Claude Code 权限体系与安全沙箱全实战：从权限配置到Docker隔离的完整防护指南

┌─────────────────────────────────────────────────┐
│              Claude Code 权限决策树               │
├─────────────────────────────────────────────────┤
│                                                 │
│  工具调用请求                                     │
│       │                                         │
│       ▼                                         │
│  ┌─────────┐   匹配   ┌──────────────────┐      │
│  │ Deny 规则├────────►│ ❌ 直接拒绝（静默）│      │
│  └────┬────┘          └──────────────────┘      │
│       │ 不匹配                                    │
│       ▼                                           │
│  ┌──────────┐  匹配  ┌───────────────────┐       │
│  │ Allow 规则├───────►│ ✅ 自动放行（无提示）│      │
│  └────┬─────┘        └───────────────────┘       │
│       │ 不匹配                                     │
│       ▼                                            │
│  ┌──────────────────────────────┐                 │
│  │ 🟡 弹出确认对话框（Ask 模式）│                 │
│  │ 用户手动选择 Allow / Deny    │                 │
│  └──────────────────────────────┘                 │
│                                                   │
└─────────────────────────────────────────────────┘

~/.claude/settings.json              ← 全局配置（对所有项目生效）
  └── 项目根目录/.claude/settings.json   ← 项目配置（仅对当前项目生效）
       └── settings.local.json          ← 本地配置（不提交到 Git）

{
  "permissions": {
    "allow": [
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(npm test *)",
      "Bash(npm run lint *)",
      "Read",
      "Glob",
      "Grep"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(curl * | bash *)",
      "Bash(sudo *)",
      "Bash(chmod 777 *)",
      "Edit(*.env*)",
      "Write(*.env*)",
      "Write(*secret*)",
      "Write(*credential*)"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Bash(git *)",
      "Bash(npm *)",
      "Bash(npx *)",
      "Bash(node *)",
      "Bash(python *)",
      "Bash(ls *)",
      "Bash(cat *)",
      "Bash(echo *)",
      "Bash(mkdir *)",
      "Bash(cp *)",
      "Bash(mv *)"
    ],
    "deny": [
      "Bash(rm -rf /)",
      "Bash(rm -rf ~*)",
      "Bash(sudo *)",
      "Bash(su *)",
      "Bash(chmod 777 *)",
      "Bash(curl * | sh)",
      "Bash(curl * | bash)",
      "Bash(wget * | sh)",
      "Bash(aws s3 rm *)",
      "Bash(docker rm *)",
      "Bash(kubectl delete *)",
      "Bash(pkill *)",
      "Bash(kill -9 *)"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Read",
      "Edit(src/**)",
      "Edit(tests/**)",
      "Write(src/**)",
      "Write(tests/**)"
    ],
    "deny": [
      "Edit(.env*)",
      "Edit(*.pem)",
      "Edit(*.key)",
      "Write(.env*)",
      "Write(*.pem)",
      "Write(*.key)",
      "Write(/etc/*)",
      "Write(/var/*)",
      "Edit(package.json)",
      "Edit(package-lock.json)"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "WebFetch",
      "WebSearch"
    ],
    "deny": [
      "WebFetch(http://localhost*)",
      "WebFetch(http://127.0.0.1*)",
      "WebFetch(http://192.168.*)",
      "WebFetch(http://10.*)",
      "WebFetch(http://172.16.*)"
    ]
  }
}

# 启动时预设权限
claude --allow "Bash(git *)" --allow "Bash(npm test *)" --deny "Bash(sudo *)"

# 在会话中管理权限
/permissions          # 打开权限管理面板
/permissions allow    # 查看所有 allow 规则
/permissions deny     # 查看所有 deny 规则

sequenceDiagram
    participant User as 用户/Claude
    participant HookSystem as Hook 引擎
    participant PreHook as PreToolUse Hook
    participant Tool as 目标工具
    participant PostHook as PostToolUse Hook

