Claude Code Workbench — Agentic Developer Tooling Framework

Problem

Most setups land on one of two defaults. Either everything is approved automatically, or every action prompts you. The second one sounds safer but trains you to click approve without reading, so the prompt that actually mattered gets waved through with the rest. The useful question is which actions are genuinely hard to undo, because those are the only ones worth interrupting for.

Approach

• Picked two actions worth stopping for, both hard to undo. A secret leaving a file, and code leaving the machine. Everything reversible runs without prompting.
• Matched the severity to the risk. Reading .env files, private keys, and credentials is a hard deny, since a secret in the context window can end up in a log or a summary. Git commit and push return ask, so there's a pause but I still make the call.
• Wrote every hook to fail open on bad input, so a broken guardrail can't wedge a session.
• Routed subagents by where the model choice changes the answer. Opus for RAG and LLM security review, Sonnet as the default, Haiku for the two agents that mostly parse and format.
• Built a checkpoint system around a gap in the platform. Plan-quota usage isn't exposed to any hook, so a PreCompact trigger handles context pressure and a manual command covers the quota case. The PROGRESS.md it writes keeps the dead ends that were already ruled out.
• Shipped a symlink-based installer that won't silently overwrite, with --dry-run and a required --force to replace anything already there.
• Added CI that checks frontmatter, allowed model and effort values, hook compilation, and that settings.json only points at hooks that exist.
• Ran a cross-platform pass before release that turned up 8 real bugs, including Windows path handling, CRLF and WSL issues, and a PATH resolution failure that made hooks silently never fire.
• Wrote up the known limitations, including a Windows symlink fallback that quietly turns into a plain copy.
• Included transcripts of each guardrail and agent actually running.

Outcome

A public, MIT-licensed framework that I install on my own machine and that doubles as a worked example. The decisions were the hard part. Which risks get a deny versus an ask, how to keep a guardrail from becoming the outage, and where the platform's own limits stop the design from going further.