How To'sSE Kit for Claude Code
Safety Hooks
Four guards against the common accidental disasters.
The hooks fail safe: each exits 0 (allow) on any error or missing dependency, so they never block a legitimate session. They are safety nets for the common accidental cases, not security boundaries against a determined bypass.
| Hook | Event | What it does |
|---|---|---|
sf-org-guard.sh | PreToolUse (Bash) | Blocks destructive sf CLI commands outright and gates deploys and data mutations against production orgs, including commands that rely on your default target org. Configure prod aliases with SF_PROD_ALIASES. |
dangerous-command-guard.sh | PreToolUse (Bash) | Blocks reboot, shutdown, halt, and killall WindowServer unless you run them yourself. |
subagent-guard.sh | PreToolUse (Agent) | Warns before spawning a sub-agent when too many claude processes are already running. Tune with CLAUDE_MAX_AGENTS. |
compact-window-guard.sh | SessionStart | Keeps auto-compact firing near 500k tokens and re-asserts the value if a managed-settings tool reverts it. |
Key configuration
Set these in your shell profile or under .env in ~/.claude/settings.json:
SF_PROD_ALIASES: pipe-separated grep pattern of your production org aliases, for exampleexport SF_PROD_ALIASES="prod|production|acme-prod". Set this, or the prod gate only catches aliases literally containing "prod".SF_PROD_USERS: pattern of production usernames or emails (optional).CLAUDE_MAX_AGENTS: sub-agent warning threshold (default 5).