    User->>HookSystem: 发起工具调用
    HookSystem->>PreHook: 传递工具名+参数(JSON)
    alt PreHook 返回 exit 0
        PreHook->>HookSystem: 放行
        HookSystem->>Tool: 执行工具
        Tool->>HookSystem: 返回结果
        HookSystem->>PostHook: 传递结果(JSON)
        PostHook->>HookSystem: 后处理完成
        HookSystem->>User: 返回最终结果
    else PreHook 返回 exit 2
        PreHook->>HookSystem: 拦截（反馈给 Claude）
        HookSystem->>User: 返回拦截原因
    else PreHook 返回 exit 1 或超时
        PreHook->>HookSystem: 静默放行
        HookSystem->>Tool: 执行工具
    end

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "python3 /path/to/security-guard.py"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "npx prettier --write $CLAUDE_FILE_PATH 2>/dev/null || true"
          }
        ]
      }
    ]
  }
}

{
  "tool_name": "Bash",
  "tool_input": {
    "command": "rm -rf /tmp/test",
    "description": "清理临时文件"
  },
  "session_id": "abc123"
}

#!/usr/bin/env python3
"""danger-guard.py — 拦截危险的 Bash 命令"""
import sys, json

DANGEROUS_PATTERNS = [
    "rm -rf /", "rm -rf ~", "rm -rf /*",
    "sudo rm", ":(){ :|:& };:",  # fork bomb
    "dd if=/dev/zero",
    "mkfs.", "format ",
    "> /dev/sd", "chmod -R 777 /",
    "curl * | bash", "curl * | sh",
    "wget * | bash", "wget * | sh",
]

def check(data):
    if data.get("tool_name") != "Bash":
        sys.exit(0)

    cmd = data.get("tool_input", {}).get("command", "")

    for pattern in DANGEROUS_PATTERNS:
        # 简单的通配符匹配
        if "*" in pattern:
            parts = pattern.split("*")
            if all(p in cmd for p in parts if p):
                print(f"⛔ 危险命令已被拦截！匹配模式: {pattern}")
                print(f"   命令: {cmd}")
                sys.exit(2)
        elif pattern in cmd:
            print(f"⛔ 危险命令已被拦截！匹配模式: {pattern}")
            print(f"   命令: {cmd}")
            sys.exit(2)

    sys.exit(0)  # 放行

data = json.load(sys.stdin)
check(data)

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/danger-guard.py"
          }
        ]
      }
    ]
  }
}

#!/usr/bin/env python3
"""file-guard.py — 保护敏感文件不被修改或删除"""
import sys, json, re

PROTECTED_PATTERNS = [
    r"\.env($|\.|$)", r"\.env\.",
    r"\.pem$", r"\.key$", r"\.p12$",
    r"credentials", r"secrets?[/\\]",
    r"id_rsa", r"id_ed25519",
    r"\.ssh[/\\]",
    r"\.gnupg[/\\]",
    r"\.aws[/\\]credentials",
]

def check(data):
    tool = data.get("tool_name", "")
    if tool not in ("Edit", "Write", "Bash"):
        sys.exit(0)

    if tool == "Bash":
        cmd = data.get("tool_input", {}).get("command", "")
        # 检查是否涉及敏感文件的删除或覆盖
        for p in PROTECTED_PATTERNS:
            if re.search(p, cmd):
                print(f"🔒 操作被阻止：涉及敏感文件/目录 (模式: {p})")
                print(f"   命令: {cmd}")
                sys.exit(2)
        sys.exit(0)

    file_path = data.get("tool_input", {}).get("file_path", "")
    for p in PROTECTED_PATTERNS:
        if re.search(p, file_path):
            print(f"🔒 文件被保护，禁止 {tool} 操作: {file_path}")
            sys.exit(2)

    sys.exit(0)

data = json.load(sys.stdin)
check(data)

#!/usr/bin/env python3
"""auto-format.py — 文件编辑后自动格式化"""
import sys, json, subprocess, os

def format_file(data):
    tool = data.get("tool_name", "")
    if tool not in ("Edit", "Write"):
        sys.exit(0)

    file_path = data.get("tool_input", {}).get("file_path", "")
    if not file_path or not os.path.exists(file_path):
        sys.exit(0)

    ext = os.path.splitext(file_path)[1]

