settings.json

{
  "permissions": {
    "allow": [
      "Bash(find:*)",
      "Bash(xargs ls:*)",
      "Bash(grep:*)"
    ],
    "deny": [
      "Read(**/.env)",
      "Read(**/.env.*)"
    ],
    "defaultMode": "default"
  },
  "statusLine": {
    "type": "command",
    "command": "input=$(cat); cwd=$(echo \"$input\" | jq -r '.workspace.current_dir'); printf '\\033[1m%s\\033[0m' \"$(basename \"$cwd\")\"; if git -C \"$cwd\" rev-parse --is-inside-work-tree >/dev/null 2>&1 || git -C \"$cwd\" rev-parse --is-inside-git-dir >/dev/null 2>&1; then branch=$(git -C \"$cwd\" rev-parse --abbrev-ref HEAD 2>/dev/null); [ -z \"$branch\" ] && branch='(no branch)'; if git -C \"$cwd\" rev-parse --is-inside-work-tree >/dev/null 2>&1; then status_count=$(git -C \"$cwd\" status --porcelain 2>/dev/null | wc -l); else status_count=0; fi; if [ \"${status_count:-0}\" -gt 0 ]; then printf ' \\033[1;33m%s*\\033[0m' \"$branch\"; else printf ' \\033[36m%s\\033[0m' \"$branch\"; fi; elif git -C \"$cwd\" rev-parse --is-bare-repository >/dev/null 2>&1; then printf ' \\033[36m%s\\033[0m' '(bare repo)'; fi; if command -v kubectl >/dev/null 2>&1; then context=$(kubectl config view -o=jsonpath='{.current-context}' 2>/dev/null); if [ -n \"$context\" ]; then namespace=$(kubectl config view -o=jsonpath=\"{.contexts[?(@.name==\\\"${context}\\\")].context.namespace}\" 2>/dev/null); printf ' \\033[34m%s%s\\033[0m' \"$context\" \"${namespace:+:$namespace}\"; fi; fi; if [ -n \"$SSH_CONNECTION\" ]; then printf ' \\033[2m%s@%s\\033[0m' \"$(whoami)\" \"$(hostname -s)\"; fi; if [ -n \"$IN_NIX_SHELL\" ] || [[ \":$PATH:\" == *\":/nix/store:\"* ]]; then printf ' ❄️'; fi"
  }
}