medharness: Settings file for Claude Code

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "$comment": [
    "企业级 Claude Code baseline — 医疗数据 SaaS",
    "合规约束：HIPAA + PIPL + 数据安全法 + 健康医疗数据安全指南",
    "本文件是 L2 Harness 层的入口治理点，所有团队成员仓库 settings.local.json 必须在此基础上扩展，不允许放宽 deny",
    "维护：Harness Engineer（M1-M3 由 Senior 兼任）",
    "审计：每月由技术委员会复核一次",
    "升级流程：修改本文件须经技术委员会签字 + 合规委员会会签（如涉及 L5 合规层）"
  ],

  "permissions": {
    "$comment": "deny 优先于 allow；ask 用于敏感但可控的命令，由开发者当场决定",

    "deny": [
      "Bash(rm -rf *)",
      "Bash(rm -rf /)",
      "Bash(rm -rf ~/*)",
      "Bash(curl * | bash)",
      "Bash(curl * | sh)",
      "Bash(wget * | bash)",
      "Bash(wget * | sh)",
      "Bash(git push --force *)",
      "Bash(git push -f *)",
      "Bash(git reset --hard *)",
      "Bash(git clean -fd*)",
      "Bash(git checkout -- *)",
      "Bash(* --no-verify*)",
      "Bash(* --no-gpg-sign*)",

      "Read(.env)",
      "Read(.env.*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/secrets/**)",
      "Read(**/credentials/**)",
      "Read(**/private_key*)",
      "Read(**/*.pem)",
      "Read(**/*.p12)",

      "Read(**/patient_data/**)",
      "Read(**/phi/**)",
      "Read(**/real_patient/**)",
      "Read(**/production_data/**)",

      "Edit(.env)",
      "Edit(.env.*)",
      "Edit(**/secrets/**)",

      "WebFetch(domain:openai.com)",
      "WebFetch(domain:api.openai.com)",
      "$comment_webfetch": "境外 LLM API 默认禁止；如需 architecture-only 调用，由 Compliance Officer 加入白名单"
    ],

    "ask": [
      "Bash(git push *)",
      "Bash(git commit *)",
      "Bash(npm install *)",
      "Bash(pip install *)",
      "Bash(docker *)",
      "Bash(kubectl *)",
      "Bash(curl *)",
      "Bash(psql *)",
      "Bash(mysql *)",
      "WebFetch(*)"
    ],

    "allow": [
      "Bash(ls *)",
      "Bash(cat *)",
      "Bash(grep *)",
      "Bash(find . *)",
      "Bash(git status)",
      "Bash(git log *)",
      "Bash(git diff *)",
      "Bash(git branch *)",
      "Bash(pytest *)",