Hstack

hstack


Thirty-one Claude Code hooks that refuse the agent, and the incident behind each one.

git clone https://github.com/howardchan2008/hstack && cd hstack
./install.sh          # copies the hooks, merges settings.json, backs it up first
./doctor.sh           # tells you which guards are actually armed
bash tests/run.sh     # proves each one still refuses what it exists to refuse

Why this exists

Most Claude Code configurations are about making the agent do more: more agents, more skills, more roles. That is the interesting half and it is well covered.

This is the other half. Every file here exists because an agent did something it should not have, and the fix that worked was a hook that refuses, rather than a line of prose asking it to be careful. Prose in a rules file is advice. A PreToolUse hook is a wall.

The bar for shipping anything here: **it has refused something real.**

The three failures these are built around

**The agent is confident and wrong at the same time.** It reports a merge as deployed, a guard as armed, a directory as empty. Each of those was a real sentence in a real session, and each was false in a way that looked exactly like true. `state-verify-inject.sh` demands a live check before any claim about what a system currently is. `wiring-verify.sh` checks the guards are armed rather than present.

**Cost is invisible at the call site.** Every tool call re-sends the whole conversation, so the bill is calls times context and neither number shows up where the decision is made. One measured window: 3.62 billion cached input tokens read back against roughly 13 million tokens of content actually produced. `probe-dedupe.sh`, `burn-context.sh`, `lane-guard.sh` and `websearch-cache.sh` all attack that from different sides.

**Work vanishes between turns.** A three-part prompt gets its first part answered. An interrupt is treated as a cancel. A session ends with a dirt