Study: Claude Code hooks block protected file edits better than CLAUDE.md rules

·69 views

Researchers ran 29 headless sessions using Claude Code v2.1.273 to compare two methods of preventing edits to a protected directory: a plain-language rule in CLAUDE.md and a PreToolUse shell hook. Both methods successfully blocked edits in normal conditions, but when users explicitly claimed authorization in the prompt, the CLAUDE.md rule was overridden in both test runs while the hook held firm in both. The CLAUDE.md approach added 58–70 input tokens to every request, whereas the hook incurred no token cost unless triggered, though it did introduce an extra model round trip on direct requests. Claude Code's own documentation notes that CLAUDE.md content is treated as context rather than enforced configuration, and that PreToolUse hooks are the correct mechanism for reliably blocking actions. The experiment provides concrete measurements backing that distinction, showing hooks are more tamper-resistant against user-supplied authorization claims.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Runway releases open-weight Praxis-1 robot model topping RoboLab-120 benchmark at 46.2%

Runway released Praxis-1 on November 11, 2026, a 27-billion-parameter world action model with open weights under Apache 2.0 that permits commercial use. The model reached 46.2% success on NVIDIA's RoboLab-120 leaderboard, placing it ahead of several competing systems. It jointly predicts future video and robot actions, returning 24 action steps in about 0.55 seconds on a single H100 GPU. Three checkpoints are available on Hugging Face, including a DROID fine-tune for single-arm tabletop tasks and a bimanual YAM variant. The article's author notes that these results come from Runway's own reporting and have not yet been independently reproduced.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Two Forgotten Smart Plugs Prompt a Home Automation Project Built With AI Agents

The author found two old Oakter smart plugs in storage and discovered that their dependence on a discontinued service made them effectively unusable. That prompted an investigation into whether the devices could be revived and, ultimately, a broader effort to build Pebble Home, a home automation platform. The author, who had roughly 80 smart devices from several vendors and multiple radio protocols, used AI coding agents to analyse protocols, debug integrations and build interfaces. The project has reshaped the author's views on how much control people truly have over the software behind their devices. The account is presented as a work in progress.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shared household notes beat perfect memory, builders of TaskFamily find

A household task app called TaskFamily was built on the observation that families usually forget things because each detail belongs to a single person. The developers consolidated tasks, schedules and errands into one visible place, and they kept entries short so they could be written quickly and stay current. Finished items were cleared so the list remained easy to scan and trustworthy, and stale duplicate copies in other channels were eliminated to avoid contradictions. Notifications were limited to time-sensitive items after frequent alerts led people to ignore them. The authors acknowledge that the tool cannot by itself make households adopt the habit of recording information.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Label Created Is Not a Carrier Scan: Why Tracking States Should Stay Separate

A common mistake in carrier tracking systems is treating the first status a carrier returns as proof the parcel is in its hands, when that row often only means a shipping label or pre-advice was created. Such a record reflects that the carrier expects the parcel while it still sits with the shipper. Lumping this pre-scan state into an in-transit bucket distorts transit-time metrics, blurs which party owns a stuck-parcel alert, and produces customer messaging that can be contradicted. The proposed fix is to track a normalised status alongside a boolean for whether the carrier has scanned the parcel and the timestamp of that first scan. Transit time should then be measured from the first carrier scan, and matching should key on the meaning of status wording rather than on carrier-specific rules.

0 comments Read more at DEV Community