{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(ssh:*)",
      "Bash(scp:*)",
      "Bash(sftp:*)",
      "Bash(ssh-add:*)",
      "Bash(ssh-keygen:*)",
      "Bash(ssh-copy-id:*)",
      "Bash(rsync:*)",
      "Bash(git status*)",
      "Bash(git diff*)",
      "Bash(git log*)",
      "Bash(git show*)",
      "Bash(git branch*)",
      "Bash(git rev-parse*)",
      "Bash(git blame*)",
      "Bash(git ls-files*)",
      "Bash(git config --get*)",
      "Bash(git remote -v)",
      "Bash(git remote show*)",
      "Bash(git shortlog*)",
      "Bash(git reflog*)",
      "Bash(git checkout*)",
      "Bash(git switch*)",
      "Bash(git add*)",
      "Bash(git commit*)",
      "Bash(git pull*)",
      "Bash(git fetch*)",
      "Bash(git stash*)",
      "Bash(git push origin*)",
      "Bash(git cherry-pick*)",
      "Bash(git restore*)",
      "Bash(git tag*)",
      "Bash(git cherry-pick --abort)",
      "Bash(git merge --abort)",
      "Bash(git rebase --abort)",

      "Bash(gh auth status*)",
      "Bash(gh pr view*)",
      "Bash(gh pr list*)",
      "Bash(gh pr diff*)",
      "Bash(gh pr checks*)",
      "Bash(gh pr status*)",
      "Bash(gh pr create*)",
      "Bash(gh pr comment*)",
      "Bash(gh pr checkout*)",
      "Bash(gh pr ready*)",
      "Bash(gh pr edit*)",
      "Bash(gh pr review --comment*)",
      "Bash(gh issue view*)",
      "Bash(gh issue list*)",
      "Bash(gh issue create*)",
      "Bash(gh issue comment*)",
      "Bash(gh issue edit*)",
      "Bash(gh issue close*)",
      "Bash(gh issue reopen*)",
      "Bash(gh run view*)",
      "Bash(gh run list*)",
      "Bash(gh run watch*)",
      "Bash(gh run download*)",
      "Bash(gh workflow view*)",
      "Bash(gh workflow list*)",
      "Bash(gh workflow run*)",
      "Bash(gh repo view*)",
      "Bash(gh repo list*)",
      "Bash(gh repo clone*)",
      "Bash(gh release view*)",
      "Bash(gh release list*)",
      "Bash(gh release download*)",
      "Bash(gh api*)",
      "Bash(gh secret list*)",
      "Bash(gh label list*)",
      "Bash(gh variable list*)",
      "Bash(gh browse*)",

