diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..5b5e261
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,17 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(poetry run pytest:*)",
+      "Bash(poetry run mypy:*)",
+      "Bash(poetry run ruff check:*)",
+      "Bash(poetry run ruff format:*)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)"
+    ],
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)"
+    ]
+  }
+}
diff --git a/.gitignore b/.gitignore
index ad6580a..74ea6df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -189,4 +189,7 @@ junit/
 .run/
 
 # macOS
-.DS_Store
\ No newline at end of file
+.DS_Store
+# Claude Code local state (commands/ is tracked)
+.claude/settings.local.json
+.claude/worktrees/