Heavy User Configs & Real-World Patterns

Pillar: heavy-user-configs | Date: April 2026
Scope: Named power users' actual dotfiles, settings.json, CLAUDE.md files, slash commands, and hooks as used in Q1-Q2 2026 — not blog posts but live config repos. Covers: Steve Yegge, Geoffrey Huntley, Harper Reed, Simon Willison, Mitchell Hashimoto, Anthropic eng team, Aider/Cursor/Goose communities, Claude Code Discord. Documents how many parallel sessions each runs, their worktree strategy, which hooks live in settings.json, which slash commands earn rent, and how they handle memory/continuity.
Sources: 32 gathered, consolidated, synthesized.

Table of Contents

1. Named Power User Profiles
2. CLAUDE.md Structure & Best Practices
3. settings.json Configuration Reference
4. Hook System: Events, Types & Implementations
5. Slash Commands & Skill Systems
6. Parallel Sessions & Multi-Agent Orchestration
7. Memory & Continuity Systems
8. Status Lines & Context Window Management
9. Security Configurations & Sandboxing
10. Community Resources & Repository Index

Section 1: Named Power User Profiles

A cluster of prominent engineers have published detailed workflows, dotfiles, and architecture documentation for their Claude Code setups as of Q1–Q2 2026. Parallel session counts range from 1–2 focused agents (Hashimoto) to 20–30 orchestrated workers (Yegge), with the Anthropic creator himself running 10–15 simultaneous sessions as the practical middle ground.^[32][5][23]

Parallel Session Counts by Named User

Steve Yegge — Gas Town Orchestrator

Yegge (40+ years engineering, ex-Amazon, ex-Google) uses Claude Code 14 hours per day and claims 12,000 lines of code per day as of January 2026.^[5] His Gas Town orchestrator launched January 2026 — originally Python, rewritten in Go because "models waste fewer tokens on it compared to TypeScript."^[30]

Key finding: Yegge's Gas Town operates with 7 distinct worker roles including "Deacon and Dogs," "Refinery," and "handoff loops/seances" — entirely vibe-coded: "100% vibe coded. I've never seen the code, and I never care to."^[30]

Gas Town Architecture Components

Gas Town distributes across machines rather than vertical scaling. Yegge identifies a critical infrastructure gap: "Agents have almost no platform APIs" — necessitating custom hacks for factory-style orchestration.^[5] His "Desire Paths" methodology: observe what agents attempt → implement those capabilities → iterate until agent-native.

Mitchell Hashimoto — Harness Engineering

Hashimoto's most distinctive contribution is systematic error prevention: when an agent makes a mistake, build a validation script/linting rule and add it to AGENTS.md. "Each line in AGENTS.md represents a past agent failure now prevented."^[23] He estimates agents run 10–20% of his working day in the background.^[23]

Hashimoto Quality Standard by Project Type

Notifications are disabled to prevent context-switching costs; Hashimoto manually checks progress during natural breaks.^[15] Before every transition (leaving the house, end of day): spends 30 minutes asking "What's a slow thing my agent could do next?"^[15]

Boris Cherny — Claude Code Creator (Anthropic)

Cherny shared his workflow publicly in January 2026. Three core CLAUDE.md principles: (1) Simplicity First — minimal changes, (2) No Laziness — find root causes, (3) Minimal Impact — only touch what's necessary.^[32]

Key finding: "Almost all best practices boil down to one thing: Context Window management." — Boris Cherny^[32]

Cherny's self-improvement loop: "Anytime we see Claude do something incorrectly, we add it to CLAUDE.md so it doesn't repeat next time."^[32] Aggressive prompting style: "Grill me on these changes and don't make a PR until I pass your test," "Prove to me this works," single-word prompts like "Fix" when sharing bug reports.^[32]

On verification: "Probably the most important thing to get great results out of Claude Code — give Claude a way to verify its work. If Claude has that feedback loop, it will 2–3× the quality."^[31]

Additional Power User Profiles

Section 2: CLAUDE.md Structure & Best Practices

Multiple independent sources converge on ~100 lines / ~2,500 tokens as optimal CLAUDE.md size.^[28][32] Anthropic's official guidance: "For each line, ask: 'Would removing this cause Claude to make mistakes?' If not, cut it. Bloated CLAUDE.md files cause Claude to ignore your actual instructions."^[18]

Key finding: Haberlah's global file sits at just 48 lines — his principle: detailed procedural knowledge belongs in skills (loaded on demand), not in CLAUDE.md (loaded every session).^[6]

CLAUDE.md Include vs. Exclude Decision Matrix

Sources: ^[28][18][32]

CLAUDE.md Placement Hierarchy

Note: raw_3.md and raw_18.md differ slightly on exact priority ordering for project vs. global; both agree global applies to all sessions.^[3][18]