      "Bash(az --version)",
      "Bash(az --help*)",
      "Bash(az account show*)",
      "Bash(az account list*)",
      "Bash(az account get-access-token*)",
      "Bash(az group list*)",
      "Bash(az group show*)",
      "Bash(az containerapp list*)",
      "Bash(az containerapp show*)",
      "Bash(az containerapp logs show*)",
      "Bash(az containerapp logs tail*)",
      "Bash(az containerapp revision list*)",
      "Bash(az containerapp revision show*)",
      "Bash(az containerapp ingress show*)",
      "Bash(az containerapp ingress cors show*)",
      "Bash(az containerapp identity show*)",
      "Bash(az containerapp env show*)",
      "Bash(az containerapp env list*)",
      "Bash(az containerapp env logs show*)",
      "Bash(az containerapp job list*)",
      "Bash(az containerapp job show*)",
      "Bash(az containerapp job execution list*)",
      "Bash(az containerapp job execution show*)",
      "Bash(az containerapp replica list*)",
      "Bash(az containerapp replica show*)",
      "Bash(az keyvault list*)",
      "Bash(az keyvault show*)",
      "Bash(az keyvault secret list*)",
      "Bash(az keyvault secret show*)",
      "Bash(az keyvault secret list-versions*)",
      "Bash(az keyvault key list*)",
      "Bash(az keyvault key show*)",
      "Bash(az keyvault certificate list*)",
      "Bash(az keyvault certificate show*)",
      "Bash(az acr list*)",
      "Bash(az acr show*)",
      "Bash(az acr repository list*)",
      "Bash(az acr repository show*)",
      "Bash(az acr repository show-tags*)",
      "Bash(az acr repository show-manifests*)",
      "Bash(az acr manifest list*)",
      "Bash(az acr manifest show*)",
      "Bash(az acr task list*)",
      "Bash(az acr task show*)",
      "Bash(az acr task show-run*)",
      "Bash(az postgres server show*)",
      "Bash(az postgres server list*)",
      "Bash(az postgres flexible-server show*)",
      "Bash(az postgres flexible-server list*)",
      "Bash(az postgres flexible-server db list*)",
      "Bash(az postgres flexible-server db show*)",
      "Bash(az postgres flexible-server parameter show*)",
      "Bash(az postgres flexible-server parameter list*)",
      "Bash(az redis show*)",
      "Bash(az redis list*)",
      "Bash(az storage account show*)",
      "Bash(az storage account list*)",
      "Bash(az storage account show-connection-string*)",
      "Bash(az storage blob list*)",
      "Bash(az storage blob show*)",
      "Bash(az storage container list*)",
      "Bash(az storage container show*)",
      "Bash(az staticwebapp list*)",
      "Bash(az staticwebapp show*)",
      "Bash(az staticwebapp environment list*)",
      "Bash(az staticwebapp hostname list*)",
      "Bash(az monitor metrics list*)",
      "Bash(az monitor log-analytics workspace show*)",
      "Bash(az monitor log-analytics query*)",
      "Bash(az monitor alert list*)",
      "Bash(az monitor activity-log list*)",
      "Bash(az monitor diagnostic-settings list*)",
      "Bash(az monitor diagnostic-settings show*)",
      "Bash(az deployment group list*)",
      "Bash(az deployment group show*)",
      "Bash(az deployment sub list*)",
      "Bash(az deployment sub show*)",
      "Bash(az deployment operation group list*)",
      "Bash(az deployment group what-if*)",
      "Bash(az deployment sub what-if*)",
      "Bash(az resource list*)",
      "Bash(az resource show*)",
      "Bash(az role assignment list*)",
      "Bash(az role assignment show*)",
      "Bash(az role definition list*)",
      "Bash(az identity list*)",
      "Bash(az identity show*)",
      "Bash(az network vnet list*)",
      "Bash(az network vnet show*)",
      "Bash(az network private-endpoint list*)",
      "Bash(az network private-endpoint show*)",
      "Bash(az network nsg list*)",
      "Bash(az network nsg show*)",
      "Bash(az network public-ip list*)",
      "Bash(az bicep build*)",
      "Bash(az bicep decompile*)",
      "Bash(az bicep version*)",
      "Bash(az servicebus*show*)",
      "Bash(az servicebus*list*)",
      "Bash(az ad user show*)",
      "Bash(az ad user list*)",
      "Bash(az ad app show*)",
      "Bash(az ad app list*)",
      "Bash(az ad sp show*)",
      "Bash(az ad sp list*)",

