Aide-mémoire Claude Code

Precedence (highest → lowest)
┌──────────────────────────────────────────────────────────┐
│ Managed / enterprise policy   (IT-controlled, cannot be   │
│                                overridden by users)       │
├──────────────────────────────────────────────────────────┤
│ Command-line flags            (--model, --allowedTools…)  │
├──────────────────────────────────────────────────────────┤
│ .claude/settings.local.json   (project, git-ignored)      │
├──────────────────────────────────────────────────────────┤
│ .claude/settings.json         (project, checked in)       │
├──────────────────────────────────────────────────────────┤
│ ~/.claude/settings.json       (user)                      │
└──────────────────────────────────────────────────────────┘

CLAUDE.md memory (all loaded, most specific wins on conflict)
  managed policy CLAUDE.md → ~/.claude/CLAUDE.md → ./CLAUDE.md → ./sub/dir/CLAUDE.md
  CLAUDE.local.md = personal, git-ignored        @path/to/file = import

# Project: payments-api

## Commands
- Install: `pnpm install`  · Test: `pnpm test`  · Lint: `pnpm lint`  · Typecheck: `pnpm tsc --noEmit`

## Architecture
- Hexagonal: `src/domain` (pure), `src/adapters` (IO). Never import adapters from domain.
- All money values are integer minor units (cents). Never floats.

## Workflow
- Run `pnpm test` before proposing a commit. Use conventional commits.
- Prefer plan mode for changes touching more than 3 files.

@docs/api-conventions.md

{
  "model": "claude-opus-5",
  "permissions": {
    "allow": ["Read", "Edit", "Bash(pnpm test*)", "Bash(pnpm lint*)", "Bash(git status*)", "Bash(git diff*)"],
    "ask":   ["Bash(git commit*)", "Bash(git push*)", "WebFetch"],
    "deny":  ["Bash(rm -rf*)", "Bash(git push --force*)", "Read(.env*)", "Read(**/secrets/**)"]
  },
  "env": { "NODE_ENV": "test" },
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{ "type": "command", "command": ".claude/hooks/guard.sh" }]
    }],
    "PostToolUse": [{
      "matcher": "Edit|Write",
      "hooks": [{ "type": "command", "command": "pnpm lint --fix $CLAUDE_FILE_PATHS" }]
    }]
  }
}

#!/usr/bin/env bash
# .claude/hooks/guard.sh – block destructive shell
cmd=$(jq -r '.tool_input.command // empty')
if echo "$cmd" | grep -Eq 'rm -rf|git push --force|drop table|mkfs|dd if='; then
  echo "Blocked by policy: destructive command" >&2
  exit 2
fi
exit 0

.claude/skills/release-notes/
└── SKILL.md

---
name: release-notes
description: Generate release notes from merged PRs since the last tag. Use when asked for a changelog or release summary.
---
1. Run `git describe --tags --abbrev=0` to find the last tag.
2. List merged PRs since then with `gh pr list --state merged --search "merged:>$TAG_DATE"`.
3. Group by label (feat, fix, chore) and write Markdown under `## vNEXT`.

// .mcp.json (project scope, checked in)
{ "mcpServers": {
  "docs":   { "command": "python", "args": ["mcp_docs_server.py"], "env": { "DOCS_ROOT": "./docs" } },
  "linear": { "type": "http", "url": "https://mcp.linear.app/mcp" }
} }

Scenario A – model conflict
  managed policy: model = claude-sonnet-5   (locked)
  ~/.claude/settings.json: model = claude-opus-5
  --model claude-haiku-4-5 on the CLI
  → Effective: claude-sonnet-5   (managed policy wins over everything)

Scenario B – permission conflict
  project .claude/settings.json allow: Bash(git push*)
  managed policy deny: Bash(git push --force*)
  → git push allowed; git push --force denied (deny in a higher scope wins)

Scenario C – CLAUDE.md conflict
  ./CLAUDE.md: "use tabs"
  ./frontend/CLAUDE.md: "use 2-space indent"
  → In frontend/, 2-space wins (most specific file wins on conflict; both are loaded)

stdin (JSON):  { "tool_name": "Bash", "tool_input": { "command": "…" }, "session_id": "…", "cwd": "…" }

exit 0  → allow (stdout may carry structured JSON decision)
exit 2  → BLOCK; stderr is fed back to Claude as the reason
other   → non-blocking error (logged, action proceeds)

// Structured stdout decision (alternative to exit code)
{ "decision": "block", "reason": "Migrations require review", "continue": false }

{ "permissions": {
  "allow": ["Read", "Edit", "Bash(pnpm test:*)", "Bash(git status)", "Bash(git diff:*)"],
  "ask":   ["Bash(git commit:*)", "Bash(git push:*)", "WebFetch(domain:docs.internal)"],
  "deny":  ["Bash(rm -rf:*)", "Bash(curl:*)", "Read(./.env)", "Read(./**/*.pem)", "Read(**/secrets/**)"]
} }

{ "permissions": {
    "deny": ["Bash(rm -rf:*)", "Bash(git push --force:*)", "Read(**/*.pem)", "WebFetch"] },
  "model": "claude-sonnet-5",
  "disabledMcpjsonServers": ["*"] }