You leave Claude Code running while you do something else. You come back and something is gone. That is the moment this manual is written against. Hooks can stop the common ways it happens: a recursive delete, a hard reset, a secret going into a commit. Installing them takes about thirty seconds. But an installed guard and a working guard look identical from the outside, and almost nobody checks which one they have. This is that check, written out.
Chapter 1 — the pre-flight checklist. Four stages you can copy into your project: before the first session, before letting it run unattended, during, and after.
Chapter 2 — measure before installing. The audit is read-only. Nine findings on an empty project is a baseline, not a crisis; what matters is which of them are still there a week later.
Chapter 3 — what the guards actually refuse. The block messages, taken from the shipped hook definitions rather than from the documentation, followed by a section on what a hook cannot see at all.
Chapter 4 — prove they fire. Feed a guard the input it is supposed to refuse, and watch what comes back.
Chapter 5 — the npm package is the wrong one. It is frozen at 29.8.0 (2026-04-20). Fired against forty-one command shapes, twenty-five that the current code refuses are let through by the version npm serves, and nothing goes the other way. The obvious install command is the one that gets you that version.
Chapter 6 — after the session. An empty log of blocked commands means either that nothing dangerous was attempted or that nothing is matching, and from the outside those look the same.
Chapter 7 — which event can even stop a call. Only a `PreToolUse` hook can refuse. A `PostToolUse` hook is a witness: by the time it runs, the file is written and the branch is already reset. A guard wired to the wrong event is a guard that logs your loss.
Chapter 8 — an audit of the collection this book accompanies, and it is not flattering. Of the 915 example hooks in the repository, 609 cannot refuse anything on any path. They warn, they count, they log. That is a reasonable thing for a hook to be, and it stops being reasonable the moment you install one expecting a door.
Chapter 9 — what a broken hook does. It has two behaviours, not one, and which you get depends on how it broke. One is loud. The other is silent, and the silent one is the failure mode of the defensive line most people put on line 2. A hook that dies is a hook that said yes.
Chapter 10 — the catalogue. Every one of the 915 scripts, with the two facts you want before installing anything and cannot get from the filename: when it runs, and whether it can refuse.
Chapter 11 — what `--dangerously-skip-permissions` actually skips. The question behind every phrasing of it is the same: if I run with that flag, have I turned off everything I set up? Measured with the flag on, against the same guards, rather than argued from the documentation.
Appendix A — a citation index. 353 of the scripts name at least one issue number, covering 487 distinct issues. Given a number, it tells you which scripts cite it. It does not paraphrase the issues, because a paraphrase of an issue nobody re-read is how a book starts being wrong.
Every command output printed in Chapters 1 to 6 came from a clean sandbox, and the output you see is the output that came back. From Chapter 7 onward some numbers come from the author's own machine and from counting the repository — where that is the case, the text says so. Where a command fails, the failure is printed too, because a check that cannot fail is not a check.
It is the companion to cc-safe-setup, an MIT-licensed tool, and everything in it is also in that repository. You are not paying for secrets — and at a minimum price of zero, you are not paying at all. What you get is the parts that matter, in the order you need them.
What it is not: a guarantee. A hook sees one tool call at a time; it does not see intent. Chapter 3 says where the floor ends, and Chapter 8 says how much of the collection is standing on it. If you want a book that tells you your agent is now safe, this is not that book.
This manual is free and it stays free. Installing the guards is a different job and a different book. Claude Code Safety Mastery has the hooks themselves — git, credentials, token spikes, autonomous operation, multi-agent work — a chapter on hooks that do not fire, eight dated incidents where the guard failed silently, and the 50-point audit checklist, which is itself free and MIT-licensed in the repository. If you would rather work from the accident than from the mechanism, Claude Code Safety is arranged that way: four irreversible failures, and for three of them the hook that blocks the command before it runs. All seven of these books — the two above, this manual, and the four in the Operator's Library — are also sold together as Claude Code Operator's Library: Complete Edition: $39 against $74.94 bought separately.