      "Bash(npm install*)",
      "Bash(npm ci*)",
      "Bash(npm test*)",
      "Bash(npm run*)",
      "Bash(npm audit*)",
      "Bash(npm outdated*)",
      "Bash(npm list*)",
      "Bash(npm view*)",
      "Bash(pnpm install*)",
      "Bash(pnpm run*)",
      "Bash(pnpm test*)",
      "Bash(pnpm list*)",
      "Bash(pnpm outdated*)",
      "Bash(pnpm audit*)",
      "Bash(bun install*)",
      "Bash(bun test*)",
      "Bash(bun run*)",
      "Bash(yarn*)",
      "Bash(pip install*)",
      "Bash(pip list*)",
      "Bash(pip show*)",
      "Bash(pip check*)",
      "Bash(uv pip*)",
      "Bash(uv run*)",
      "Bash(uv sync*)",
      "Bash(pytest*)",
      "Bash(ruff*)",
      "Bash(black*)",
      "Bash(mypy*)",
      "Bash(isort*)",
      "Bash(flake8*)",
      "Bash(pip-audit*)",
      "Bash(alembic current*)",
      "Bash(alembic heads*)",
      "Bash(alembic history*)",
      "Bash(alembic upgrade*)",
      "Bash(alembic check*)",
      "Bash(alembic revision --autogenerate*)",
      "Bash(prisma validate*)",
      "Bash(prisma migrate status*)",
      "Bash(prisma migrate diff*)",
      "Bash(prisma migrate dev*)",
      "Bash(prisma migrate deploy*)",
      "Bash(prisma generate*)",
      "Bash(npx prisma*)",
      "Bash(go build*)",
      "Bash(go test*)",
      "Bash(go vet*)",
      "Bash(go fmt*)",
      "Bash(go mod*)",
      "Bash(go list*)",
      "Bash(go version*)",
      "Bash(go install*)",
      "Bash(golangci-lint*)",
      "Bash(govulncheck*)",
      "Bash(make*)",

      "Bash(docker compose build*)",
      "Bash(docker compose config*)",
      "Bash(docker compose ps*)",
      "Bash(docker compose logs*)",
      "Bash(docker compose exec*)",
      "Bash(docker images*)",
      "Bash(docker ps*)",
      "Bash(docker inspect*)",
      "Bash(docker logs*)",
      "Bash(docker version*)",
      "Bash(docker info*)",

      "Bash(kubectl get*)",
      "Bash(kubectl describe*)",
      "Bash(kubectl logs*)",
      "Bash(kubectl top*)",
      "Bash(kubectl version*)",
      "Bash(kubectl config get-contexts*)",
      "Bash(kubectl config view*)",

      "Bash(rg*)",
      "Bash(fd*)",
      "Bash(jq*)",
      "Bash(yq*)",
      "Bash(ls*)",
      "Bash(cat*)",
      "Bash(head*)",
      "Bash(tail*)",
      "Bash(wc*)",
      "Bash(file*)",
      "Bash(stat*)",
      "Bash(du*)",
      "Bash(df*)",
      "Bash(find*)",
      "Bash(which*)",
      "Bash(whereis*)",
      "Bash(type*)",
      "Bash(env)",
      "Bash(pwd)",
      "Bash(date*)",
      "Bash(echo*)",
      "Bash(printf*)",
      "Bash(uname*)",
      "Bash(hostname*)",
      "Bash(id*)",
      "Bash(groups*)",
      "Bash(ps*)",
      "Bash(top -b*)",
      "Bash(free*)",
      "Bash(uptime*)",

      "Bash(curl -s*)",
      "Bash(curl -sL*)",
      "Bash(curl -sI*)",
      "Bash(curl -I*)",
      "Bash(curl -o*)",
      "Bash(curl --silent*)",
      "Bash(curl --fail*)",
      "Bash(wget -O*)",
      "Bash(wget --quiet*)",
      "Bash(grep*)",
      "Bash(awk*)",
      "Bash(sed -n*)",
      "Bash(sort*)",
      "Bash(uniq*)",
      "Bash(cut*)",
      "Bash(tr*)",
      "Bash(xargs*)",
      "Bash(tee*)",
      "Bash(column*)",
      "Bash(base64*)",
      "Bash(md5sum*)",
      "Bash(sha256sum*)",

