring the terminal bell for notifications, such as a finished task or a waiting permission prompt
  "preferredNotifChannel": "terminal_bell",
  // Let Claude Code run git diff and read your .zshrc without asking
  "permissions": {
    "allow": [
      "Bash(git diff *)",
      "Read(~/.zshrc)"
    ]
  },
  // Take updates from the stable channel
  "autoUpdatesChannel": "stable",
  // Delete session transcripts and other local session data older than 20 days
  "cleanupPeriodDays": 20
}

{
  "permissions": {
    // Run npm scripts without asking
    "allow": [
      "Bash(npm run *)"
    ],
    // Always confirm before pushing
    "ask": [
      "Bash(git push *)"
    ],
    // Never read env files or the secrets folder
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)"
    ]
  },
  // Send OpenTelemetry metrics to the team's collector over gRPC; replace the endpoint with your collector's URL
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://collector.example.com:4317"
  },
  // Before every Bash command, run a script in the repo that can block it
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
          }
        ]
      }
    ]
  },
  // Register the team's plugin marketplace on every clone
  "extraKnownMarketplaces": {
    "acme-tools": {
      "source": {
        "source": "github",
        "repo": "acme-corp/claude-plugins"
      }
    }
  },
  // Enable one plugin from that marketplace; a plugin from an external source such as a GitHub repository still needs each person to install it once
  "enabledPlugins": {
    "code-formatter@acme-tools": true
  },
  // Sandbox commands: writable build dir; npm and example.com pre-allowed, other hosts still prompt
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "allowWrite": [
        "/tmp/build"
      ]
    },
    "network": {
      "allowedDomains": [
        "registry.npmjs.org",
        "*.example.com"
      ]
    }
  },
  // Keep plan files inside the repo
  "plansDirectory": "./plans"
}

{
  // Only claude.ai logins, and only in this organization
  "forceLoginMethod": "claudeai",
  "forceLoginOrgUUID": [
    "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  ],
  // Only Opus and Sonnet models; with enforceAvailableModels, the Default option obeys the list too
  "availableModels": [
    "opus",
    "sonnet"
  ],
  "enforceAvailableModels": true,
  "permissions": {
    // Block curl, the project's .env file, and its secrets folder on every machine
    "deny": [
      "Bash(curl *)",
      "Read(./.env)",
      "Read(./secrets/**)"
    ],
    // Remove the bypass-permissions mode from every session
    "disableBypassPermissionsMode": "disable"
  },
  // Ignore permission rules from user, project, and local settings
  "allowManagedPermissionRulesOnly": true,
  // Only the GitHub MCP server, matched by URL rather than by name, since a user can
  // name any server "github". Servers that don't match don't load, which includes every
  // stdio server when the list has only URL entries; the lock below makes this managed
  // list the only allowlist that counts
  "allowedMcpServers": [
    {
      "serverUrl": "https://api.githubcopilot.com/*"
    }
  ],
  "allowManagedMcpServersOnly": true,
  // Plugins can come only from this marketplace
  "strictKnownMarketplaces": [
    {
      "source": "github",
      "repo": "acme-corp/approved-plugins"
    }
  ],
  // Sandbox every command Claude runs, refuse to start if the sandbox can't be
  // set up, and never let a blocked command retry outside the sandbox; network
  // limited to npm and GitHub, and users can't add domains
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "network": {
      "allowedDomains": [
        "registry.npmjs.org",
        "github.com"
      ],
      "allowManagedDomainsOnly": true
    }
  },
  // Refuse to start on versions older than 2.1.150
  "requiredMinimumVersion": "2.1.150",
  // Delete session transcripts and other local session data after 7 days
  "cleanupPeriodDays": 7,
  // A message every user sees at startup
  "companyAnnouncements": [
    "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
  ]
}