← Claude Code & MCP Masterclass
0/15 complete

Module 02 · CLI Workflows

Hooks and Automation: Running Actions on Every Edit

20 minfocused lesson5practical steps4grounded questions2source links
Open lesson + course map

On this lesson

Course outline

Claude Code hooks can run deterministic logic at lifecycle and tool events. Because hooks execute code automatically, a repository hook is part of the trusted software supply chain. Review it before accepting workspace trust.

// concept

Choose Guardrail, Feedback, or Audit

  • Guardrail: block a forbidden command/path before execution.
  • Feedback: run a targeted formatter or validator after a change.
  • Audit: record a minimal structured event.

Hooks should be fast, deterministic, bounded, and fail in a documented direction. Do not send repository contents to an external endpoint without explicit authorization.

// concept

Build Safely

Parse structured hook input rather than interpolating it into a shell string. Resolve paths to an approved root. Use timeouts. Redact secrets. Pin helper dependencies. Make messages actionable.

// prompt — copy me3 lines
if requested file resolves outside repo → block
if path is generated/** → block and name generator command
if edited file matches src/**/*.ts → run targeted formatter

Avoid running the full build after every tiny tool action; use staged checks and preserve the final full gate.

// worked_example

Worked Example

A Karachi fintech sample repo adds a pre-tool hook that blocks edits to migrations and .env*, plus a post-edit hook that runs a TypeScript formatter on changed source files. The pre-tool check resolves canonical paths and cannot be bypassed with ../.

The team tests allowed edit, forbidden file, path traversal, timeout, malformed input, and missing formatter. A separate CI build remains authoritative.

// failure_cases

Failure Cases to Diagnose

6 cases to diagnose

  • Hook concatenates untrusted command text

    parse and allowlist.

  • Repository hook accepted blindly

    inspect before trust.

  • Hook contains a secret

    use managed environment and rotate exposure.

  • Network upload is hidden telemetry

    remove or obtain authority.

  • Every edit triggers long tests

    scope fast feedback.

  • Failure silently ignored

    define block/warn behavior.

// concept

Operator Note

Version hooks alongside the repository and require ordinary code review. Record which event invokes each hook, its maximum runtime, exit-code meaning, and owner. A break-glass disable mechanism should be documented, but disabling a security hook must be visible and temporary. When a hook changes, rerun its abuse tests before trusting the workspace again.

// pakistan_angle

Pakistan Angle

Do not upload Pakistani customer, banking, CNIC, payroll, or health data through a hook. Client repositories may contain sensitive fixtures; treat automated scanners and SaaS endpoints as third-party processors requiring approval.

On unstable networks, local deterministic checks should fail clearly, not retry forever. Keep the final build reproducible offline where feasible.

// hands_on

Hands-On Exercise

5 steps

  1. Define one guardrail and one feedback hook.

  2. Parse structured input and resolve paths safely.

  3. Add timeout, redaction, and clear exit behavior.

  4. Test traversal, malformed input, and missing dependency.

  5. Document trust and disable procedure.

// completion_rubric

Completion Rubric

6 checks — tick as you verify

0/6

// sources

Sources

2 official sources — check every claim yourself

// check_yourself

Check yourself

4 questions · answers and options are taken word-for-word from this course

0/4

  1. 1 / 4 · diagnose

    Your work shows this failure mode: “Hook contains a secret.” What does the lesson tell you to do about it?