What to check after a Claude Code session ends (Chapter 6)

Two things are worth doing when a session ends.

Read the log of what was stopped. Every block is written to blocked-commands.log. It is the only honest record of what your setup did, as opposed to what it was configured to do. An empty log after a long unattended run means one of two things: nothing dangerous was attempted, or nothing is matching. Both are worth knowing, and they look identical from the outside unless you go and check.

Then turn the log into protections:

1 npx github:yurukusa/cc-safe-setup --learn

With no history yet, it tells you exactly that rather than pretending:

1   cc-safe-setup --learn
2   Analyzing your blocked command history to generate custom protections...
3 
4   No blocked-commands.log found.
5   Install cc-safe-setup first, then use Claude Code normally.
6   Blocked commands are logged automatically. Re-run --learn after a few sessions.

That is the right behaviour for a tool to have, and it is worth naming: it returned nothing and said why. A command that reports “0 issues found” when it never looked is the most expensive kind of bug a safety tool can have, because the output is indistinguishable from good news.