Import Syntax

CLAUDE.md supports inline references to pull in additional context files without bloating the main file:^[18]

See @README.md for project overview and @package.json for available npm commands.
# Additional Instructions
- Git workflow: @docs/git-instructions.md
- Personal overrides: @~/.claude/my-project-instructions.md

Named User CLAUDE.md Patterns Compared

Section 3: settings.json Configuration Reference

The mculp community reference (v2.1.104, April 13, 2026) documents 125+ configuration keys across authentication, model selection, permissions, filesystem sandbox, MCP servers, hooks, memory/context, enterprise/org settings, UI/display, and network/proxy.^[10][21]

Configuration Scope Hierarchy

Source: ^[6][13]. Shell-level env var exports take precedence over settings.json values (e.g., export CLAUDE_CODE_MAX_OUTPUT_TOKENS=32000).^[6]

High-Impact Core Parameters (Power User Consensus)

Environment Variables Block (Power User Consensus)

Model Identifiers as of April 2026

Source: ^[17][31]

Permission Model Structure

Evaluation order: deny → ask → allow. First match wins.^[6][13]

Standard Deny Block (Power User Consensus)

"deny": [
  "Read(**/.env*)", "Read(**/secrets/**)", "Read(**/*.pem)", "Read(**/*.key)",
  "Read(~/.ssh/**)", "Read(~/.aws/**)", "Read(~/.gnupg/**)", "Read(~/.azure/**)",
  "Read(~/.kube/**)", "Read(~/.npmrc)", "Read(~/.pypirc)", "Read(~/.git-credentials)"
]

Source: ^[4][6][14]

Standard Ask Block (Destructive Operations)

"ask": [
  "Bash(rm -rf *)", "Bash(git push --force *)", "Bash(git reset --hard *)",
  "Bash(sudo rm *)", "Bash(chmod 777 *)"
]

Permission Rule Syntax Examples

Source: ^[17][21]

Section 4: Hook System — Events, Types & Implementations

The hook system enables deterministic control over Claude's probabilistic behavior. As Lukasz Fryc states: "Hooks give you deterministic control over a probabilistic system."^[8]

Hook Event Count (Source Discrepancy)

Different sources report different counts reflecting version differences: disler reports 13,^[9] Fryc reports 12,^[8] Haberlah documents 14 lifecycle points including TeammateIdle and TaskCompleted,^[6] and TechBytes (April 2026) adds CwdChanged, FileChanged, and PostCompact as newer additions.^[17]

Complete Hook Event Reference

Hook Types

Exit Code Semantics

Consistent across: ^{[2][8][9][14][17]}

High-Value Hook Implementations (Production Examples)

Universal: Block rm -rf (PreToolUse)

Present in nearly every power user config:^[4][8][17]

CMD=$(jq -r ".tool_input.command" <<< "$(cat)")
echo "$CMD" | grep -qiE "rm -rf" && echo "Blocked" >&2 && exit 2

Auto-format After Edits (PostToolUse — disler, Fryc)

{ "matcher": "Write|Edit", "hooks": [{ "type": "command",
  "command": "npx prettier --write \"$CLAUDETOOLINPUTFILEPATH\"" }] }

Source: ^[8][17]

Auto-commit on Stop (Haberlah)

Stages changes, commits with auto: <changed-files> message, scans dotfiles for secrets before pushing, outputs pull command via stderr.^[6][13]

Anti-rationalization Gate (Stop hook, Trail of Bits)

{ "type": "prompt",
  "prompt": "Review if assistant is rationalizing incomplete work...
             Respond with JSON: {\"ok\": false, \"reason\": \"...\"} or {\"ok\": true}" }

Source: ^[14]

Code Quality Enforcement (PostToolUse — disler)

Triggers on Python file writes; blocks (exit 2) on Ruff linting errors and Ty type errors.^[2][20]

Skill Auto-suggestion via Prompt Analysis (UserPromptSubmit — ChrisWiles)

Analyzes prompts via keyword/pattern/file-path/intent scoring, auto-suggests relevant skills.^[3][22]

TTS Integration (Stop/Notification hooks — disler)

Provider priority: ElevenLabs → OpenAI → pyttsx3 → random fallback.^[2][20]

Audit Log All Bash Commands (PostToolUse)

jq -r ".tool_input.command" | while read cmd; do
  echo "$(date) $cmd" >> .claude/command-audit.log; done

Source: ^[8]

Critical Implementation Patterns

Hook vs. CLAUDE.md vs. Skills Decision Framework

Source: Botmonster^[28]

Key finding: CLAUDE.md and skills achieve ~80% compliance through instruction; hooks achieve 100% compliance through mechanical enforcement. Only hooks can guarantee a behavior across all sessions regardless of context window pressure.^[28]

