Guides
Practical, tested answers to the questions people actually search for about Claude Code hooks, guardrails, secrets, plugins and testing discipline. Written against the current documentation and updated when Claude Code changes.
Latest guide
Claude Code in CI: running headless with -p safely
A headless run has nobody to answer prompts, so it trusts the repository's hooks automatically while ignoring the repository's allow rules — here is what that inversion costs and the four flags that close it.
Read it{ "PreToolUse": [{ "matcher": "Bash",
"hooks": [{ "type": "command",
"command": "bash guard.sh" }] }] }
# every guide ends with something you can paste
- Guide · 2026-09-13 · 5 minClaude Code --dangerously-skip-permissions: what it actually disables and safer alternativesThe flag turns off permission prompts and the protected-path checks, but not deny rules, ask rules or the critical-path circuit breaker — and there are three narrower settings that get you most of the same speed.Read →
- Guide · 2026-09-12 · 6 minClaude Code deleted my files: what happened and how to get them backWhich deletions /rewind can undo and which it cannot, the git commands that recover the rest (including work you only ever staged), and the three settings that decide whether recovery is possible at all.Read →
- Guide · 2026-09-11 · 7 minClaude Code permissions explained: allow, ask, deny, and settings.json examplesHow Claude Code decides whether a tool call runs — the three rule lists, the order they are evaluated in, the exact settings.json shapes, and the rules that quietly match less than you think.Read →
- Guide · 2026-09-09 · 5 minSkills vs subagents vs hooks: which Claude Code extension point to useClaude Code has three ways to change how it behaves — skills, subagents and hooks. They solve different problems. A decision rule, the exact file layout for each, and the limits nobody mentions until you hit them.Read →
- Guide · 2026-09-06 · 6 minClaude Code hooks: the practical guide (2026)Every hook event, what JSON your script receives, how to block a tool call with exit codes or a JSON decision, matchers, hook types, and a copy-paste guardrail — with the mistakes that bite.Read →
- Guide · 2026-09-06 · 2 minClaude Code plugin marketplaces: install, private repos, and updatesHow marketplaces work, the marketplace.json format, installing from GitHub, using a private repository as a paid or team-only marketplace, version pinning, and how updates propagate.Read →
- Guide · 2026-09-06 · 3 minKeeping secrets out of Claude Code: .env files, keys and transcriptsHow credentials leak through an AI coding session (reading .env, writing keys into code, dumping env), what the transcript retains, and a layered fix using Read/Edit/Bash hooks and a post-write scanner.Read →
- Guide · 2026-09-06 · 2 minMaking Claude Code actually run the tests before it says doneWhy models declare victory without running tests, what CLAUDE.md can and cannot fix, and a Stop hook pattern that tracks edits and test runs to gate the end of a turn.Read →
- Guide · 2026-09-06 · 3 minHow to stop Claude Code from running rm -rf, force pushes and DROP TABLEThe destructive commands agents actually run by accident, why deny-lists in settings.json are not enough, and a hook-based guardrail that blocks them with a reason the model can act on.Read →