Claude Code settings

Reproducible practice

Test a project setting in isolation before sharing it

Distinguish project, local, user, and command-line settings while avoiding overwrite of existing configuration.

Prerequisites

• A unique temporary git repository.
• jq for syntax checks.
• One reversible setting with a documented key and expected scope.

Steps

1. Create isolated project and local layers

   Never run the fixture over an existing `.claude` directory.

   SETTINGS_LAB=$(mktemp -d "${TMPDIR:-/tmp}/claude-settings.XXXXXX")
   printf '%s\n' "$SETTINGS_LAB"
   cd "$SETTINGS_LAB" && git init -q
   mkdir .claude
   printf '%s\n' '{"permissions":{"allow":["Read"]}}' > .claude/settings.json
   printf '%s\n' '{"permissions":{"deny":["Read(.env)"]}}' > .claude/settings.local.json

2. Validate both files

   Syntax is necessary but does not prove effective merge behavior.

   jq -e . .claude/settings.json >/dev/null
   jq -e . .claude/settings.local.json >/dev/null

3. Select sources explicitly

   Start an optional session with only project and local sources to exclude unrelated user settings.

   claude --setting-sources project,local

4. Exercise a denial

   Request a normal file and `.env`; inspect the actual permission result without placing a secret in the fixture.

Expected result

The project allow rule and local deny rule are both attributable, `.env` remains denied, and no user setting is needed for the test.

Validation

• Use `/status` or `/config` only to inspect effective state, not to infer undocumented merge rules.
• Check both JSON files and git status separately.
• Verify local settings remain untracked before using the pattern in a real repo.

Failure handling

Cleanup or rollback

• Exit, return to the original directory, verify SETTINGS_LAB is the printed mktemp path, and remove only it.
• In a real project, revert shared settings by reviewed commit and preserve unrelated local settings.

Boundaries and when not to use it

• Local settings may resolve to the repository root across worktrees in newer 2.1.x versions.
• Managed settings and security controls can override or supplement project choices; local tests cannot prove organization policy.