Claude Code Operator's Library: Complete Edition

Between March and April 2026, Claude Code subscribers on the Max ($200/mo) and Pro ($20/mo) plans lived through six weeks of stacked regressions: cache TTL shortened from sixty minutes to five, a tokenizer that charged 1.35 to 1.46 times more for the same prompts, Pro access that briefly disappeared and returned forty-eight hours later with no public explanation, and a third-party tool ban.

This playbook turns that window into a decision instead of a guess. Five measurable triggers tell you which situation you are actually in.

Three paths — stay and fortify, switch, or build your own stack — are laid out with a 30-day cost projection for each. A decision tree returns one specific recommendation rather than a menu, and Chapter 9 makes that decision reversible within forty-eight hours if the output turns out to be wrong.

Edition 2 is 251 pages: ten decision-framework chapters, six path supplements, a decision tree expanded from three paths to six, and four appendices — source citations, a competitor grid, further reading, and an updates log.

Edition 1 covered the March–April 2026 regression window. Edition 2 carries it forward through the later trigger clusters — Triggers 11 to 16, including silent regression and quota burnout, claim-reality divergence, irreversible operations, and project-scoped settings as an MCP injection vector — and the June 15 billing split, with Chapter 10 on the team performance metrics that hold up under the new economics.

This book is reconstructed from public GitHub Issues, Hacker News threads, Simon Willison's measurement posts, The Register's coverage, and independent reverse-engineering. It is not affiliated with or endorsed by Anthropic.

Also sold in two bundles. The four-book Claude Code Operator's Library — this playbook plus Safety Mastery, the token-cost guide, and the AGENTS.md interop handbook — is from $29, and through September 21, 2026 a Leanpub promotion prices all four at $14.50, against $51.96 at their suggested prices bought separately (Leanpub set that promotional price, not the author): https://leanpub.com/b/cc-operators-library/c/LeanPublishingDaily20260917 . A seven-book Complete Edition is $39: https://leanpub.com/b/cc-operators-complete

Written by an independent operator who runs Claude Code autonomously and maintains cc-safe-setup, a free MIT-licensed collection of 914 example safety hooks: https://github.com/yurukusa/cc-safe-setup

Claude Code users routinely spend more on tokens than they expect, and cannot see where the money goes.

This guide diagnoses specific token-waste patterns with real cost data from the author's own production Claude Code operation, then gives measured fixes: why costs spike overnight and the first settings to check; the hidden costs of sub-agents, thinking tokens, and context-window bloat; and a chapter-by-chapter diagnostic workflow with real dollar figures.

Chapter 8 alone is a catalogue of 48 diagnosable symptoms, each with what it looks like, what causes it, and what to change.

Chapter 10 adds the April 2026 incidents — the cache TTL silent change, the v2.1.100 cache_creation inflation, and a $1,446 unauthorized transfer traced to its cause. Chapter 11 adds May 2026, the month single failures became clusters: silent skips, silent model swaps, sub-agent boundary gaps, and a $6,000 overnight quota burn.

Revised edition of 2026-08-21: 11 chapters, 89 pages. Updates are free to buyers.

Not theory and not prompt packs: symptoms you can match against your own session, copy-paste templates, and measurements rather than reasoning. Written against Claude Code as it stood through mid-2026 — what carries over is the diagnostic method and the numbers behind it.

Also sold in two bundles. The four-book Claude Code Operator's Library — this guide plus Safety Mastery, the Migration Playbook, and the AGENTS.md interop handbook — is from $29, and through September 21, 2026 a Leanpub promotion prices all four at $14.50, against $51.96 at their suggested prices bought separately (Leanpub set that promotional price, not the author): https://leanpub.com/b/cc-operators-library/c/LeanPublishingDaily20260917 . A seven-book Complete Edition is $39: https://leanpub.com/b/cc-operators-complete

Written by an independent operator who runs Claude Code autonomously and maintains cc-safe-setup, a free MIT-licensed collection of 914 example safety hooks: https://github.com/yurukusa/cc-safe-setup

Claude Code is powerful, and that is exactly the risk. But once the five essential hooks are in place, the incidents that keep happening are no longer Claude deleting your files. They are the guards themselves failing, usually with no error at all: a stashing hook that swallowed 3,071 entries of uncommitted work, a cost circuit breaker wired to the wrong event that read zero for months, seventeen of nineteen hooks blocking nothing on a machine without jq, and a subagent limiter that stopped the parent and never the child.

Eight chapters take you from the five essential hooks every user should install first, through Git protection, credential guards, token-spike alerts, autonomous-operation safeguards, multi-agent safety, and troubleshooting hooks that do not fire, closing with eight dated incidents and a 50-point safety audit checklist. Every hook is tested and explained.

