#Claude Code
54 articles
-
Stop Claude Code reading your .env with a Read deny rule
A Read deny rule is the reliable way to keep .env out of the model's input. How to write the pattern, how depth and anchoring change its reach, and where deny stops working.
-
This week in Claude Code, Codex and Gemini CLI (week of October 25, 2026)
Claude Code 2.1.309 lands a cluster of sandbox and permission-check bypass fixes, and Codex 0.164.0 adds /presets and credential masking. The ten changes from this week.
-
Claude Code plan mode: review the plan before any file is touched
How to enter plan mode in Claude Code, how it differs from the other permission modes, the path from an approved plan to the code, and when a plan is worth the extra step.
-
Claude Code starts in auto mode by default — all six permission modes compared
With v2.1.283 or later a terminal session starts in auto mode on every plan. What the six modes allow, and the two defaultMode values project settings ignore.
-
This week in Claude Code, Codex and Gemini CLI (week of October 18, 2026)
Claude Code now compacts idle conversations on its own, and Codex turned Daybreak back on by default. Plus the environment variables added in 2.1.299 to 2.1.302.
-
Claude Code on Windows, native or WSL, and what trips people up
Native Windows and WSL 2 compared on the point that decides it — sandboxing — plus install steps, whether you need Git for Windows, and the hooks and encoding gotchas.
-
Run Claude Code in GitHub Actions with claude-code-action
Set up the official claude-code-action so @claude in an issue or PR comment makes changes, plus the automated review workflow, who is allowed to trigger runs, and how to cap cost.
-
Auto-approve MCP tools in Claude Code permissions: the mcp__ syntax and its wildcard limits
Put mcp__server or mcp__server__tool in permissions.allow to stop the prompts, why an allow wildcard needs an mcp__<server>__ prefix, and why parenthesised mcp__ rules are skipped.
-
Getting started with Claude Code, from install to your first hour
Pick an install method by whether it auto-updates, verify with claude --version and claude doctor, then start your first session. Covers the plans required and the Windows choices.
-
/autocompact 500k and CLAUDE_CODE_AUTOCOMPACT_PCT_OVERRIDE=50: make Claude Code compact earlier, or never
/autocompact 500k sets autoCompactWindow, CLAUDE_CODE_AUTOCOMPACT_PCT_OVERRIDE=50 compacts at half the window, autoCompactEnabled: false turns it off. Defaults and precedence.
-
Get a desktop notification when Claude Code finishes, with a Stop hook
Fire a notification the moment Claude finishes responding: commands for macOS, Linux and Windows, how Stop differs from Notification, and the exit-code trap to avoid.
-
This week in Claude Code, Codex and Gemini CLI (week of October 11, 2026)
Claude Haiku 5.5 becomes the default Haiku on the API and Codex switches to GPT-6.1 Sol. Plus the permission-bypass fixes in Claude Code 2.1.289 to 2.1.296.
-
Adding MCP servers to Claude Code, claude mcp add, .mcp.json, scopes and passing tokens from the environment
claude mcp add for stdio and HTTP servers, the local / project / user scopes and which wins a name clash, .mcp.json with ${VAR} tokens, the approval prompt, checks and permissions.
-
Adding to CLAUDE.md in Claude Code, what # really does, /memory, and the @ import syntax
You typed # expecting it to append to CLAUDE.md and nothing happened. What the docs say, the three documented ways to add to CLAUDE.md, and splitting a long file with @ imports.
-
Claude Code hook input and output, the JSON on stdin and what exit codes 0, 2 and everything else do
Command hooks read JSON from stdin and answer with an exit code. The fields every event includes, the extras per event, jq examples, what exit 2 does per event, and JSON output.
-
Claude Code permissions by example, auto-allow npm scripts, confirm git push, block force push
One settings.json that lets npm run scripts go without prompts while npm install still asks, stops right before every git push, and denies git push --force in all its spellings.
-
Claude Code permissions in settings.json and settings.local.json, allow, deny and ask rules with real examples
The allow / deny / ask rules and pattern syntax, scope precedence, what settings.local.json is for and how it stays out of git, plus recommended setups for solo and team work.
-
Make a coding agent write the failing test before the implementation
The four-step test-first workflow for Claude Code, Codex and Gemini CLI, the prompts for each step, what to put in your context file, and a hook that blocks edits to test files.
