Claude Code, pinned and sandboxed

Why another configuration

Most Claude Code configurations on GitHub are someone's personal setup, loaded into every session whether a project needs it or not.

ccc is a user-level configuration with pinned settings, a sandbox, lean instructions and a small set of binding rules. What depends on a project or a framework, such as naming conventions or framework setups, sits in opt-in/ and loads only where a project copies it.

Three goals

1. Sessions cost fewer tokens. Effort is medium, opusplan lets Opus plan while a cheaper model writes the code, and context compacts at 250,000 tokens. Long command output goes to a file instead of the context, subagents run on Sonnet with at most four at once and no nesting, and skillOverrides stops Claude from carrying every bundled skill's description around. An RTK hook strips boilerplate from command output and keeps the errors.
2. Claude cannot read secrets or rewrite Git history. The sandbox is on, Claude Code exits if it cannot start, and failed commands are never retried outside it. deny rules cover .env files, keys, certificates and credential folders, and block git push, reset, rebase, --no-verify and similar. Pushing stays with you.
3. It behaves the same on every machine. Every value in settings.json is set explicitly, even where it matches today's default, because defaults change between releases. minimumVersion keeps auto-updates from going below what the configuration needs.

What is inside

The split between rules/stack/ and opt-in/ is the core idea. A stack rule is true for a language wherever it is used, such as escaping output or pinning container images. An opt-in rule is a decision a project makes, such as BEM class names, so two projects in the same language can choose differently.

JSON has no comments, so the README explains the reason for every value. It is also honest about limits: deny rules match the form Claude normally writes, bash -c '…' gets past them, and the sandbox is the real boundary.

Try it

You need Claude Code 2.1.261 or later, macOS (the sandbox uses Seatbelt; Linux is untested), RTK and ripgrep on PATH.

1. Copy everything except opt-in/ into ~/.claude/.
2. Create ~/.claude/LOCAL.md for anything personal, such as your GitHub account or local paths. It can stay empty; the README has a template.
3. Start a new session and check that it works: run /skills, then ask Claude to read a .env file, to run git push and to run printenv. It must refuse all three.

For a project, copy a convention or a framework setup from opt-in/ into its .claude/ and change every rule the project does not follow.

Limits and feedback

ccc is a personal project, not a product. Some gaps are known and listed in the README: the environment can still be printed with export -p, not every combination of short Git flags is caught, and checkpoints miss files changed only through Bash.

The code is on GitHub at jarovarga/ccc under the ISC license.

Issues and pull requests are limited to collaborators, so send feedback on Mastodon at @[email protected].

Any feedback is very welcome, whether it is a bug, an idea or a different way of doing things.

Report a way out of the sandbox privately through the repository's security advisories.