The whole hunk
from line 154, old and new numbered
/
lines
from line 154
154154The deny rules can cover everyone working in the repository, only you, or every session on the machine, depending on which settings file you put them in:
155155
156156* **Everyone working in the repository**: commit the rules to `.claude/settings.json`, at the repository root if you start Claude there, or in each package's `.claude/` if you start from subdirectories. Like other project settings on this page, that file isn't inherited from parent directories.
157* **Yourself only**: use `.claude/settings.local.json` at the repository root, which loads in every CLI session inside the repository regardless of starting directory, except in the cases where Claude Code [doesn't use the repository root](/docs/en/settings#where-claude-code-looks-for-each-file), such as on Windows. Relative patterns like the example's `Read(./vendor/**)` still [anchor at the session's current working directory](/docs/en/permissions#read-and-edit) rather than the repository root, so if you start sessions from subdirectories, write the rules in this file as `//`-absolute paths, such as `Read(//absolute/path/to/repo/vendor/**)`. Before v2.1.211, `.claude/settings.local.json` also loaded only from the starting directory.
157* **Yourself only**: use `.claude/settings.local.json` at the repository root, which loads in every CLI session inside the repository regardless of starting directory, except in the cases where Claude Code [doesn't use the repository root](/docs/en/settings#where-claude-code-looks-for-each-file), such as on Windows. Relative patterns like the example's `Read(./**/vendor/**/*)` still [anchor at the session's current working directory](/docs/en/permissions#read-and-edit) rather than the repository root, so if you start sessions from subdirectories, write the rules in this file as `//`-absolute paths, such as `Read(//absolute/path/to/repo/**/vendor/**/*)`. Before v2.1.211, `.claude/settings.local.json` also loaded only from the starting directory.
158158* **Everyone, enforced in every session**: set the rules in [managed settings](/docs/en/managed-settings), which user and project settings cannot override.
159159
160The example below blocks build artifacts and a vendored SDK:
160The example below blocks build artifacts and a vendored SDK. Its directory patterns end with `/**/*` rather than `/**` so that each rule covers everything inside the directory but not the directory itself. Claude can then still list those directories or change into them, for example with `ls dist` or `cd build`.
161161
162162```json .claude/settings.json theme={null}
163163{
164164 "permissions": {
165165 "deny": [
166 "Read(./**/dist/**)",
167 "Read(./**/build/**)",
166 "Read(./**/dist/**/*)",
167 "Read(./**/build/**/*)",
168168 "Read(./**/*.generated.*)",
169 "Read(./vendor/**)"
169 "Read(./**/vendor/**/*)"
170170 ]
171171 }
172172}
from line 406
406406 "../shared"
407407 ],
408408 "deny": [
409 "Read(./**/dist/**)",
410 "Read(./**/build/**)"
409 "Read(./**/dist/**/*)",
410 "Read(./**/build/**/*)"
411411 ]
412412 }
413413}
from line 421
421421{
422422 "permissions": {
423423 "deny": [
424 "Read(./**/dist/**)",
425 "Read(./**/build/**)"
424 "Read(./**/dist/**/*)",
425 "Read(./**/build/**/*)"
426426 ]
427427 }
428428}