diff --git a/.claude/settings.json b/.claude/settings.json
index eb18c34c..32375a3f 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "CMD=$(python3 -c \"import json,sys; d=json.load(sys.stdin); print(d.get('tool_input',d).get('command',''))\" 2>/dev/null || true); case \"$CMD\" in *grep*|*rg\\ *|*ripgrep*|*find\\ *|*fd\\ *|*ack\\ *|*ag\\ *)   [ -f graphify-out/graph.json ] &&   echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"additionalContext\":\"graphify: Knowledge graph exists. Read graphify-out/GRAPH_REPORT.md for god nodes and community structure before searching raw files.\"}}'   || true ;; esac"
+            "command": "CMD=$(python3 -c \"import json,sys; d=json.load(sys.stdin); print(d.get('tool_input',d).get('command',''))\" 2>/dev/null || true); set -- $CMD; case \"$1\" in grep|egrep|fgrep|rg|ripgrep|find|fd|ack|ag) [ -f graphify-out/graph.json ] && echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"additionalContext\":\"graphify: Knowledge graph exists. Read graphify-out/GRAPH_REPORT.md for god nodes and community structure before searching raw files.\"}}' || true ;; esac"
           }
         ]
       }
diff --git a/.gitignore b/.gitignore
index f919efce..7f720b6a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,5 +65,11 @@ graphify-out/
 !.agents/**/*.md
 !.claude/**/*.md
 
-# [local-only 2026-05-12] .claude/worktrees 는 git worktree 메타라 추적 제외
+# [local-only 2026-05-12] .claude 는 화이트리스트 방식 — settings.json + md 만 추적
+# 머신 전용(settings.local.json, projects/, history.jsonl, todos/, cache/ …) 은 모두 차단
+.claude/**
+!.claude/**/
+!.claude/settings.json
+!.claude/**/*.md
+.claude/settings.local.json
 .claude/worktrees/