    # 根据文件类型选择格式化工具
    formatters = {
        ".js": ["npx", "prettier", "--write"],
        ".ts": ["npx", "prettier", "--write"],
        ".jsx": ["npx", "prettier", "--write"],
        ".tsx": ["npx", "prettier", "--write"],
        ".css": ["npx", "prettier", "--write"],
        ".json": ["npx", "prettier", "--write"],
        ".py": ["python3", "-m", "black"],
        ".go": ["gofmt", "-w"],
        ".rs": ["rustfmt"],
    }

    formatter = formatters.get(ext)
    if formatter:
        try:
            subprocess.run(
                formatter + [file_path],
                capture_output=True, timeout=10
            )
        except Exception:
            pass  # 格式化失败不影响主流程

    sys.exit(0)

data = json.load(sys.stdin)
format_file(data)

#!/usr/bin/env python3
"""git-guard.py — 防止在 main/master 分支上直接修改"""
import sys, json, subprocess

def check(data):
    if data.get("tool_name") != "Bash":
        sys.exit(0)

    cmd = data.get("tool_input", {}).get("command", "")

    # 只检查 git commit / git push 操作
    if "git commit" not in cmd and "git push" not in cmd:
        sys.exit(0)

    try:
        result = subprocess.run(
            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
            capture_output=True, text=True, timeout=5
        )
        branch = result.stdout.strip()

        if branch in ("main", "master"):
            print(f"🛡️ 禁止在 {branch} 分支上直接 commit/push！")
            print(f"   请创建新分支: git checkout -b feature/xxx")
            sys.exit(2)
    except Exception:
        pass

    sys.exit(0)

data = json.load(sys.stdin)
check(data)

#!/usr/bin/env python3
"""audit-logger.py — 记录所有工具调用到审计日志"""
import sys, json, os
from datetime import datetime

LOG_FILE = os.path.expanduser("~/.claude/audit.log")

def log(data):
    entry = {
        "timestamp": datetime.now().isoformat(),
        "tool": data.get("tool_name"),
        "input_summary": str(data.get("tool_input", {}))[:500],
        "session_id": data.get("session_id", "unknown"),
    }

    with open(LOG_FILE, "a") as f:
        f.write(json.dumps(entry, ensure_ascii=False) + "\n")

    sys.exit(0)  # 只记录，不拦截

data = json.load(sys.stdin)
log(data)

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/danger-guard.py"
          },
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/git-guard.py"
          }
        ]
      },
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/file-guard.py"
          }
        ]
      },
      {
        "matcher": ".*",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/audit-logger.py"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "python3 ~/.claude/hooks/auto-format.py"
          }
        ]
      }
    ]
  }
}

flowchart TB
    subgraph "第一层：静态权限防线"
        A[工具调用] --> B{Deny 规则匹配?}
        B -->|是| C[❌ 静默拒绝]
        B -->|否| D{Allow 规则匹配?}
        D -->|是| E[✅ 自动放行]
        D -->|否| F{PreToolUse Hook}
    end

    subgraph "第二层：动态 Hook 防线"
        F -->|exit 2| G[❌ Hook 拦截]
        F -->|exit 0| H{用户确认}
    end

    subgraph "第三层：人工确认"
        H -->|拒绝| I[❌ 用户拒绝]
        H -->|允许| J[执行工具]
    end

    subgraph "第四层：后置处理"
        J --> K[PostToolUse Hook]
        K --> L[日志 / 格式化 / 验证]
    end

    style C fill:#ff6b6b
    style G fill:#ff6b6b
    style I fill:#ff6b6b
    style E fill:#51cf66
    style J fill:#51cf66
    style L fill:#74c0fc

