Claude Code Safety Hooks Pack: 5 tested hooks for Windows, macOS and Linux

Claude Code resends the whole conversation on every turn, so one huge build log keeps riding along for the rest of the session, and a long session can pass 200,000 tokens before you look. Separately, an agent that can run rm can run it in the wrong folder.

This pack is five hooks that deal with those problems. Each one comes with the settings to wire it in and tests that feed it the same JSON Claude Code sends.

The five hooks

• Protected-path guard (PreToolUse). List folders in a JSON file. Edits, rm, mv, redirects, git clean, Remove-Item, Set-Content and similar writes into them are refused, or you're asked first. Reading (ls, cat, grep, Get-Content) still works. If the guard itself crashes or times out, the call is blocked.
• Output truncation (PostToolUse). Bash, PowerShell or MCP output over 15,000 characters is saved to a file. Claude sees the first 2,500 characters, the last 1,500 and the file path. In our test, a 38,590-character log went into context as 4,303 characters. The hook keeps the tool's own output format, which Claude Code requires before it will accept a replacement.
• Token sentinel (UserPromptSubmit). Shows you a one-line warning when the context passes 150,000 tokens (you choose the number), once per 25,000-token step. It has a scan mode for a nightly job too.
• Cache pruning (SessionStart). Clears truncation files older than 3 days. It deletes nothing else.
• Transcript dump (PreCompact, SessionEnd). Saves the last 160 transcript lines before compaction and at exit, with known key and token formats redacted.

What's in the zip

• The five hooks: plain Python 3.8+, standard library only
• settings.json snippets for Windows (Git Bash or PowerShell) and for macOS/Linux
• An example protected-folder list
• 76 pytest cases. Each one runs a hook as its own process, sends it hook JSON on stdin and checks the answer. On our Windows machine: 75 passed, 1 skipped (a symlink test that needs a Windows privilege).
• A README and a 6-page PDF guide (cover included): install, each hook's behaviour, every setting, troubleshooting and uninstall

What it does not do

• The guard reads the command line only. It can't see inside scripts (python cleanup.py passes), doesn't decode obfuscated commands, and doesn't cover MCP tools. It's a guard rail against mistakes, not a security boundary. Keep backups.
• The guard errs toward blocking, so a command like cp out of a protected folder is refused too.
• Truncation leaves Read, Grep and the other built-in tools alone, and doesn't summarise anything.
• The sentinel warns. It never compacts or clears for you.
• Redaction catches known secret formats, not a bare password with no label. Treat the dump folder as private.
• It's not an Anthropic product, and a future change to Claude Code's hook format may need an update.

Pairs with the Memory Kit

Pairs with our Claude Code Persistent Memory Kit ($29), which loads your own notes into every session: https://payhip.com/b/jKlwY or https://amagilabs.gumroad.com/l/cc-memory-kit. Both include a transcript dump hook. They write to different folders and don't clash, so if you install both you can leave this pack's dump hook out.

Before you buy

You need Claude Code v2.1.295 or later and Python 3 on your PATH. We ran the test suite on Windows 11. The macOS and Linux settings use the same scripts with python3.

How it was made

Written with AI help (Claude) and reviewed by AmagiLabs before release.

Refunds

All sales are final. You get this digital download right away, so we don't give cash refunds. If a file won't open or the product doesn't match this page, email us within 7 days of purchase. We'll fix it or send a replacement. If we can't, you'll get store credit for the full price.

Licence: use on your own machines for personal and client work. No resale or sharing.