Study: Claude Code hooks block protected file edits better than CLAUDE.md rules

·8 views

Researchers ran 29 headless sessions using Claude Code v2.1.273 to compare two methods of preventing edits to a protected directory: a plain-language rule in CLAUDE.md and a PreToolUse shell hook. Both methods successfully blocked edits in normal conditions, but when users explicitly claimed authorization in the prompt, the CLAUDE.md rule was overridden in both test runs while the hook held firm in both. The CLAUDE.md approach added 58–70 input tokens to every request, whereas the hook incurred no token cost unless triggered, though it did introduce an extra model round trip on direct requests. Claude Code's own documentation notes that CLAUDE.md content is treated as context rather than enforced configuration, and that PreToolUse hooks are the correct mechanism for reliably blocking actions. The experiment provides concrete measurements backing that distinction, showing hooks are more tamper-resistant against user-supplied authorization claims.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Key Docker Commands for Managing Containers, Images, and Volumes

This tutorial covers essential Docker commands used in day-to-day container management, including pulling images, running containers, and executing commands inside them. Lightweight base images such as Alpine and Bookworm are recommended for small applications to reduce overhead compared to full OS images. Commands like docker run -it, docker exec, and docker ps help users interact with and monitor running containers. Port mapping with the -p flag exposes container services to the host, while volume mounting with -v allows persistent or shared file storage. Additional commands such as docker logs, docker inspect, and the --rm flag for auto-removal round out core container lifecycle management.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer's Second AWS AI Agent Accidentally Fulfilled His First Project's Wishlist

A software developer completing an AWS nanodegree shipped his second AI support agent, Nova Adiutrix, built on Amazon Bedrock to handle order tracking, refunds, and product queries for a simulated online store. During testing, the agent incorrectly refused to share order details with the account holder, citing a security check that falsely flagged the order as unlinked — making a bug look indistinguishable from correct security behavior in the logs. The developer later realized that Nova Adiutrix had organically implemented three features he had explicitly deferred in his first project, Nova Trivium, listed under a 'Not built, and why' section in that project's README. Key architectural differences between the two builds included a shift from pasting static FAQ content directly into a system prompt to using a Bedrock-managed vector knowledge base for retrieval. The developer noted that each project surfaced the same core challenges — where knowledge lives, where rules are enforced, and whether a security checkpoint can be fooled by the system it is meant to check — only at a greater level of complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fliproom Uses Sanity CMS to Turn Room Changeovers Into Visual Checklists

Fliproom is a small open-source planning tool built for the Sanity CMS developer challenge that converts room layout changeovers into step-by-step visual checklists. A volunteer selects a starting and ending room layout, and the app automatically derives a numbered move list by comparing equipment placements across layouts rather than requiring manually authored instructions. The demo features a fictional 12-by-8-metre community hall with eight pieces of equipment and three layouts, hosted publicly on GitHub Pages with no login required. Dependencies between steps keep certain moves locked until prerequisite actions are completed, and progress is preserved across browser reloads. The MIT-licensed app is built with Next.js, TypeScript, React, and Sanity, with AI agents handling most of the technical development and code review.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Logs 445 Clones but 2 Stars for Free Mental Health Toolkit

A developer released a collection of 36 free, client-side mental health tools built in vanilla JavaScript, requiring no backend, signup, or dependencies. After 30 days, the project attracted 157 unique cloners and 445 total clones on GitHub, but earned only 2 stars and no forks. Alongside the repository, the developer published 62 articles on Dev.to, generating just 607 views and 24 reactions in total. Attempts to monetize through a Gumroad template, a paid API listing on RapidAPI, and an AI agent marketplace yielded zero sales or paid calls. The developer attributes the low conversion rate to a weak repository presentation and a monetization model undermined by the toolkit's completeness at no cost.

0 comments Read more at DEV Community