# Claude Code: the "build" policy, with its configuration and the
# network, but not its telemetry. Its configuration is in
# $CLAUDE_CONFIG_DIR, or else $XDG_CONFIG_HOME/claude
# (~/.config/claude), which the policy sets CLAUDE_CONFIG_DIR to so that
# it can save it: in ~/.claude.json, it would need to write home itself.
# Set CLAUDE_CONFIG_DIR the same way outside the sandbox, and move
# ~/.claude/* and ~/.claude.json there, to share it. It can change its
# own settings and hooks, which run outside the sandbox later.
# policies/commands/claude.policy in blinker's config directory comes
# first.

# type  access  pattern
include build
file    write   ${CLAUDE_CONFIG_DIR:-${XDG_CONFIG_HOME:-~/.config}/claude}/
env     set     CLAUDE_CONFIG_DIR ${CLAUDE_CONFIG_DIR:-${XDG_CONFIG_HOME:-~/.config}/claude}
env     allow   ANTHROPIC_API_KEY

host    allow   *
host    deny    statsig.anthropic.com
host    deny    sentry.io
host    deny    *.sentry.io
host    deny    *.datadoghq.com
host    deny    browser-intake-us5-datadoghq.com