Update settings-strict.json

CHANGELOG.md

@@ -1,45 +1,5 @@
 # Changelog
 
-## 2.1.17
-
-- Fixed crashes on processors without AVX instruction support
-
-## 2.1.16
-
-- Added new task management system, including new capabilities like dependency tracking
-- [VSCode] Added native plugin management support
-- [VSCode] Added ability for OAuth users to browse and resume remote Claude sessions from the Sessions dialog
-- Fixed out-of-memory crashes when resuming sessions with heavy subagent usage
-- Fixed an issue where the "context remaining" warning was not hidden after running `/compact`
-- Fixed session titles on the resume screen not respecting the user's language setting
-- [IDE] Fixed a race condition on Windows where the Claude Code sidebar view container would not appear on start
-
-## 2.1.15
-
-- Added deprecation notification for npm installations - run `claude install` or see https://docs.anthropic.com/en/docs/claude-code/getting-started for more options
-- Improved UI rendering performance with React Compiler
-- Fixed the "Context left until auto-compact" warning not disappearing after running `/compact`
-- Fixed MCP stdio server timeout not killing child process, which could cause UI freezes
-
-## 2.1.14
-
-- Added history-based autocomplete in bash mode (`!`) - type a partial command and press Tab to complete from your bash command history
-- Added search to installed plugins list - type to filter by name or description
-- Added support for pinning plugins to specific git commit SHAs, allowing marketplace entries to install exact versions
-- Fixed a regression where the context window blocking limit was calculated too aggressively, blocking users at ~65% context usage instead of the intended ~98%
-- Fixed memory issues that could cause crashes when running parallel subagents
-- Fixed memory leak in long-running sessions where stream resources were not cleaned up after shell commands completed
-- Fixed `@` symbol incorrectly triggering file autocomplete suggestions in bash mode
-- Fixed `@`-mention menu folder click behavior to navigate into directories instead of selecting them
-- Fixed `/feedback` command generating invalid GitHub issue URLs when description is very long
-- Fixed `/context` command to show the same token count and percentage as the status line in verbose mode
-- Fixed an issue where `/config`, `/context`, `/model`, and `/todos` command overlays could close unexpectedly
-- Fixed slash command autocomplete selecting wrong command when typing similar commands (e.g., `/context` vs `/compact`)
-- Fixed inconsistent back navigation in plugin marketplace when only one marketplace is configured
-- Fixed iTerm2 progress bar not clearing properly on exit, preventing lingering indicators and bell sounds
-- Improved backspace to delete pasted text as a single token instead of one character at a time
-- [VSCode] Added `/usage` command to display current plan usage
-
 ## 2.1.12
 
 - Fixed message rendering bug

examples/settings/README.md

@@ -0,0 +1,31 @@
+# Settings Examples
+
+Example Claude Code settings files, primarily intended for organization-wide deployments. Use these are starting points — adjust them to fit your needs.
+
+These may be applied at any level of the [settings hierarchy](https://code.claude.com/docs/en/settings#settings-files), though certain properties only take effect if specified in enterprise settings (e.g. `strictKnownMarketplaces`, `allowManagedHooksOnly`, `allowManagedPermissionRulesOnly`).
+
+
+## Configuration Examples
+
+> [!WARNING]
+> These examples are community-maintained snippets which may be unsupported or incorrect. You are responsible for the correctness of your own settings configuration.
+
+| Setting | [`settings-lax.json`](./settings-lax.json) | [`settings-strict.json`](./settings-strict.json) | [`settings-bash-sandbox.json`](./settings-bash-sandbox.json) |
+|---------|:---:|:---:|:---:|
+| Disable `--dangerously-skip-permissions` | ✅ | ✅ | |
+| Block plugin marketplaces | ✅ | ✅ | |
+| Block user and project-defined permission `allow` / `ask` / `deny` | | ✅ | ✅ |
+| Block user and project-defined hooks | | ✅ | |
+| Deny web fetch and search tools | | ✅ | |
+| Bash tool requires approval | | ✅ | |
+| Bash tool must run inside of sandbox | | | ✅ |
+
+## Tips
+- Consider merging snippets of the above examples to reach your desired configuration
+- Settings files must be valid JSON
+- Before deploying configuration files to your organization, test them locally by applying to `managed-settings.json`, `settings.json` or `settings.local.json`
+- The `sandbox` property only applies to the `Bash` tool; it does not apply to other tools (like Read, Write, WebSearch, WebFetch, MCPs), hooks, or internal commands
+
+## Full Documentation
+
+See https://code.claude.com/docs/en/settings for complete documentation on all available managed settings.

examples/settings/settings-bash-sandbox.json

@@ -0,0 +1,18 @@
+{
+  "allowManagedPermissionRulesOnly": true,
+  "sandbox": {
+    "enabled": true,
+    "autoAllowBashIfSandboxed": false,
+    "allowUnsandboxedCommands": false,
+    "excludedCommands": [],
+    "network": {
+      "allowUnixSockets": [],
+      "allowAllUnixSockets": false,
+      "allowLocalBinding": false,
+      "allowedDomains": [],
+      "httpProxyPort": null,
+      "socksProxyPort": null
+    },
+    "enableWeakerNestedSandbox": false
+  }
+}

examples/settings/settings-lax.json

@@ -0,0 +1,6 @@
+{
+  "permissions": {
+    "disableBypassPermissionsMode": "disable"
+  },
+  "strictKnownMarketplaces": []
+}

examples/settings/settings-strict.json

@@ -0,0 +1,28 @@
+{
+  "permissions": {
+    "disableBypassPermissionsMode": "disable",
+    "ask": [
+      "Bash"
+    ],
+    "deny": [
+      "WebSearch",
+      "WebFetch"
+    ]
+  },
+  "allowManagedPermissionRulesOnly": true,
+  "allowManagedHooksOnly": true,
+  "strictKnownMarketplaces": [],
+  "sandbox": {
+    "autoAllowBashIfSandboxed": false,
+    "excludedCommands": [],
+    "network": {
+      "allowUnixSockets": [],
+      "allowAllUnixSockets": false,
+      "allowLocalBinding": false,
+      "allowedDomains": [],
+      "httpProxyPort": null,
+      "socksProxyPort": null
+    },
+    "enableWeakerNestedSandbox": false
+  }
+}