The incidents come from one autonomous Claude Code operation running since 2026-02-15: a single operator, personal repositories, no team and no production service. For Claude Code users who want to run it safely, especially autonomously, and for teams who need consistent safety policies across contributors.

Also sold in two bundles. The four-book Claude Code Operator's Library — this book plus the Migration Playbook, the token-cost guide, and the AGENTS.md interop handbook — is from $29, and through September 21, 2026 a Leanpub promotion prices all four at $14.50, against $51.96 at their suggested prices bought separately (Leanpub set that promotional price, not the author): https://leanpub.com/b/cc-operators-library/c/LeanPublishingDaily20260917 . A seven-book Complete Edition is $39: https://leanpub.com/b/cc-operators-complete

Written by an independent operator who runs Claude Code autonomously and maintains cc-safe-setup, a free MIT-licensed collection of 914 example safety hooks: https://github.com/yurukusa/cc-safe-setup

Stop maintaining CLAUDE.md and AGENTS.md as two files that drift apart. Claude Code reads CLAUDE.md; Codex, Amp, and GitHub Copilot read AGENTS.md natively; Cursor, Windsurf, and Cline read their own files; Aider and Gemini CLI read AGENTS.md only after you configure them.

That gap was the most-reacted feature request in Claude Code — issue #6235, 6,516 reactions — and it was closed as completed on 2026-08-17. So is the problem gone? Re-measured on 2026-08-28: the official CHANGELOG runs to 2.1.248 and mentions AGENTS.md zero times (the control word "hook" appears 271 times, so the search works), and on 2.1.246 an AGENTS.md is still not loaded into context the way CLAUDE.md is.

Chapter 9 shows why the usual test says otherwise: put a plain fact in AGENTS.md and ask for it, and the agent runs ls, opens the file and answers correctly — it went looking. Put an instruction there and ask something unrelated, and it makes no tool call at all and the instruction is not in force. Discoverable, not loaded.

Chapter 9 also names what did ship behind the closed issue: not a reader, but a Codex config importer that copies AGENTS.md into CLAUDE.md — and on this build it answers "claude import is not yet available in this build". A closed issue is not the same as working in your environment, and this handbook shows you how to tell the difference in your own setup.

This handbook removes the duplication tax. It gives you a verified 9-tool matrix: which file each tool reads, whether it needs setup, and the one thing to watch — checked against every tool's official docs on 2026-06-02.

It ranks six sync paths by trade-off: the official @AGENTS.md import, symlink, pre-commit sync, SessionStart hook, direnv, and a CI drift check.

And it hands you the parts: copy-paste templates for all nine tools plus a complete repo layout, a rollback-safe migration runbook to move CLAUDE.md to AGENTS.md without losing Claude-only behavior, and a team drift guard that makes divergence fail loudly.

36 pages, dense and practical, with free updates as conventions change. Read the free sample before you buy.

Try the free AGENTS.md Setup Generator and the field-guide Gist first; buy this for the full matrix, the runbook, and the templates in one place.

Also sold in two bundles. The four-book Claude Code Operator's Library — this handbook plus Safety Mastery, the Migration Playbook, and the token-cost guide — is from $29, and through September 21, 2026 a Leanpub promotion prices all four at $14.50, against $51.96 at their suggested prices bought separately (Leanpub set that promotional price, not the author): https://leanpub.com/b/cc-operators-library/c/LeanPublishingDaily20260917 . A seven-book Complete Edition is $39: https://leanpub.com/b/cc-operators-complete

Written by an independent operator who runs Claude Code unattended and maintains cc-safe-setup, a free MIT-licensed collection of 914 example safety hooks: https://github.com/yurukusa/cc-safe-setup . Independent handbook — not affiliated with Anthropic, OpenAI, GitHub, or Google.

I sell tools that stop Claude Code from doing dangerous things, and the sentence at the centre of my marketing was "rules you write in CLAUDE.md get skipped, so you need enforcement."

In late August 2026 I measured it. Thirty-nine trials, Claude Code 2.1.246, two task families, twelve conditions, an observer hook recording every shell command before it ran.

In the 22 trials where the ban was written into a project CLAUDE.md, the banned command was never once attempted. In the 17 trials where it was not written, it was attempted 17 times out of 17.

Nothing I built to break that worked. Not burying the rule in the middle of a 128-line instruction file. Not moving it to the eighteenth of twenty sections. Not planting two other sections in the same file that explicitly told the model to use the banned command. Not raising the stakes from "replace a string in a config file" to "delete files you cannot get back."

