The whole hunk
from line 88, old and new numbered
/
lines
from line 88
8888 A team's shared settings
8989</h2>
9090
91One team's shared settings, committed to the repository so everyone who clones it gets the same permissions, hooks, telemetry, and plugin marketplace. Save a file like this at `.claude/settings.json` at the top of the repository. Three things to know before you commit one:
91One team's shared settings, committed to the repository so everyone who clones it gets the same permissions, hooks, telemetry, and plugin marketplace. Save a file like this at `.claude/settings.json` at the top of the repository. What to know before you commit one:
9292
9393* **Cloud sessions read it too.** A [cloud session](/docs/en/settings#settings-in-cloud-sessions) on Claude Code on the web starts from a clone of the repository, so the committed file applies there as well.
9494* **Allow rules wait for trust.** Allow rules and `extraKnownMarketplaces` entries take effect after each person [trusts this folder itself](/docs/en/permissions#project-allow-rules-and-workspace-trust), not only a parent folder; deny and ask rules apply in every session, trusted or not.
9595* **The hook is a script in the repo.** This file's hook runs `.claude/hooks/block-rm.sh`; [How a hook resolves](/docs/en/hooks#how-a-hook-resolves) walks through writing it.
96* **Rules match the command and path as written.** `Bash(git push *)` doesn't match [`git -C . push`](/docs/en/permissions#bash-rule-limits). `Read(./.env)` on its own stops the file tools and commands that name the file, such as `cat .env`, but not [`grep -r` run over the directory](/docs/en/permissions#read-and-edit); the `sandbox` block in this file closes that gap, because the sandbox [adds your `Read` deny paths](/docs/en/settings-reference#sandbox-filesystem-denyread) to what every sandboxed command can't read.
9697
9798<Tabs>
9899 <Tab title="Copyable settings file">
from line 173
172173 "allow": [
173174 "Bash(npm run *)"
174175 ],
175 // Always confirm before pushing
176 // Confirm before git push commands
176177 "ask": [
177178 "Bash(git push *)"
178179 ],
179 // Never read env files or the secrets folder
180 // Deny reads of env files and the secrets folder by the file tools and file-reading commands
180181 "deny": [
181182 "Read(./.env)",
182183 "Read(./.env.*)",
from line 248
247248
248249* `forceLoginMethod` and `forceLoginOrgUUID` pin the login method and organization
249250* `availableModels` and `enforceAvailableModels` restrict which models sessions can use
250* `permissions.deny` blocks two file reads and `curl`, and `disableBypassPermissionsMode` removes the bypass permission mode
251* `permissions.deny` denies two file reads and `curl` commands [as Claude writes them](/docs/en/permissions#bash-rule-limits), and `disableBypassPermissionsMode` removes the bypass permission mode
251252* [`allowManagedPermissionRulesOnly`](/docs/en/settings-reference#allowmanagedpermissionrulesonly) and [`allowManagedMcpServersOnly`](/docs/en/settings-reference#allowmanagedmcpserversonly) make the managed permission and MCP allowlists the only ones that apply
252253* `allowedMcpServers` pins the MCP server by URL
253254* `strictKnownMarketplaces` allows one plugin marketplace
from line 333
332333 ],
333334 "enforceAvailableModels": true,
334335 "permissions": {
335 // Block curl, the project's .env file, and its secrets folder on every machine
336 // Deny curl commands and reads of the project's .env file and secrets folder on every machine
336337 "deny": [
337338 "Bash(curl *)",
338339 "Read(./.env)",