Backend · Claude Code (via permissions.deny)
Bun & Elysia / Hono .claudeignore
A .claudeignore for Bun & Elysia / Hono: the paths Claude Code should stay out of, with matching permissions.deny rules.
- Path
- .claudeignore
- Loads
- Pattern list
- Format
- gitignore syntax
- Used by
- Claude Code (via permissions.deny)
What this file tells the agent
Claude Code reads files while it works. This .claudeignore keeps the list of Bun & Elysia / Hono paths it should stay out of (build output, large binaries, logs and secrets). Copy the sensitive ones into permissions.deny in .claude/settings.json, which Claude Code enforces.
- Use Elysia's native t schema builder (powered by TypeBox) for request body, query, and parameter validation.
- Leverage native Bun.serve(), Bun.file(), and Bun.password instead of slow Node.js polyfills or external dependencies.
- Structure plugins using .use() and define explicit Eden Treaty contracts for frontend consumption.
- Handle application errors using Elysia .onError(({ code, error, set }) => ...) with typed error codes.
- Ensure zero unhandled promise rejections and use strict type inference for all endpoint responses.
Code to avoid, and what to write instead
The rule steers the agent away from the left and toward the right.
// Discouraged: Node.js bcrypt imports, unvalidated body, and Express paradigms
import bcrypt from "bcrypt";
app.post("/users", async (req: any, res: any) => {
const hash = await bcrypt.hash(req.body.password, 10);
res.json({ success: true });
});import { Elysia, t } from "elysia";
export const app = new Elysia()
.onError(({ code, set }) => {
if (code === "NOT_FOUND") {
set.status = 404;
return { ok: false, error: "Resource not found" };
}
})
.post(
"/api/users",
async ({ body, set }) => {
const hash = await Bun.password.hash(body.password);
set.status = 201;
return { ok: true, email: body.email };
},
{
body: t.Object({
email: t.String({ format: "email" }),
password: t.String({ minLength: 8 }),
}),
}
);Install it in one command
- 01
Go to your project root
The file goes at .claudeignore, relative to the root.
- 02
Download the file
Run the command on the right. It downloads this preset and writes the file.
- 03
Make sure it gets used
Claude Code does not enforce .claudeignore by itself. Copy the sensitive paths into permissions.deny in .claude/settings.json, which it does enforce.
$ curl -fsSL "https://www.devscratchpad.tech/api/raw/claudeignore/bun-elysia" -o ".claudeignore"
writes .claudeignore
.claudeignore
To write the file from your own code instead, use Read your code or Convert Legacy Rules in the editor above.
More for Bun & Elysia / Hono
Questions
- Does Claude Code honor .claudeignore?
- Not by itself. Claude Code enforces permission rules, so copy the sensitive paths into permissions.deny in .claude/settings.json, for example Read(./.env). Keep .claudeignore in the repository root as the reviewable list.
- What should I put in .claudeignore?
- Exclude large build caches, minified bundles, lockfiles, and environment files containing sensitive credentials.