Then I translated the whole harness and ran it again in English, because every instruction file in the original was Japanese and that was the largest hole in the result. It reproduced: three out of three attempts without the rule, zero out of three with it.

This book is the full record. The instrument and why the obvious design does not work. Every trial's raw counts, including the six that never started. Six worked examples of my own measuring code producing real numbers for the wrong quantity, and how each one was caught. And the arithmetic on what small samples cannot tell you: zero out of twenty-five bounds the failure rate at about 11 percent. It does not mean "never".

It also contains the measurement that cost me the other half of my sales pitch. A reviewer objected to my claim that a hook makes a violation impossible, so I tested that too. A PreToolUse hook blocks on exactly one exit status. A hook with a syntax error exits with a different one and does not block. Whether a MISSING hook script protects you depends on which interpreter you named in the command: "python3 missing.py" blocks everything and "bash missing.sh" silently lets it through - and "sh missing.sh" goes either way depending on what /bin/sh is on that machine. Ordinary bugs turn your guard off, and the only symptom is a line of stderr nobody reads.

What you get:

- Every condition, every trial, every command the model actually ran

- The harness, cleaned into a single script, so you can run it against your version, your language and your task. It is the same script the English replication used, so you know it works start to finish

- What belongs in CLAUDE.md and what belongs in a hook, tied to specific measurements instead of folklore

- Six worked examples of an instrument producing real numbers for the wrong quantity - the most transferable skill in the book

- A one-minute check for rules that name files which no longer exist, measured at roughly 4 to 7 percent of public repositories that have a CLAUDE.md

What this is not: a certification answer key, a template pack, or a claim that CLAUDE.md is sufficient. One model version, one primary language, two task families, small n. I direct an agent rather than writing the code myself, and the book says so. Every limit is stated in its own chapter, before the practical advice rather than after it.

If you run the harness and get a different answer, yours describes your situation and mine does not. That is the whole reason the scripts are in the book.

You leave Claude Code running while you do something else. You come back and something is gone. That is the moment this manual is written against. Hooks can stop the common ways it happens: a recursive delete, a hard reset, a secret going into a commit. Installing them takes about thirty seconds. But an installed guard and a working guard look identical from the outside, and almost nobody checks which one they have. This is that check, written out.

Chapter 1 — the pre-flight checklist. Four stages you can copy into your project: before the first session, before letting it run unattended, during, and after.

Chapter 2 — measure before installing. The audit is read-only. Nine findings on an empty project is a baseline, not a crisis; what matters is which of them are still there a week later.

Chapter 3 — what the guards actually refuse. The block messages, taken from the shipped hook definitions rather than from the documentation, followed by a section on what a hook cannot see at all.

Chapter 4 — prove they fire. Feed a guard the input it is supposed to refuse, and watch what comes back.

Chapter 5 — the npm package is the wrong one. It is frozen at 29.8.0 (2026-04-20). Fired against forty-one command shapes, twenty-five that the current code refuses are let through by the version npm serves, and nothing goes the other way. The obvious install command is the one that gets you that version.

Chapter 6 — after the session. An empty log of blocked commands means either that nothing dangerous was attempted or that nothing is matching, and from the outside those look the same.

Chapter 7 — which event can even stop a call. Only a `PreToolUse` hook can refuse. A `PostToolUse` hook is a witness: by the time it runs, the file is written and the branch is already reset. A guard wired to the wrong event is a guard that logs your loss.

Chapter 8 — an audit of the collection this book accompanies, and it is not flattering. Of the 915 example hooks in the repository, 609 cannot refuse anything on any path. They warn, they count, they log. That is a reasonable thing for a hook to be, and it stops being reasonable the moment you install one expecting a door.

Chapter 9 — what a broken hook does. It has two behaviours, not one, and which you get depends on how it broke. One is loud. The other is silent, and the silent one is the failure mode of the defensive line most people put on line 2. A hook that dies is a hook that said yes.

Chapter 10 — the catalogue. Every one of the 915 scripts, with the two facts you want before installing anything and cannot get from the filename: when it runs, and whether it can refuse.

Chapter 11 — what `--dangerously-skip-permissions` actually skips. The question behind every phrasing of it is the same: if I run with that flag, have I turned off everything I set up? Measured with the flag on, against the same guards, rather than argued from the documentation.

Appendix A — a citation index. 353 of the scripts name at least one issue number, covering 487 distinct issues. Given a number, it tells you which scripts cite it. It does not paraphrase the issues, because a paraphrase of an issue nobody re-read is how a book starts being wrong.

