Claude Code

Claude Code

The repo's claude/ folder is synced to ~/.claude/ (it is claude/, not .claude/: Claude Code would read that as this repo's own project settings). Change these in the repo, not with /config: a sync overwrites ~/.claude/settings.json.

File
settings.json	no co-author trailer on commits and PRs, Read(...) deny rules for keys, .env and credential files, asks before kubectl, git commit and git push, the hooks below, plugins
CLAUDE.md	global instructions (includes RTK.md)
RTK.md	how to use rtk, the token-saving CLI proxy the playbook installs

Hooks

• deny-sensitive-reads (Go, on Bash and Read): blocks what is really private — ssh private keys, AWS credentials, env files (not .env.example), *.pem / *.key, age keys, app credential files, and files under secrets/ / credentials/ unless sops says they are encrypted. ~/.ssh/config, ~/.aws/config and docker-compose files stay readable. For Bash it reads the paths from the command text: a safety net, not a sandbox.
  • Built by install.sh; until it is, Claude Code's Bash and Read are blocked with "run dotfiles-sync".
• rtk hook (Bash): rewrites commands through rtk.

Reference: claude README.