handbooksWhere everything lives
Every file path, every scope, and which one wins when two of them disagree. The lookup page for the rest of this reference.
- This page is a lookup table, not a tutorial. Bookmark it and come back when you need a path.
- Every Claude Code artifact has two common locations: your home directory (
~/.claude/, personal, every project) and your repo (.claude/, shared with your team via git). - Do not assume the strongest-sounding file always wins. For permissions specifically, a
denyrule wins regardless of which file it is in.
Where each artifact lives
| Artifact | Personal (all projects) | Project (shared via git) |
|---|---|---|
| Settings | ~/.claude/settings.json | .claude/settings.json |
| Local-only settings | None | .claude/settings.local.json (auto-gitignored) |
| Memory | ~/.claude/CLAUDE.md | ./CLAUDE.md |
| Auto memory | Reviewed via /memory, not a path you edit directly | Reviewed via /memory, not a path you edit directly |
| Scoped rules | Not available | .claude/rules/*.md |
| Hooks | inside either settings.json | inside either settings.json |
| Skills | ~/.claude/skills/<name>/SKILL.md | .claude/skills/<name>/SKILL.md |
| Subagents | ~/.claude/agents/<name>.md | .claude/agents/<name>.md |
| Slash commands | ~/.claude/commands/<name>.md | .claude/commands/<name>.md |
| MCP servers | ~/.claude.json | .mcp.json (repo root) |
| Output styles | None | .claude/output-styles/*.md |
An enterprise-managed file can also exist above all of these: managed-settings.json and a managed CLAUDE.md, deployed by an organization's IT and impossible for anyone below that level to override.
Which file wins
For most settings, the more specific file wins. Your personal local file beats your project's shared file, which beats your personal global file. A company-managed file beats everything and cannot be overridden by anyone.
Permission rules are the one exception, and it is worth memorizing: deny always wins, regardless of which file it is in. A deny in your weakest file beats an allow in your strongest one. This is deliberate. It means a safety rule can never be quietly switched off by a more specific file.
{ "permissions": { "deny": ["Read(./.env)"] } }{ "permissions": { "allow": ["Read(./.env)"] } }Claude Code still refuses to read .env. See settings.json for the full precedence order across all four files.