Every command output printed in Chapters 1 to 6 came from a clean sandbox, and the output you see is the output that came back. From Chapter 7 onward some numbers come from the author's own machine and from counting the repository — where that is the case, the text says so. Where a command fails, the failure is printed too, because a check that cannot fail is not a check.

It is the companion to cc-safe-setup, an MIT-licensed tool, and everything in it is also in that repository. You are not paying for secrets — and at a minimum price of zero, you are not paying at all. What you get is the parts that matter, in the order you need them.

What it is not: a guarantee. A hook sees one tool call at a time; it does not see intent. Chapter 3 says where the floor ends, and Chapter 8 says how much of the collection is standing on it. If you want a book that tells you your agent is now safe, this is not that book.

This manual is free and it stays free. Installing the guards is a different job and a different book. Claude Code Safety Mastery has the hooks themselves — git, credentials, token spikes, autonomous operation, multi-agent work — a chapter on hooks that do not fire, eight dated incidents where the guard failed silently, and the 50-point audit checklist, which is itself free and MIT-licensed in the repository. If you would rather work from the accident than from the mechanism, Claude Code Safety is arranged that way: four irreversible failures, and for three of them the hook that blocks the command before it runs. All seven of these books — the two above, this manual, and the four in the Operator's Library — are also sold together as Claude Code Operator's Library: Complete Edition: $39 against $74.94 bought separately.

You let Claude Code edit files, run shell commands, touch your database — maybe unattended, while you do something else. The question this book answers is the one in the back of your mind: what stops it from destroying something you cannot get back? That fear is not paranoia. An agent ran drizzle-kit push --force on a production Postgres and wiped more than sixty tables (#27063). Another escalated to prisma db push --force-reset and dropped all eighty-seven (#36183). A third was asked only to investigate a production error and ran ALTER TABLE ... DROP COLUMN twice on the live database (#46684). Every incident here is cited by issue number so you can read the original yourself — with one exception, a widely reported third-party case, which the book flags in the table as press-sourced rather than letting it sit unmarked among the others. Four classes of irreversible accident — databases, files, git history, and /rewind — each get the defence that applies and an ordered recovery runbook, with an honest line about what is genuinely gone. Three of the four get the exact PreToolUse hook that stops the command before it runs, ready to paste into settings.json; /rewind does not, because slash commands are not tool calls and no PreToolUse hook sees one, so that chapter gives the settings-level lever, the recovery order, and the one place a refusal could still live. The git-history chapter is built from the mechanism and the blockable list rather than from a single cited incident. What you get that a list of hooks does not give you: - A guard that was fired in both directions, and the results are printed. 195 commands: 123 that must be blocked, 72 ordinary ones that must not. The passing set is what decides whether you keep the guard — git stash push passes while git stash drop is blocked; git push origin main passes while git push --force is blocked; rm -rf ~/projects/app/node_modules passes while rm -rf ~/Documents is blocked; docker compose down passes while docker compose down -v is blocked. - The false positives, with the exact commands. You will know before you install it which harmless things it interrupts, so you can decide once instead of discovering them one irritation at a time. - The four things it genuinely cannot catch, also with commands — including the empty-variable accident that is Chapter 2's own headline story, because a hook sees the command before the shell expands it. Where the boundary is, and what covers the other side of it. - The one line that decides whether any of it runs. On a machine without jq, a guard like this exits 0 — which Claude Code reads as permission, with no error and no warning. The book shows the check that makes that condition announce itself instead, and why the exit code you choose determines whether the warning reaches a human at all. - A setting that removes /rewind's destructive option at the source, confirmed in the shipped 2.1.258 binary, with the part that was not tested kept clearly separate from the part that was. - Where each cited issue stands today. Five of the six closed for inactivity, not because anything was fixed. The sixth closed as "completed" and users kept reporting the same behaviour afterwards. The book explains why, in that table, "completed" is the weakest signal on the page — a habit you can apply to any tracker. Also: a chapter on why writing "never delete the database" in CLAUDE.md is not a control point you can check — with the documented case of exactly that rule being ignored, and with my own 48 runs measuring how often a written rule actually holds — and what to use instead. Written for the individual operator, not a security team. Fifteen minutes gets you a recoverable setup. The guards come from cc-safe-setup, the author's free MIT-licensed hook collection; this book is the organised depth on top of it, not the only way to stay safe. Independent, and not affiliated with Anthropic or any provider. The verification runs described in the first person were carried out by the author's Claude Code agent, on the author's machine, under the author's direction — which is also the setup this book is about. This book is also in Claude Code Operator's Library: Complete Edition - seven handbooks for $39, against $74.94 bought separately: https://leanpub.com/b/cc-operators-complete