私のClaude Code設定：放っておいても最大の成果を出す方法

"don't touch the production database"
"only read, don't write anything"
"run the migration on local first, show me the result before touching prod"
"don't delete any files, just show me what you'd remove"
"check the logs before making any changes"

{
  "permissions": {
    "deny": [],
    "allow": [
      // Reading & searching
      "Read",
      "Grep",
      "Glob",
      "WebSearch",
      "WebFetch",

      // Git — safe read/write operations
      "Bash(git status *)",
      "Bash(git log *)",
      "Bash(git diff *)",
      "Bash(git branch *)",
      "Bash(git show *)",
      "Bash(git stash *)",
      "Bash(git add *)",
      "Bash(git commit *)",
      "Bash(git fetch *)",
      "Bash(git pull *)",
      "Bash(git merge *)",
      "Bash(git rebase *)",
      "Bash(git cherry-pick *)",
      "Bash(git tag *)",

      // GitHub CLI
      "Bash(gh *)",

      // ⚠️ Runtimes — can do anything
      "Bash(node *)",
      "Bash(python3 *)",

      // npm — read-only & dev tools
      "Bash(npm run *)",
      "Bash(npm list *)",
      "Bash(npm ls *)",
      "Bash(npm show *)",
      "Bash(npm view *)",
      "Bash(npm outdated *)",
      "Bash(npx prettier *)",
      "Bash(npx eslint *)",
      "Bash(npx tsc *)",
      "Bash(npx vitest *)",
      "Bash(npx svelte-check *)",

      // pip — read-only
      "Bash(pip show *)",
      "Bash(pip list *)",

      // Filesystem — read & navigate
      "Bash(ls *)",
      "Bash(cat *)",
      "Bash(head *)",
      "Bash(tail *)",
      "Bash(wc *)",
      "Bash(du *)",
      "Bash(find *)",
      "Bash(which *)",
      "Bash(file *)",
      "Bash(echo *)",
      "Bash(date *)",
      "Bash(pwd *)",
      "Bash(diff *)",

      // Text processing
      "Bash(sort *)",
      "Bash(uniq *)",
      "Bash(jq *)",
      "Bash(grep *)",
      "Bash(rg *)",
      "Bash(sed *)",
      "Bash(awk *)",
      "Bash(tr *)",
      "Bash(cut *)",
      "Bash(base64 *)",

      // Filesystem — write (git tracked, so revertible)
      "Bash(mkdir *)",
      "Bash(touch *)",
      "Bash(cp *)",
      "Bash(mv *)",

      // Misc tools
      "Bash(open *)",
      "Bash(cwebp *)",
      "Bash(sips *)",
      "Bash(gunzip *)",
      "Bash(curl *)",

      // Version/help — always safe
      "Bash(* --version)",
      "Bash(* --help)"
    ],
    "ask": [
      // Deployment — ask before shipping
      "Bash(wrangler *)",
      "Bash(npx wrangler *)",

      // Git — destructive or irreversible operations
      "Bash(git push *)",
      "Bash(git reset --hard *)",
      "Bash(git clean *)",
      "Bash(git checkout .)",
      "Bash(git checkout -- .)",
      "Bash(git checkout * -- .)",
      "Bash(git restore .)",

      // Package management
      "Bash(npm install *)",
      "Bash(npm publish *)",
      "Bash(pip install *)",

      // Destructive
      "Bash(rm *)",
      "Bash(sudo *)",
      "Bash(gh repo delete *)",

      // Secrets — never read without asking
      "Read(.dev.vars)",
      "Read(.env)",
      "Bash(cat *.env)",
      "Bash(cat .env)"
    ]
  }
}

// ⚠️ Runtimes — can do anything: file writes,
// network requests, db operations.
// They bypass other restrictions.
"Bash(node *)",
"Bash(python3 *)"

// Secrets — never read without asking
"Read(.dev.vars)",
"Read(.env)",
"Bash(cat *.env)",
"Bash(cat .env)"