Section 11: Lab: Hooks for Automatic Quality Control
Key hook events: PreToolUse, PostToolUse, UserPromptSubmit and Stop
Run formatters, linters and tests automatically after file edits
Block dangerous commands with exit code 2 or a JSON decision, and make a failing hook block
Check and test hooks through the /hooks menu before relying on them
Lab: a hook that formats files after edits and protects .env files
Section 12: Security, Permissions and Governance
Allow, ask and deny permission rules for commands and files through /permissions
Protecting secrets and .env files, and the risks of prompt injection
The sandbox that limits file and network access for shell commands on macOS, Linux and WSL2
Managed settings for organisations, and /security-review for a first vulnerability check of a branch
Section 13: Plugins and Sharing Team Standards
Plugins: bundling skills, subagents, hooks and MCP servers into one unit
Install plugins from a marketplace with /plugin and create a team marketplace
Share .claude/ and CLAUDE.md through Git so the whole team works to one standard
Lab: package the commands, skills and subagents you built into a team plugin
Section 14: Headless Mode and CI/CD Integration
Run non-interactively with claude -p and text, json or stream-json output
Claude Code GitHub Actions for reviewing pull requests and responding to @claude in issues
Automated code review with /code-review and setting the scope of review findings
Controlling permissions, allowed tools and secrets in the pipeline
Section 15: Costs and Team Best Practices
Track usage with /usage and the status line
Reduce cost: choose the model and effort for the task, manage context and use subagents
Team agreements: which work AI does and which work people must review
Measure AI use in a development team sensibly and keep improving the setup
Section 16: Master Workshop: From Issue to Pull Request
Install hooks and permission rules for the NovaDesk project
Set up GitHub Actions so Claude Code reviews pull requests automatically
Take the "SLA and notifications" issue, then plan, build and test it
Deliver a pull request that passes automated review and is ready to merge
Present the result and wrap up with a checklist for applying the workflow to your own projects