-
Run Claude Code sessions in parallel with git worktrees
Start isolated parallel sessions with claude --worktree, carry .env files in with .worktreeinclude, and know which tool calls the isolation checks block.
-
Where Claude Code reads CLAUDE.md from, root, subdirectories, CLAUDE.local.md and --add-dir
Which CLAUDE.md files Claude Code loads and when: the upward search at startup, why subdirectory files load later, CLAUDE.local.md for personal notes, and loading --add-dir files.
-
Claude Code /permissions shows every rule and the settings file it came from
The /permissions dialog lists each rule with its source settings.json, edits take effect from the next tool call in the same turn, and the Auto mode and Recently denied tabs.
-
What Claude Code is, what it can do, and what it does not guarantee
What kind of tool Claude Code is, where it runs and what it can do per the official docs, which parts are instructions rather than enforcement, and how to compare it with Cursor.
-
Claude Code on Pro, Max, Team or the API, and how to choose (October 2026 pricing)
Which plans include Claude Code, the subscription and API prices as of October 5, 2026, what happens when you hit a limit, and which path fits which kind of use.
-
cleanupPeriodDays: Claude Code deletes transcripts after 30 days by default (minimum 1, 0 is rejected)
Set cleanupPeriodDays in settings.json to control how long plain-text transcripts stay under ~/.claude, what the sweep skips, and CLAUDE_CODE_SKIP_PROMPT_HISTORY=1 to stop writing.
-
This week in Claude Code, Codex and Gemini CLI (week of October 4, 2026)
Claude Sonnet 5.5 becomes the default Sonnet model. What changed in Claude Code 2.1.284 to 2.1.288, including Claude Mods and WebFetch control, plus Codex and Gemini CLI.
-
CLAUDE.md length: under 200 lines, and Claude Code warns you at startup past it
The documented target is under 200 lines per CLAUDE.md file, and you get a startup and /status warning past it. Plus the 4 MiB limit, the combined-size warning, and how to trim.
-
Managing context in Claude Code: /compact versus /clear and how to save tokens
Why long Claude Code sessions slow down, when to use /compact, /clear and /context, how automatic compaction works, and habits that keep token usage down.
-
Run lint after every edit in Claude Code: a PostToolUse hook on Edit|Write|MultiEdit
A PostToolUse hook with matcher "Edit|Write|MultiEdit" runs Prettier, ESLint or ruff after every edit. Read the path from tool_input.file_path and feed failures back to Claude.
-
Codex vs Claude Code: OS sandbox or per-tool allow/deny, config.toml or settings.json
Codex gates work with an OS-level sandbox and approval policy; Claude Code with per-tool allow/deny rules. Plus config.toml vs settings.json, AGENTS.md vs CLAUDE.md, and pricing.
-
Sign in to a remote MCP server in Claude Code: /mcp and claude mcp login
Add a remote server with claude mcp add --transport http, then sign in from /mcp or with claude mcp login. Covers fixed callback ports, pre-registered client IDs and re-auth.
-
This week in Claude Code, Codex and Gemini CLI (week of September 27, 2026)
Claude Opus 5.5 is the new default Opus model. What changed in Claude Code 2.1.278 to 2.1.283, Codex 0.156.1 and 0.157.0, and Gemini CLI 0.61.0.
-
Claude Code kills Bash commands at 2 minutes: raise it with BASH_DEFAULT_TIMEOUT_MS
The default timeout is 120000 ms (2 minutes), the ceiling the model can set is 600000 (10 minutes), and output cuts at 30,000 characters. How to raise each, and where to set them.
-
Disable the Co-Authored-By trailer in Claude Code with the attribution setting
Set attribution.commit in settings.json to hide or rewrite the commit trailer. Also covers attribution.pr for PR descriptions, sessionUrl, and the deprecated includeCoAuthoredBy.
-
autoMemoryEnabled: false turns off Claude Code auto memory; autoMemoryDirectory moves it
Disable auto memory with autoMemoryEnabled: false, for one session with CLAUDE_CODE_DISABLE_AUTO_MEMORY=1, or move it with autoMemoryDirectory. What it records, the 200-line cap.
-
Block rm -rf with a Claude Code PreToolUse hook, and know its limits
Two ways to deny a dangerous rm before it runs: exit code 2 and permissionDecision. Why a hook deny works even in bypassPermissions, and where string matching stops being enough.
-
claude -p: run Claude Code non-interactively in scripts and CI (--output-format json, --allowedTools)
Use claude -p "prompt" for non-interactive mode: pipe stdin, get JSON with --output-format json, pre-approve tools with --allowedTools, cap cost with --max-turns. Works in cron/CI.
