From 52ac7cc02ec1fb70b6e43418818243f5ef223c10 Mon Sep 17 00:00:00 2001
From: Yuichi TSUNEMATSU <tsunematsu.yuichi@moneyforwardprivatebank.com>
Date: Sat, 8 Aug 2026 18:25:57 +0900
Subject: [PATCH] =?UTF-8?q?feat(claude):=20=E6=A8=A9=E9=99=90=E3=83=97?=
 =?UTF-8?q?=E3=83=AD=E3=83=B3=E3=83=97=E3=83=88=E5=89=8A=E6=B8=9B=E3=81=A8?=
 =?UTF-8?q?=E3=82=BB=E3=82=AD=E3=83=A5=E3=83=AA=E3=83=86=E3=82=A3=E5=BC=B7?=
 =?UTF-8?q?=E5=8C=96=E3=81=AE=E3=81=9F=E3=82=81=E3=81=AE=E8=A8=AD=E5=AE=9A?=
 =?UTF-8?q?=E3=82=92=E8=BF=BD=E5=8A=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 認証情報ファイルの読み取りや破壊的なgit操作を permissions.deny でブロック
- terraform/kubectl/docker/gh merge 等の重要操作を permissions.ask で個別確認に
- ネイティブサンドボックスを有効化し、サンドボックス内Bashを自動許可
- dangerouslyDisableSandbox使用時に承認を求めるPreToolUseフックを追加
---
 dot_claude/settings.json | 143 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 143 insertions(+)

diff --git a/dot_claude/settings.json b/dot_claude/settings.json
index 5230f56..b50a9b9 100644
--- a/dot_claude/settings.json
+++ b/dot_claude/settings.json
@@ -11,8 +11,151 @@
           }
         ]
       }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "grep -q '\"dangerouslyDisableSandbox\"[[:space:]]*:[[:space:]]*true' && echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"サンドボックス外での実行には承認が必要です\"}}'; exit 0",
+            "timeout": 10,
+            "statusMessage": "sandbox-escape-gate"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "allow": [
+      "Bash(git *)",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:api.github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebFetch(domain:*.githubusercontent.com)",
+      "WebFetch(domain:*.googleapis.com)",
+      "WebFetch(domain:accounts.google.com)",
+      "WebFetch(domain:*.slack.com)",
+      "WebFetch(domain:*.amazonaws.com)",
+      "WebFetch(domain:registry.npmjs.org)",
+      "WebFetch(domain:registry.terraform.io)",
+      "WebFetch(domain:docs.anthropic.com)",
+      "WebFetch(domain:code.claude.com)",
+      "WebSearch(*)"
+    ],
+    "ask": [
+      "Bash(terraform apply*)",
+      "Bash(terraform destroy*)",
+      "Bash(kubectl apply*)",
+      "Bash(kubectl delete*)",
+      "Bash(docker push*)",
+      "Bash(gh pr merge*)"
+    ],
+    "deny": [
+      "Read(**/.env)",
+      "Read(**/.envrc)",
+      "Read(**/.env.*)",
+      "Read(**/secrets/**)",
+      "Read(**/credentials)",
+      "Read(~/.aws/credentials)",
+      "Read(~/.aws/config)",
+      "Read(~/.ssh/id_*)",
+      "Read(~/.netrc)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(~/.config/gcloud/application_default_credentials.json)",
+      "Bash(sudo *)",
+      "Bash(su *)",
+      "Bash(git push --force *)",
+      "Bash(git push -f *)",
+      "Bash(git reset --hard *)",
+      "Bash(git clean -f *)"
     ]
   },
+  "sandbox": {
+    "enabled": true,
+    "autoAllowBashIfSandboxed": true,
+    "allowUnsandboxedCommands": true,
+    "excludedCommands": [
+      "git *",
+      "docker *",
+      "docker-compose *",
+      "gh *",
+      "chezmoi *",
+      "gcloud *",
+      "bq *",
+      "gsutil *",
+      "aws *",
+      "kubectl *",
+      "terraform *"
+    ],
+    "filesystem": {
+      "denyRead": [
+        "~/.aws/",
+        "~/.ssh/",
+        "~/.netrc",
+        "~/.config/gcloud/",
+        "~/.config/gh/",
+        "~/.kube/"
+      ],
+      "allowWrite": [
+        "~/.npm",
+        "~/.pnpm-store",
+        "~/go/pkg",
+        "~/Library/Caches/go-build",
+        "~/.gradle/caches",
+        "~/.gradle/wrapper",
+        "~/.m2/repository",
+        "~/.cargo/registry",
+        "~/.cargo/git",
+        "~/.cache"
+      ]
+    },
+    "network": {
+      "allowedDomains": [
+        "github.com",
+        "*.github.com",
+        "api.github.com",
+        "raw.githubusercontent.com",
+        "*.githubusercontent.com",
+        "registry.npmjs.org",
+        "*.npmjs.com",
+        "registry.yarnpkg.com",
+        "rubygems.org",
+        "*.rubygems.org",
+        "pypi.org",
+        "*.pypi.org",
+        "files.pythonhosted.org",
+        "proxy.golang.org",
+        "sum.golang.org",
+        "golang.org",
+        "crates.io",
+        "static.crates.io",
+        "index.crates.io",
+        "static.rust-lang.org",
+        "repo.maven.apache.org",
+        "repo1.maven.org",
+        "*.gradle.org",
+        "packagist.org",
+        "repo.packagist.org",
+        "*.googleapis.com",
+        "accounts.google.com",
+        "*.google.com",
+        "*.googleusercontent.com",
+        "*.slack.com",
+        "files.slack.com",
+        "*.amazonaws.com",
+        "registry.terraform.io",
+        "*.terraform.io",
+        "registry-1.docker.io",
+        "*.docker.io",
+        "api.anthropic.com",
+        "*.anthropic.com",
+        "claude.ai",
+        "*.claude.ai"
+      ]
+    }
+  },
   "statusLine": {
     "type": "command",
     "command": "~/.claude/statusline.py"