chore: bootstrap sandbox settings

.claude/settings.local.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "allow": [
+      "Bash(npm *)",
+      "Bash(npm:*)",
+      "Bash(npx *)",
+      "Bash(node *)",
+      "Bash(tsx *)",
+      "Bash(esbuild *)",
+      "Bash(vitest *)",
+      "Bash(tsc *)",
+      "Bash(. ~/.nvm/nvm.sh*)",
+      "Bash(source ~/.nvm/nvm.sh*)",
+      "Bash(git *)",
+      "Bash(tea *)",
+      "Bash(tea:*)",
+      "Bash(gh *)",
+      "Bash(claude *)",
+      "Bash(curl *)",
+      "Bash(xargs -r kill)"
+    ],
+    "deny": [
+      "Bash(npm publish*)",
+      "Bash(sudo *)"
+    ],
+    "defaultMode": "acceptEdits"
+  },
+  "sandbox": {
+    "enabled": true,
+    "autoAllowBashIfSandboxed": true,
+    "network": {
+      "allowedDomains": [
+        "registry.npmjs.org",
+        "*.npmjs.org",
+        "nodejs.org",
+        "*.nodejs.org",
+        "raw.githubusercontent.com",
+        "objects.githubusercontent.com",
+        "codeload.github.com",
+        "github.com",
+        "api.github.com",
+        "*.bchen.dev"
+      ],
+      "allowLocalBinding": true
+    },
+    "filesystem": {
+      "allowWrite": [
+        "/home/brendan/sqlite-migrate",
+        "/home/brendan/sqlite-migrate/.git",
+        "/home/brendan/.npm",
+        "/home/brendan/.config/tea"
+      ],
+      "denyWrite": []
+    }
+  }
+}