hooks:
  - event: UserPromptSubmit
    handler: { type: command, command: "echo 'base hook'" }
permissions:
  allow:
    - { tool: Bash }
  deny:
    - { tool: Read, paths: ["./.env", "./.env.*"] }
native_permissions:
  claude_code:
    deny: ["WebFetch(domain:internal.example.com)"]