      "Bash(psql -c \\dt*)",
      "Bash(psql -c \\dn*)",
      "Bash(psql -c \\l*)",
      "Bash(psql -c SELECT*)",
      "Bash(redis-cli INFO*)",
      "Bash(redis-cli DBSIZE*)",
      "Bash(redis-cli KEYS*)",
      "Bash(redis-cli GET*)",
      "Bash(redis-cli TYPE*)",
      "Bash(redis-cli PING*)"
    ],
    "deny": [
      "Bash(git push --force*)",
      "Bash(git push -f*)",
      "Bash(git push origin main*)",
      "Bash(git push origin master*)",
      "Bash(git clean -fdx*)",
      "Bash(git commit --amend*)",
      "Bash(git filter-branch*)",
      "Bash(git filter-repo*)",
      "Bash(git branch -D*)",
      "Bash(git tag -d*)",
      "Bash(git push*--delete*)",

      "Bash(rm -rf /*)",
      "Bash(rm -rf ~*)",
      "Bash(rm -rf ~/*)",
      "Bash(rm -rf /Volumes/*)",
      "Bash(sudo*)",
      "Bash(su*)",
      "Bash(chmod 777*)",
      "Bash(chown*)",

      "Bash(docker system prune*)",
      "Bash(docker volume rm*)",
      "Bash(docker volume prune*)",
      "Bash(docker image prune*)",
      "Bash(docker rm*)",
      "Bash(docker rmi*)",

      "Bash(az login*)",
      "Bash(az logout*)",
      "Bash(az account set*)",
      "Bash(az containerapp update*)",
      "Bash(az containerapp create*)",
      "Bash(az containerapp delete*)",
      "Bash(az containerapp restart*)",
      "Bash(az containerapp revision set-mode*)",
      "Bash(az containerapp revision activate*)",
      "Bash(az containerapp revision deactivate*)",
      "Bash(az containerapp revision restart*)",
      "Bash(az containerapp ingress update*)",
      "Bash(az containerapp ingress cors update*)",
      "Bash(az containerapp identity assign*)",
      "Bash(az containerapp identity remove*)",
      "Bash(az containerapp env create*)",
      "Bash(az containerapp env update*)",
      "Bash(az containerapp env delete*)",
      "Bash(az containerapp job create*)",
      "Bash(az containerapp job update*)",
      "Bash(az containerapp job delete*)",
      "Bash(az containerapp job start*)",
      "Bash(az containerapp job stop*)",
      "Bash(az deployment group create*)",
      "Bash(az deployment group delete*)",
      "Bash(az deployment sub create*)",
      "Bash(az deployment sub delete*)",
      "Bash(az keyvault create*)",
      "Bash(az keyvault update*)",
      "Bash(az keyvault delete*)",
      "Bash(az keyvault secret set*)",
      "Bash(az keyvault secret delete*)",
      "Bash(az keyvault secret restore*)",
      "Bash(az keyvault key create*)",
      "Bash(az keyvault key delete*)",
      "Bash(az keyvault key restore*)",
      "Bash(az keyvault certificate create*)",
      "Bash(az keyvault certificate delete*)",
      "Bash(az acr create*)",
      "Bash(az acr delete*)",
      "Bash(az acr update*)",
      "Bash(az acr login*)",
      "Bash(az acr import*)",
      "Bash(az acr build*)",
      "Bash(az acr task create*)",
      "Bash(az acr task update*)",
      "Bash(az acr task delete*)",
      "Bash(az acr task run*)",
      "Bash(az acr repository delete*)",
      "Bash(az acr repository untag*)",
      "Bash(az postgres server create*)",
      "Bash(az postgres server delete*)",
      "Bash(az postgres server update*)",
      "Bash(az postgres server restart*)",
      "Bash(az postgres flexible-server create*)",
      "Bash(az postgres flexible-server delete*)",
      "Bash(az postgres flexible-server update*)",
      "Bash(az postgres flexible-server restart*)",
      "Bash(az postgres flexible-server start*)",
      "Bash(az postgres flexible-server stop*)",
      "Bash(az postgres flexible-server db create*)",
      "Bash(az postgres flexible-server db delete*)",
      "Bash(az redis create*)",
      "Bash(az redis delete*)",
      "Bash(az redis update*)",
      "Bash(az redis regenerate-keys*)",
      "Bash(az storage account create*)",
      "Bash(az storage account delete*)",
      "Bash(az storage account update*)",
      "Bash(az storage blob upload*)",
      "Bash(az storage blob delete*)",
      "Bash(az storage blob copy*)",
      "Bash(az storage container create*)",
      "Bash(az storage container delete*)",
      "Bash(az staticwebapp create*)",
      "Bash(az staticwebapp delete*)",
      "Bash(az staticwebapp update*)",
      "Bash(az group create*)",
      "Bash(az group delete*)",
      "Bash(az group update*)",
      "Bash(az resource create*)",
      "Bash(az resource delete*)",
      "Bash(az resource update*)",
      "Bash(az resource move*)",
      "Bash(az role assignment create*)",
      "Bash(az role assignment delete*)",
      "Bash(az identity create*)",
      "Bash(az identity delete*)",
      "Bash(az network vnet create*)",
      "Bash(az network vnet delete*)",
      "Bash(az network vnet update*)",
      "Bash(az network nsg rule create*)",
      "Bash(az network nsg rule delete*)",

