From dc5d30bc4a5ad7ae30df1e09b5295a1d330897a2 Mon Sep 17 00:00:00 2001
From: Nat Dean-Lewis <nat.dean-lewis@softwire.com>
Date: Wed, 27 May 2026 10:52:29 +0100
Subject: [PATCH] feat: add .claude/settings.json ALLOWLIST

---
 .claude/settings.json | 76 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 000000000..fa74455c3
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,76 @@
+{
+  "permissions": {
+    "allow": [
+      "WebSearch",
+      "Bash(rg:*)",
+      "Bash(ls:*)",
+      "Bash(bundle exec rspec:*)",
+      "Bash(bundle exec rake lint)",
+      "Bash(bundle exec rake parallel:spec)",
+      "Bash(bundle exec rake parallel:setup)",
+      "Bash(bundle exec rubocop:*)",
+      "Bash(bundle exec erb_lint:*)",
+      "Bash(bundle exec rails:*)",
+      "Bash(bundle exec rake db:migrate)",
+      "Bash(bundle exec rake db:migrate:status)",
+      "Bash(bundle install)",
+      "Bash(yarn install)",
+      "Bash(yarn standard:*)",
+      "Bash(yarn prettier:*)",
+      "Bash(yarn stylelint:*)",
+      "Bash(yarn build:*)",
+      "Bash(git fetch)",
+      "Bash(git pull)",
+      "Bash(git status)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(git branch:*)",
+      "Bash(git checkout:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Edit(app/**)",
+      "Edit(config/**)",
+      "Edit(db/migrate/**)",
+      "Edit(lib/**)",
+      "Edit(spec/**)",
+      "Edit(docs/**)"
+    ],
+    "deny": [
+      "Read(.env*)",
+      "Read(config/master.key)",
+      "Edit(.env*)",
+      "Edit(config/master.key)",
+      "Edit(config/credentials.yml.enc)",
+      "Edit(db/schema.rb)",
+      "Edit(db/structure.sql)",
+      "Edit(Gemfile.lock)",
+      "Edit(yarn.lock)",
+      "Edit(AGENTS.md)",
+      "Edit(AI_CONTEXT.md)",
+      "Edit(WORKFLOW_AI.md)",
+      "Bash(curl:*)",
+      "Bash(wget:*)",
+      "Bash(sudo:*)",
+      "Bash(rm -rf:*)",
+      "Bash(chmod:*)",
+      "Bash(chown:*)",
+      "Bash(echo:*)",
+      "Bash(cat:*)",
+      "Bash(tail:*)",
+      "Bash(head:*)",
+      "Bash(gh:*)",
+      "Bash(git add .)",
+      "Bash(git add --all)",
+      "Bash(git add -A)",
+      "Bash(git push --force)",
+      "Bash(git push --force-with-lease)",
+      "Bash(git reset --hard)",
+      "Bash(bundle exec rake db:drop)",
+      "Bash(bundle exec rake db:reset)"
+    ]
+  },
+  "env": {
+    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
+  }
+}