{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep",
      "WebSearch",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(npm test *)",
      "Bash(npm run lint *)",
      "Bash(npm run build *)",
      "Bash(npm run typecheck *)",
      "Bash(npx *)",
      "Bash(node *)",
      "Bash(ls *)",
      "Bash(cat *)",
      "Bash(head *)",
      "Bash(tail *)",
      "Bash(find *)",
      "Bash(grep *)",
      "Bash(wc *)",
      "Bash(echo *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(chmod 777 *)",
      "Bash(curl * | sh*)",
      "Bash(curl * | bash*)",
      "Bash(wget * | sh*)",
      "Bash(docker rm *)",
      "Bash(kubectl delete *)",
      "Bash(psql *)",
      "Bash(mysql *)",
      "Bash(mongosh *)",
      "Write(.env*)",
      "Write(*.pem)",
      "Write(*.key)",
      "Write(*.secret*)",
      "Edit(.env*)",
      "Edit(*.pem)",
      "Edit(*.key)",
      "Edit(*.secret*)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "python3 scripts/hooks/danger-guard.py"
          }
        ]
      },
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "python3 scripts/hooks/file-guard.py"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "python3 scripts/hooks/auto-format.py"
          }
        ]
      }
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Bash(docker *)",
      "Bash(kubectl *)",
      "Bash(terraform *)",
      "Bash(aws *)"
    ]
  }
}

.claude/settings.local.json

flowchart LR
    subgraph "方案A：内置沙箱"
        A1[Claude Code] --> A2[Seatbelt / Landlock]
        A2 --> A3[受限文件系统]
    end

    subgraph "方案B：Docker 容器"
        B1[Claude Code] --> B2[Docker Container]
        B2 --> B3[命名空间隔离]
        B2 --> B4[网络隔离]
        B2 --> B5[资源限制]
    end

    subgraph "方案C：Dev Container"
        C1[Claude Code] --> C2[VS Code Dev Container]
        C2 --> C3[完整开发环境]
    end

    style A2 fill:#ffd43b
    style B2 fill:#51cf66
    style C2 fill:#74c0fc

# claude-sandbox/Dockerfile
FROM node:20-slim

# 安装基础工具
RUN apt-get update && apt-get install -y \
    git \
    python3 \
    python3-pip \
    curl \
    jq \
    && rm -rf /var/lib/apt/lists/*

# 安装 Claude Code
RUN npm install -g @anthropic-ai/claude-code

# 创建非 root 用户
RUN useradd -m -s /bin/bash claude
USER claude
WORKDIR /home/claude/workspace

# 设置安全的环境变量
ENV NODE_ENV=development
ENV CLAUDE_CODE_SANDBOX=true

ENTRYPOINT ["claude"]

# claude-sandbox/docker-compose.yml
version: '3.8'

services:
  claude-sandbox:
    build: .
    container_name: claude-code-sandbox
    # 关键安全配置
    security_opt:
      - no-new-privileges:true
    read_only: false
    # 资源限制
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 512M
    # 网络隔离（仅 DNS，无外网）
    networks:
      - claude-net
    # 文件系统挂载（只挂载项目目录）
    volumes:
      - ../:/home/claude/workspace:rw
      - claude-home:/home/claude/.claude
    # 环境变量（从 .env 传入 API Key）
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
    # 禁止特权升级
    cap_drop:
      - ALL
    stdin_open: true
    tty: true

networks:
  claude-net:
    driver: bridge
    internal: false  # 设为 true 可完全禁止外网

volumes:
  claude-home:

{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep",
      "Bash(git *)",
      "Bash(npm *)",
      "Bash(npx *)",
      "Bash(node *)",
      "Bash(python3 *)",
      "Bash(ls *)",
      "Bash(cat *)",
      "Bash(find *)",
      "Bash(echo *)",
      "Bash(mkdir *)",
      "Bash(test *)",
      "Edit(src/**)",
      "Edit(tests/**)",
      "Write(src/**)",
      "Write(tests/**)"
    ],
    "deny": [
      "Bash(sudo *)",
      "Bash(su *)",
      "Bash(rm -rf /)",
      "Bash(curl * | *)",
      "Bash(wget * | *)",
      "Bash(apt *)",
      "Bash(yum *)",
      "Bash(pip install *)",
      "Bash(npm install -g *)",
      "Write(*)",
      "Edit(*)"
    ]
  }
}

# 构建镜像
cd claude-sandbox
docker compose build

# 交互式启动（连接到终端）
docker compose run --rm claude-sandbox

# 启动时传入项目特定的权限配置
docker compose run --rm \
  -v $(pwd)/sandbox-settings.json:/home/claude/.claude/settings.json:ro \
  claude-sandbox