      "Bash(gh pr merge*)",
      "Bash(gh pr close*)",
      "Bash(gh pr review --approve*)",
      "Bash(gh pr review --request-changes*)",
      "Bash(gh release create*)",
      "Bash(gh release delete*)",
      "Bash(gh release edit*)",
      "Bash(gh repo delete*)",
      "Bash(gh repo archive*)",
      "Bash(gh repo create*)",
      "Bash(gh repo rename*)",
      "Bash(gh repo transfer*)",
      "Bash(gh secret set*)",
      "Bash(gh secret delete*)",
      "Bash(gh variable set*)",
      "Bash(gh variable delete*)",
      "Bash(gh workflow disable*)",
      "Bash(gh workflow enable*)",
      "Bash(gh label create*)",
      "Bash(gh label delete*)",
      "Bash(gh label edit*)",

      "Bash(terraform destroy*)",
      "Bash(terraform apply*)",
      "Bash(terraform taint*)",
      "Bash(terraform import*)",

      "Bash(kubectl delete*)",
      "Bash(kubectl apply*)",
      "Bash(kubectl create*)",
      "Bash(kubectl edit*)",
      "Bash(kubectl patch*)",
      "Bash(kubectl replace*)",
      "Bash(kubectl scale*)",
      "Bash(kubectl rollout*)",
      "Bash(kubectl exec*)",
      "Bash(kubectl cp*)",

      "Bash(alembic downgrade*)",
      "Bash(dropdb*)",
      "Bash(createdb*)",
      "Bash(pg_dump --clean*)",
      "Bash(psql*DROP*)",
      "Bash(psql*DELETE FROM*)",
      "Bash(psql*TRUNCATE*)",
      "Bash(psql*UPDATE*)",
      "Bash(psql*production*)",
      "Bash(redis-cli FLUSHDB*)",
      "Bash(redis-cli FLUSHALL*)",
      "Bash(redis-cli CONFIG*)",
      "Bash(redis-cli DEBUG*)",
      "Bash(redis-cli SHUTDOWN*)",

      "Bash(ssh*)",
      "Bash(scp*)",
      "Bash(rsync --delete*)",

      "Read(./**/.env)",
      "Read(./**/.env.local)",
      "Read(./**/.env.production)",
      "Read(./**/.env.development)",
      "Read(./**/secrets/**)",
      "Read(./**/*.pem)",
      "Read(./**/*.key)",
      "Read(./casdoor-internal/conf/app.conf)",
      "Write(./**/.env)",
      "Write(./**/.env.local)",
      "Write(./**/.env.production)",
      "Write(./**/secrets/**)"
    ]
  },
  "env": {
    "DISABLE_TELEMETRY": "0",
    "CLAUDE_CODE_MAX_OUTPUT_TOKENS": "32000"
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash $CLAUDE_PROJECT_DIR/.claude/hooks/pre-commit-check.sh"
          }
        ]
      }
    ]
  }
}