Claude Code / cookbook

Write a PreToolUse hook. It receives the tool call as JSON on stdin, and exit code 2 blocks it — stderr goes back to Claude as the reason, so it can correct course rather than just fail.

import path from "node:path";

let raw = "";
process.stdin.on("data", (c) => (raw += c));
process.stdin.on("end", () => {
  const file = JSON.parse(raw)?.tool_input?.file_path;
  if (!file) process.exit(0);

  const root = process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
  const rel = path.relative(root, path.resolve(root, file));

  if (rel.startsWith("..") || !rel.startsWith("data" + path.sep)) {
    console.error(`writes are limited to data/ — blocked ${rel}`);
    process.exit(2); // 2 denies. 1 would be ignored.
  }
});

Scope it to the skill it guards by declaring it in that skill's frontmatter. A hook in settings.json polices every session from the start; a hook declared here registers the moment this skill is invoked and then keeps running for the rest of the session (add once: true on the hook if you only want it to fire a single time).

---
name: refresh-data
description: Re-derive the dataset from upstream.
allowed-tools: Read Write Edit WebFetch
hooks:
  PreToolUse:
    - matcher: "Write|Edit"
      hooks:
        - type: command
          command: node "${CLAUDE_PROJECT_DIR}/.claude/hooks/data-only.mjs"
---

Refresh the dataset. You may only write under `data/`.

Test the deny path directly — feed the hook a synthetic event rather than driving a whole session.

echo '{"tool_input":{"file_path":"src/index.js"}}' \
  | CLAUDE_PROJECT_DIR=$PWD node .claude/hooks/data-only.mjs; echo "exit=$?"
# exit=2  → denied, as intended

Allowlist the tools instead of denying the dangerous ones — a denylist is a list you will always be one entry behind on. --allowedTools accepts per-command Bash scoping.

claude -p "Summarize what changed in src/ this week and flag anything risky." \
  --allowedTools "Read,Grep,Glob,Bash(git log *),Bash(git diff *)" \
  --output-format json

Reach for --permission-mode acceptEdits only when the run is supposed to write, and pair it with a hook that bounds where.

claude -p "/refresh-data" --permission-mode acceptEdits \
  --allowedTools "Read,Write,Edit,WebFetch" \
  --max-turns 80

A boundary you state in chat blocks matching actions immediately, even ones the classifier's defaults would otherwise wave through. But it isn't stored as a rule — the classifier just re-reads it from the transcript on every check.

Don't push anything, to any branch, for the rest of this session — I'll review and push myself.

For the one thing that actually must never happen, back it with a deny rule instead. A rule isn't part of the transcript, so compaction can't lose it.

claude --permission-mode auto \
  --disallowedTools "Bash(git push *)" \
  "Audit infra/ for configs that violate our tagging policy and write findings to infra-audit.md"

If the classifier blocks something you didn't expect, /permissions lists it under the Recently blocked tab, where you can approve it so Claude may retry — that's how you find out it caught the right thing, instead of assuming.

/permissions

Define reviewers with disjoint mandates — the point is perspectives that can't collapse into each other. Give each only the tools it needs; a reviewer that can't write can't "helpfully" fix things mid-review.

---
name: security-reviewer
description: Reviews a diff for injection, authz, and secret-handling defects. Use for any change touching auth, input parsing, or shell invocation.
tools: Read, Grep, Glob
model: inherit
---

Review ONLY the diff you are given.

Report each finding as `file:line — severity — what breaks`.
A finding needs a concrete failure scenario: inputs, and the wrong
output or crash they produce. If you cannot name one, it is not a
finding — say so rather than padding the list.

Ask for them by name in one prompt so they run concurrently, each with its own context window.

claude "Review the diff against origin/main with the security-reviewer,
perf-reviewer, and api-reviewer subagents in parallel. Merge their
findings, drop duplicates, and sort by severity."

Delegate the sweep. The subagent reads widely and returns only what it concluded — the intermediate reads never enter your context.

Use the Explore subagent to find every place we construct a
Stripe client, and report back the file paths plus which config
key each one reads. Don't fix anything yet.

Then plan against the summary, with the context you saved.

claude --permission-mode plan "Given those call sites, plan the migration to a single factory."

Hand the whole migration to /batch. It researches the codebase, proposes 5–30 independent units, and — once you approve the plan — spawns one background subagent per unit, each in its own worktree, each opening its own PR.

/batch migrate every fetch() call in src/ to the new apiClient wrapper

Check on the units without leaving the session. /tasks lists this session's background work, including subagents that have already finished.

/tasks

Review each resulting PR in the background instead of pulling every diff into your own context — /code-review runs as its own subagent and can post its findings straight onto the PR as inline comments.

/code-review medium --comment 142

Drop a .worktreeinclude file at the repo root, in .gitignore syntax. Only files that are both gitignored and match a pattern get copied — tracked files are never duplicated.

.env
.env.local
config/secrets.json

That's it — it applies automatically to every worktree Claude Code creates with git: a --worktree session, a /batch unit, an isolation: worktree subagent. No flag or hook to wire up. Gitignore the worktree directory itself so its contents don't show up as untracked files back in the main checkout.

echo '.claude/worktrees/' >> .gitignore

The one place this doesn't reach: if you've replaced worktree creation with your own WorktreeCreate hook (for SVN, Perforce, or another non-git VCS), .worktreeinclude is skipped entirely — the hook owns the whole checkout, so copy those files inside the hook script instead.

Write the procedure once as a skill. Set disable-model-invocation: true when it should fire only on /name — a release procedure you did not ask for is a bug.

---
name: cut-release
description: Cut a release: changelog, version bump, tag, publish.
disable-model-invocation: true
allowed-tools: Read Edit Bash(git *) Bash(npm *)
argument-hint: "<major|minor|patch>"
---

Cut a **$0** release.

1. Verify the working tree is clean and you are on `main`. Stop if not.
2. Summarize commits since the last tag into `CHANGELOG.md`.
3. Bump the version, commit, tag `v<version>`.
4. Print the diff and **stop for review**. Do not push.

Invoke it as a command. $0 interpolates the argument.

# in-session
/cut-release minor

-p prints and exits; --output-format json makes the result parseable. Pull the answer out with jq.

verdict=$(claude -p "Read the failing test output in /tmp/ci.log.
Reply with exactly one word: flaky, or real." \
  --allowedTools "Read" \
  --output-format json | jq -r '.result')

if [ "$verdict" = "flaky" ]; then
  echo "retrying…" && npm test
fi

For long runs, stream events instead of waiting for the final blob.

claude -p "Audit every route for missing authz." \
  --output-format stream-json --verbose

Resume the last session in this directory with -c, or pick a specific one with --resume.

claude -c                       # continue the most recent session here
claude --resume                 # pick from a list
claude -c -p "what's left?"     # continue, headless, one question

Branch a session with --fork-session when you want to try a second approach without losing the first.

claude --resume <session-id> --fork-session