# 以 -p 模式执行任务（非交互式）
docker compose run --rm claude-sandbox \
  -p "分析 src/ 目录的代码质量，给出改进建议"

# 执行完成后自动销毁容器
docker compose down

# 在 docker-compose.yml 中替换 networks 配置
networks:
  claude-net:
    driver: bridge
    internal: true  # 完全禁止外网访问
    # 需要额外配置 DNS 和 API 代理

services:
  claude-sandbox:
    networks:
      - claude-net
    dns:
      - 8.8.8.8  # 允许 DNS 解析

  api-proxy:
    image: nginx:alpine
    networks:
      - claude-net
      - external-net
    # 配置 nginx 仅代理 api.anthropic.com

networks:
  claude-net:
    internal: true
  external-net:
    driver: bridge

# macOS：使用 Seatbelt 沙箱
claude --sandbox

# 或在 settings.json 中配置
# macOS 会自动使用 Seatbelt
# Linux 会使用 Landlock LSM

my-project/
├── .claude/
│   ├── settings.json          # 团队共享安全策略（提交 Git）
│   ├── hooks/
│   │   ├── danger-guard.py    # 危险命令拦截
│   │   ├── file-guard.py      # 敏感文件保护
│   │   ├── git-guard.py       # Git 分支保护
│   │   ├── auto-format.py     # 自动格式化
│   │   └── audit-logger.py    # 审计日志
│   └── audit/                 # 审计日志存储（gitignore）
│       └── .gitkeep
├── .claude-sandbox/           # Docker 沙箱配置
│   ├── Dockerfile
│   ├── docker-compose.yml
│   └── sandbox-settings.json  # 沙箱内的权限配置
├── .github/
│   └── workflows/
│       └── claude-review.yml  # CI 中使用 Claude Code
├── CLAUDE.md                  # 项目指令文件
├── .gitignore
├── package.json
└── src/

# Project: MyProject

## Tech Stack
- React 18 + TypeScript
- Vite
- TailwindCSS
- Vitest + React Testing Library

## Architecture
- src/components/ — UI 组件
- src/hooks/ — 自定义 React Hooks
- src/services/ — API 调用层
- src/utils/ — 工具函数
- tests/ — 测试文件

## Rules
- 所有新代码必须包含对应测试
- 使用 TypeScript strict mode
- 组件使用函数式组件 + Hooks
- 不要修改 package.json 中的依赖版本
- 不要删除 .env.example 中的变量

## Commands
- 构建: npm run build
- 测试: npm run test
- Lint: npm run lint
- 类型检查: npm run typecheck

# .github/workflows/claude-review.yml
name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  claude-review:
    runs-on: ubuntu-latest
    container:
      image: node:20-slim
      options: --user root

    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          npm ci
          npm install -g @anthropic-ai/claude-code

      - name: Run Claude Code Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          claude -p "Review the changes in this PR for:
          1. Security vulnerabilities
          2. Code quality issues
          3. Missing tests
          4. Breaking changes

          Be specific and cite file paths." \
            --allowedTools "Read,Glob,Grep,Bash(git diff *)" \
            --max-turns 10

#!/bin/bash
# scripts/verify-security.sh — 验证 Claude Code 安全配置

set -e

echo "🔍 验证 Claude Code 安全配置..."
echo ""

# 1. 检查 settings.json 是否存在且语法正确
echo "✅ 检查 settings.json..."
if [ -f ".claude/settings.json" ]; then
    jq empty .claude/settings.json 2>/dev/null && echo "  JSON 语法正确" || echo "  ❌ JSON 语法错误！"
else
    echo "  ❌ .claude/settings.json 不存在！"
fi

# 2. 检查 deny 规则是否覆盖关键危险操作
echo ""
echo "✅ 检查 deny 规则覆盖..."
DENOULEMENTS=("rm -rf" "sudo" "chmod 777" "curl.*bash")
for pattern in "${DENOULEMENTS[@]}"; do
    if grep -q "$pattern" .claude/settings.json 2>/dev/null; then
        echo "  ✓ $pattern 已被 deny"
    else
        echo "  ⚠ $pattern 未被 deny"
    fi
done

