Five settings levels, one winner per key, and a policy only if it can be read — cheat sheet

# every level, for one key
for f in /etc/claude-code/managed-settings.json ~/.claude/settings.json \
         .claude/settings.json .claude/settings.local.json; do
  [ -r "$f" ] && printf '%s: %s\n' "$f" "$(jq -c '{model, permissions}' "$f")"
done
claude -p hi --output-format json 2>&1 >/dev/null | head    # "Managed settings failed to load…"

# managed policy on Linux: readable by all, writable by root
sudo install -d -m 755 /etc/claude-code
sudo install -m 644 -o root -g root policy.json /etc/claude-code/managed-settings.json
{
  "permissions": {
    "deny": ["WebFetch", "WebSearch", "Read(~/.ssh/**)"],
    "disableBypassPermissionsMode": "disable"
  }
}

# which model a session asks for
claude -p hi --output-format json | jq '.modelUsage | keys'

# personal files
git ls-files .claude CLAUDE.local.md
git rm --cached .claude/settings.local.json
printf '.claude/settings.local.json\nCLAUDE.local.md\n' >> .gitignore
git check-ignore -v .claude/settings.local.json

# memory and imports
grep -n '^@' CLAUDE.md                      # imports: relative to this file, case-sensitive
s=$(ls -t ~/.claude/projects/<project>/*.jsonl | head -1); grep -c 'a phrase from the import' "$s"