Section 5: Slash Commands & Skill Systems

Slash Command Format and Storage

Commands stored as .claude/commands/{name}.md with frontmatter fields:^[3]

---
description: Brief description shown in command list
allowed-tools: Bash(git:*), Read, Grep
---

Available variables: $ARGUMENTS, $1, $2, $3 (positional); inline bash: !`git branch --show-current` embeds output at runtime.^[3][28]

High-Usage Slash Commands by Source

New 2026 Built-In Commands

Source: ^[17][29]

Skill System Architecture

Skills implement progressive disclosure: loading only names/descriptions at startup (~100 tokens per skill), full instructions on demand. Haberlah calculates 22 skills at rest ≈ ~2,200 tokens total ≈ 1% of a 200k context window.^[6]

Skill Frontmatter Reference

---
name: lowercase-letters-numbers-hyphens    # 64 chars max
description: When to use — determines auto-activation  # 1024 chars max
allowed-tools: Read, Grep, Glob
model: claude-sonnet-4-20250514
disable-model-invocation: true   # Manual-only activation
context: fork                    # Executes as subagent with isolated context
---

Source: ^[6][13]

Trail of Bits Recommended Skills

Trail of Bits (professional security research firm) documents a curated set of production-hardened skills for their Claude Code config:^[4][14]

Trail of Bits also recommends skills from the obra/superpowers collection: brainstorm (divergent ideation before implementation) and systematic-debugging (structured debugging workflows). These are notable as production-hardened configurations from a professional security firm rather than individual developer setups.^[4][14]

Power User Skill Counts

Skill Priority Order

Project skills > Personal skills > Plugin skills.^[6][13] Dynamic runtime injection via !`command` syntax: e.g., !`gh pr diff` embeds actual diff content at invocation time.^[28]

MCP Server Best Practices

Every connected MCP server adds tool definitions to context permanently, even when idle. Tool Search mitigates by loading up to 10% of context window, deferring remaining tools.^[6][13] Default max per tool response: 25,000 tokens, configurable via MAX_MCP_OUTPUT_TOKENS.^[6]

Key finding: Haberlah's consensus rule: "Prefer CLI tools over MCP servers when both accomplish the same task. CLI tools carry no standing overhead."^[6]

Notable MCP Server Deployments by User

Section 6: Parallel Sessions & Multi-Agent Orchestration

Three Main Parallelization Approaches

Worktree Setup Details

• Add .claude/worktrees/ to .gitignore^[28]
• Create .worktreeinclude for auto-copying .env and secrets^[28]
• Claimed: 18% throughput improvement over sequential work^[28]
• Supports 10–15+ simultaneous sessions^[28]
• Delegate mode (Shift+Tab): restricts lead agent to spawning teammates only; loses Edit/Write/Bash access^[6]

Orchestration Patterns (Anthropic Official)

Writer / Reviewer Pattern

Session A implements; Session B reviews with fresh context — "A fresh context improves code review since Claude won't be biased toward code it just wrote."^[18][28]

Fan-Out for Large Migrations

for file in $(cat files.txt); do
  claude -p "Migrate $file from React to Vue. Return OK or FAIL." \
    --allowedTools "Edit,Bash(git commit *)"
done

Source: ^[18]

Non-Interactive / CI Mode

# One-off with output format
claude -p "List all API endpoints" --output-format json

# Auto mode (uninterrupted)
claude --permission-mode auto -p "fix all lint errors"

# Budget-capped
claude -p --max-budget-usd 2.50 "Refactor API layer"

# Limit turns
claude -p --max-turns 5 "Run tests and fix failures"

Source: ^[17][18]

Subagent vs. Agent Teams vs. Parallel Sessions Comparison

Source: ^[6][13]

Key finding: Agent Teams consume ~7× the tokens of standard sessions — Haberlah's guidance: use only for genuinely parallel work with non-overlapping file boundaries. For most parallelism, git worktrees with independent sessions are faster and cheaper.^[6]

Section 7: Memory & Continuity Systems

Beads: Steve Yegge's Git-Backed Issue Tracker

Built by Yegge in approximately 6 days using Claude. Repository reached 1,000 GitHub stars in the first 6 days of release, growing to 17.9K stars as of the research date (April 2026).^[19][30] Beads inspired Claude Code Tasks.^[30]

Beads Architecture

Beads Core CLI Commands

Source: ^[19][30]

Beads "Land the Plane" Protocol (Session-Ending Procedure)

1. Run quality gates (lint, test, type-check)
2. File discovered work as new Beads issues
3. Close finished issues with reasons
4. Run bd sync and push to git
5. Generate handoff prompt for next session

Case study: developer refactored 315 frontend files in a 12-hour session using compaction cycles. Agent correctness rate: approximately 80%.^[19][30]

Beads vs. Claude Code Tasks

Source: ^[30]