# 3. 检查 Hook 脚本是否存在且可执行
echo ""
echo "✅ 检查 Hook 脚本..."
for hook in danger-guard file-guard git-guard auto-format audit-logger; do
    if [ -f ".claude/hooks/${hook}.py" ]; then
        echo "  ✓ ${hook}.py 存在"
        python3 -m py_compile ".claude/hooks/${hook}.py" 2>/dev/null && echo "    语法正确" || echo "    ❌ 语法错误"
    else
        echo "  ⚠ ${hook}.py 不存在"
    fi
done

# 4. 检查 Docker 沙箱配置
echo ""
echo "✅ 检查 Docker 沙箱..."
if [ -f ".claude-sandbox/Dockerfile" ]; then
    echo "  ✓ Dockerfile 存在"
    if grep -q "cap_drop" .claude-sandbox/docker-compose.yml 2>/dev/null; then
        echo "  ✓ 已配置 cap_drop"
    else
        echo "  ⚠ 未配置 cap_drop"
    fi
    if grep -q "no-new-privileges" .claude-sandbox/docker-compose.yml 2>/dev/null; then
        echo "  ✓ 已配置 no-new-privileges"
    else
        echo "  ⚠ 未配置 no-new-privileges"
    fi
else
    echo "  ⚠ Docker 沙箱未配置"
fi

# 5. 检查 .gitignore 是否排除了敏感文件
echo ""
echo "✅ 检查 .gitignore..."
for item in "settings.local.json" ".env"; do
    if grep -q "$item" .gitignore 2>/dev/null; then
        echo "  ✓ $item 已被 gitignore"
    else
        echo "  ⚠ $item 未被 gitignore"
    fi
done

echo ""
echo "🎉 安全配置验证完成！"

chmod +x scripts/verify-security.sh
./scripts/verify-security.sh

# 查看今天的审计日志
cat ~/.claude/audit.log | jq -c 'select(.timestamp | startswith("2026-06-11"))'

# 统计各工具调用次数
cat ~/.claude/audit.log | jq -r '.tool' | sort | uniq -c | sort -rn

# 查找涉及敏感文件的操作
cat ~/.claude/audit.log | jq -c 'select(.input_summary | test("\\.env|\\.pem|\\.key|secret"))'

# 查看特定会话的所有操作
cat ~/.claude/audit.log | jq -c 'select(.session_id == "abc123")'

□ settings.json 配置了 deny 规则覆盖 rm -rf、sudo、curl|bash
□ 敏感文件 (.env, .pem, .key) 被 deny 保护
□ PreToolUse Hook 已部署并测试
□ 审计日志已启用
□ API Key 不在代码仓库中
□ settings.local.json 在 .gitignore 中
□ Docker 沙箱已配置资源限制
□ Docker 容器使用非 root 用户
□ Docker 已配置 cap_drop: ALL
□ 网络策略已按需配置（internal: true 或 API 代理）
□ CI/CD 中 Claude Code 使用只读工具
□ 定期审查审计日志

{
  "managedSettings": {
    "permissions": {
      "deny": [
        "Bash(sudo *)",
        "Bash(rm -rf *)",
        "Bash(curl * | *)",
        "Write(.env*)",
        "Write(*.pem)"
      ]
    }
  }
}

# 开发环境：宽松
claude --settings .claude/settings.dev.json

# 测试环境：标准
claude --settings .claude/settings.test.json

# 生产环境：严格
claude --settings .claude/settings.prod.json

#!/usr/bin/env python3
"""env-settings.py — 根据环境变量选择配置"""
import os, json, shutil

env = os.getenv("CLAUDE_ENV", "dev")
settings_files = {
    "dev": "settings.dev.json",
    "staging": "settings.staging.json",
    "prod": "settings.prod.json",
}

src = f".claude/profiles/{settings_files[env]}"
dst = ".claude/settings.json"
shutil.copy2(src, dst)
print(f"已切换到 {env} 环境配置")