-
Claude Code in VS Code: install the extension, sign in with Pro/Max or an API key, and 5 settings to check
Install the Claude Code extension, sign in with a Claude Pro/Max plan or an Anthropic API key (the free plan is not enough), how it relates to the CLI, and five settings to change.
-
claudeMdExcludes: ["**/monorepo/CLAUDE.md"] stops Claude Code loading other teams' CLAUDE.md
Add claudeMdExcludes to settings.json with absolute-path globs to skip specific CLAUDE.md and .claude/rules files. Which file to use, what cannot be excluded, how to verify.
-
This week in Claude Code, Codex and Gemini CLI (week of September 20, 2026)
Claude Code now reads AGENTS.md directly. What changed across 2.1.270 to 2.1.277, Codex 0.155.0 and 0.155.1, Gemini CLI 0.60.0, and the deny-rule fix that got reverted.
-
When bypassPermissions is safe to use in Claude Code, and when it isn't
What --dangerously-skip-permissions actually turns off, what still stops it, the isolation conditions the docs require, and the alternatives worth trying before you reach for it.
-
Every value you can put in a Claude Code hook matcher, by event
What a hook matcher compares against depends on the event. The exact-match, regex and wildcard rules, the events that silently ignore a matcher, and how to target MCP tools.
-
This week in Claude Code, Codex and Gemini CLI (week of September 13, 2026)
Claude Code 2.1.268 and 2.1.269, Codex CLI 0.154.0 and Gemini CLI 0.59.0: deny-rule bypasses fixed, secrets leaking from MCP config output, and one breaking change in Codex.
-
Gemini CLI vs Claude Code: free tier, context, configuration and permissions
Gemini CLI and Claude Code compared on the parts that change slowly: the free tier, context handling, context files, permission control, extensibility and licensing.
-
Log which CLAUDE.md files Claude Code loads, and when, with the InstructionsLoaded hook
Use the InstructionsLoaded hook to record every CLAUDE.md and .claude/rules/ file as it enters context: matcher values, input JSON fields, a logging example, and its limits.
-
Pin environment variables in Claude Code's settings.json with the env key: precedence and pitfalls
How the env key in Claude Code's settings.json works: it overrides shell variables, applies to every session and subprocess, and when a saved change reaches a running session.
-
Scope Claude Code rules to specific files with .claude/rules/ and paths frontmatter
When CLAUDE.md gets long, move topics into .claude/rules/ and add paths frontmatter so a rule loads only when Claude touches matching files: glob syntax, timing, user-level rules.
-
What Claude Code's /init puts in CLAUDE.md, and what to change afterwards
What the /init command inspects and writes into CLAUDE.md, how it behaves when a file already exists, what to cut and add after generation, and how to confirm the file loads.
-
How to write CLAUDE.md: the three levels (user, project, directory) and a ready-to-use template
Where Claude Code looks for CLAUDE.md, which level wins, what belongs in it and what does not, plus a template you can drop into a small or medium web project today.
-
Stop AI coding tools from reading your API keys and secrets: settings for Claude Code, Codex and Gemini CLI
Settings that keep .env files and credentials away from Claude Code, Codex and Gemini CLI, what to do after a leak, and how to keep secrets out of the repository altogether.
-
Allow Claude Code's WebFetch for specific domains only
How WebFetch(domain:...) rules match, what each wildcard position covers, why a bare WebFetch rule differs from domain:*, and why a redirect target needs its own permission.
-
Claude Code cost and usage: /cost, /usage, rate limits and what actually saves money
How Claude Code billing works on a subscription versus API usage, checking consumption with /cost and /usage, how the rate limits behave, and the habits that cut token spend.
-
Claude Code subagents: writing .claude/agents files and when they pay off
Defining Claude Code subagents: the Markdown file in .claude/agents, the tools and model fields, how description drives delegation, and examples for research, review and tests.
-
Create your own slash commands in Claude Code with a single Markdown file
Define /review or /commit as a skill in .claude/skills/, how that differs from .claude/commands/, passing arguments with $ARGUMENTS and $1, and embedding Bash output in the prompt.
-
Is your code used to train Anthropic's models? Claude Code data usage by plan
Whether Claude Code uses your code for model training depends on your plan and settings. How personal and commercial plans differ, and what to check before using it at work.