Known Beads Limitations

• Agents don't proactively query Beads without explicit CLAUDE.md instructions^[30]
• Instructions lose weight as context grows during long sessions^[30]
• Manual triggers needed for session handoffs^[30]
• 29 contributors building extensions (VS Code, Emacs, Neovim, web dashboards) as of research date^[30]

Memory Hierarchy in Production

Source: ^[30]

Boris Cherny's 6-Step Task Management in CLAUDE.md

1. Plan to tasks/todo.md
2. Verify plans before execution
3. Track progress continuously
4. Explain changes at each step
5. Document results in todo.md
6. Capture lessons in lessons.md after corrections

Source: ^[32]

Context Management Commands

Source: ^[18][29]

Anti-pattern: /compact introduces lossy compression. Trail of Bits prefers /clear between tasks; "Summarize from here" for surgical space reclamation without full compaction.^[4][14]

Section 8: Status Lines & Context Window Management

Custom Status Line Implementations by User

Context Threshold Discrepancy Across Users

Status Line Configuration in settings.json

{
  "statusLine": {
    "type": "command",
    "command": "uv run $CLAUDE_PROJECT_DIR/.claude/status_lines/status_line_v3.py"
  }
}

Source: ^[2][20]

Context Window Management Strategies (Consensus)

Key finding: Haberlah's optimization math: 64k output tokens leaves ~136k input budget after system prompts and MCP definitions in a 200k window. The 1M context window (Opus 4.6 API beta) carries higher per-token cost and "is not always better."^[6]

Botmonster Metrics Tracked for Optimization

• Context usage per session^[28]
• Corrections per task^[28]
• Hook failure rates^[28]
• Orphaned worktree ratios^[28]

Section 9: Security Configurations & Sandboxing

Three-Layer Security Architecture (Haberlah)

Source: ^[6][13]

Trail of Bits Extended File Blocking

Additional paths blocked beyond the standard deny block:^[4][14]

• SSH/GPG: ~/.ssh/**, ~/.gnupg/**
• Cloud: ~/.aws/**, ~/.azure/**, ~/.kube/**
• Package registry: ~/.npmrc, ~/.npm/**, ~/.pypirc
• Git credentials: ~/.git-credentials, ~/.config/gh/**
• Shell config: ~/.bashrc, ~/.zshrc (prevents backdoor planting)

Critical Security Caveat

Deny rules only block Claude's built-in tools without /sandbox. Bash commands bypass deny rules entirely. With /sandbox enabled, OS-level enforcement applies to all commands.^[4]

Sandboxing Layers (Trail of Bits)

Source: ^[4]

Anti-pattern: Running /dangerously-skip-permissions without sandboxing enabled.^[14]

Hook-Based Security Patterns

Team Sharing Security Pattern (Haberlah)

Source: ^[6]

Section 10: Community Resources & Repository Index

Notable Community Repositories (April 2026 Data)

Community Configuration Patterns

The awesome-claude-code repository (41.5K stars, 276 open issues as of April 2026) serves as the primary community aggregation point for shared hook patterns, CLAUDE.md templates, and skill collections.^[29] Configuration patterns documented across the community repositories in this research converge on several shared practices:

• Hook templates: PreToolUse rm -rf blocking and PostToolUse auto-formatter patterns appear independently across disler, Fryc, Trail of Bits, and ChrisWiles configs — indicating organic community convergence rather than copying^[2][8][4]
• CLAUDE.md size consensus: The ~100-line / ~2,500-token optimal size appears across multiple independent sources^[28][32]
• Skill plugin ecosystem: The obra/superpowers skill collection (referenced by Trail of Bits) and AltimateAI/data-engineering-skills plugin (used by Haberlah) indicate a growing third-party skill plugin ecosystem^[4][6]
• Self-improvement loop: The CLAUDE.md/AGENTS.md self-improvement pattern (document agent failures as rules) appears independently in Cherny, Hashimoto, and Haberlah configs^[32][23][6]

Note: Claude Code Discord and Aider/Cursor community cross-pollination data was identified as in-scope for this pillar but was not captured in the available research corpus. The awesome-claude-code repository (276 open issues, very active) is the closest available proxy for community-aggregated config patterns.^[29]

Local Model Configuration (Trail of Bits)

Recommended local fallback: Qwen3-Coder-Next (80B MoE, 3B active parameters, MLX-4bit).^[4]

lms get Qwen3-Coder-Next@MLX-4bit -y
lms load qwen/qwen3-coder-next --context-length 32768 --gpu max -y
ANTHROPIC_BASE_URL=http://localhost:1234 ANTHROPIC_AUTH_TOKEN=lmstudio claude

Terminal Recommendations

Cost Reference Data

Keyboard Shortcuts Reference

Source: ^[17][29]

Home