Shane HO

Solo maker coding with AI agents. Ships OSS guardrails for Claude Code power users. Public post-mortems on every failure. 🇹🇼

[Shane HO @docat0209]

the trick to making Claude Code follow your CLAUDE.md isn't a better CLAUDE.md.

it's a PreToolUse hook that exits non-zero when Claude tries to skip a step.

I open-sourced 26 SOPs and 3 hooks worth of this:
https://t.co/40MxtldbWK

[Shane HO @docat0209]

@kokiaioutput the real question isn't whether they're paying. it's whether they can see what each dollar buys. most Claude Code users have zero visibility into token spend per task. they discover the bill after it's spent.

[Shane HO @docat0209]

@______mugen handing your password to an AI agent and watching it fix everything in 1 minute is magical until the next prompt makes it do something you didn't expect with that same access. PreToolUse hooks exist for exactly this.

[Shane HO @docat0209]

@nrityu_Nova8 that 4% is the repo context ingestion. Claude reads your entire codebase every session start. 40-50k tokens before doing any real work. parallel sessions multiply this.

[Shane HO @docat0209]

@kote2 the non-engineer angle is interesting but the risk is they skip guardrails because they don't know they need them. Claude is helpful enough to be dangerous without constraints.

[Shane HO @docat0209]

@m13v_ @RoundtableSpace desktop automation via accessibility APIs is exciting but the trust model is terrifying. if Claude can click any button on your desktop, you need guardrails before it clicks 'delete account' or 'send all' in your email client.

[Shane HO @docat0209]

@koharishant skills are the right approach but enforcement is the gap. without a hook that blocks the next tool call until the skill runs, Claude can 'acknowledge' the skill and ignore it in the same turn. I've seen it happen 4 times in one session.

[Shane HO @docat0209]

@vendeesign sounds like we're building the same idea independently. mine uses 3 layers: permanent principles, on-demand skills, deterministic hooks outside the LLM. curious what your verification step looks like - model-side or hook-based?

[Shane HO @docat0209]

3 layers of Claude Code customization:

awesome-claude-code: curated lists
claude-code-hooks: copy-paste scripts
SoloForge: enforced SOPs + deterministic hooks

most people stop at layer 1. the compound effect is in layer 3.
https://t.co/40MxtldbWK

[Shane HO @docat0209]

@web3_alina giving Claude Code your email credentials.json is exactly the kind of thing a PreToolUse hook should catch. one bad prompt and it reads every email in your inbox looking for 'context'.

[Shane HO @docat0209]

@mikuta0407 parallel sessions burn 2x the tokens but the hidden cost is worse: each session re-ingests the entire repo context independently. 40-50k tokens wasted per session just 'figuring out' the codebase.

[Shane HO @docat0209]

@brandonbango @Shpigford adversarial reviews of PRs is underrated. I do the same thing, spawn a sub-agent that tries to break the PR before merging. catches things the main agent rationalizes away every time.

[Shane HO @docat0209]

@p3nchan 同感。問題可能不是 Claude 忘記，是 context window 裝不下所有工具描述。我後來改成 on-demand loading — skill 只在觸發時才載入，不常駐 context。省 token 也減少幻覺。

[Shane HO @docat0209]

SoloForge blocks 14 destructive patterns before Claude Code can run them. a few:

git push --force
git reset --hard
git checkout .
rm -rf /
--no-verify

each one is a real incident. 50 lines of bash.
https://t.co/HXYxQgGxmP

[Shane HO @docat0209]

@DRMacIver interested to see your take on context window management. that's where the biggest hidden cost lives. I've measured 40-50k tokens just on Claude 'figuring out' a repo before doing any real work.

[Shane HO @docat0209]

@MichaelAluya3 @garrytan persistent context via MCP is the right direction but I've found file-based memory (markdown, git-tracked) outlasts any hosted service. when the MCP server dies your memory dies with it.

[Shane HO @docat0209]

@shubhamknitt @AlfieJCarter the permission bar is real, but it lowered the consequence bar too. Claude feels confident enough to force-push to main at 2am. without structural guardrails, more permission = more damage.

[Shane HO @docat0209]

every time Claude rationalizes a skipped step, a SoloForge hook writes a principle to principles.md.

example: "verify target API exists before building on it". written after I burned a day on a platform with no API.

https://t.co/40MxtldbWK

[Shane HO @docat0209]

before any irreversible decision in Claude Code, I spawn a Devil's Advocate sub-agent to argue the opposite with evidence.

it killed 5 of my SaaS ideas in one afternoon. every one had a fatal flaw my main thread missed.

open source: https://t.co/40MxtldbWK

[Shane HO @docat0209]

@keter_slater Claude skipped my test-gate 4 times citing 'pre-existing issue'. since the hook landed, zero skips. friction is one line: `exit 2`. cheaper than any doc.

[Shane HO @docat0209]

the trick to making Claude Code follow your CLAUDE.md isn't a better CLAUDE.md.

it's a PreToolUse hook that exits non-zero when Claude tries to skip a step.

I open-sourced 26 SOPs and 3 hooks worth of this:
https://t.co/40MxtldbWK