The automated safety net

This page covers the three automatic safeguards the base runs for you without anyone calling them by name. When something pops up that you did not trigger, or when the AI suddenly refuses to commit, it is almost always one of these three.

That is why they get their own chapter. Knowing what runs automatically, once, means the next time the same shape shows up you do not panic — you take the next step.

Where they live

Three shell scripts sit under .claude/hooks/. Whether each one is active is decided by .claude/settings.json. The base ships them set up, and they work from the start without you touching anything.

File	When it runs	In one line
session-start.sh	When a new Claude Code session opens	Hands the “where things stopped” info to the AI automatically
stop-reminder.sh	When an AI response finishes	Nudges you with “leave one line for the next session”
pre-commit-check.sh	Right before the AI issues a git commit	Runs typecheck and lint first, blocks broken code from landing

First — the AI does not have to ask “where did we leave off?”

That is session-start.sh. When you open a fresh Claude Code window, this script runs first and shows the AI the following files automatically:

• .claude/session-state/archive/active.md: the “next action” the previous session left behind
• The last 30 lines of .claude/state/progress.md: recent progress history
• .claude/state/feature_list.json: features your SaaS promised and which ones pass
• The first 50 lines of docs/design/saas-spec.md: concept, scenarios, data model
• .claude/agent-memory/MEMORY.md: the project decision cache index

Healthy shape: opening a new session lands “Session context auto-restored” as the first message, with the contents of the files above stacked underneath. Saying “let’s continue” is enough — the AI picks up the next step from that seat.

Silent on the very first run: right after a fresh clone, none of those files exist yet. So the script outputs nothing and exits quietly. At that point, the /start router auto-creates the empty templates (active.md, progress.md, MEMORY.md).

Unhealthy shape: you definitely worked yesterday, but the new session has no “Session context auto-restored” header. Almost always the SessionStart entry inside .claude/settings.json got removed (by you or the AI). Pull the original settings.json from the base and copy just that one entry back in — it works again.

Second — a nudge to leave a one-liner

That is stop-reminder.sh. Every time an AI response wraps, it checks how long active.md is. If, ignoring whitespace, the file has fewer than 20 characters, a short message lands for you:

💡 Leaving a one-liner makes it easier to pick up next time:
   File: .claude/session-state/archive/active.md
   Example: "Write one e2e scenario for the checkout flow, then run /test-saas"

This is the seat non-developers leave empty most often. The “write down what you do next” habit is not built in yet, so when a session wraps, the window just closes. The next session’s auto-restore lands empty, and the AI ends up asking where it left off again.

Healthy shape: when the nudge lands, you type a one-liner memo into .claude/session-state/archive/active.md. The next session’s auto-restore picks that line up verbatim.

Safe to ignore: if active.md is already full, the nudge does not show. And if the nudge lands but you actually did nothing of note that session, closing it without writing is fine. The safety net is automatic, not mandatory.

Third — block broken code from being committed

That is pre-commit-check.sh. Right before the AI issues git commit ..., this hook runs typecheck and lint first. Both have to pass before commit proceeds; either one failing blocks the commit. The block message also prints the last 30 lines of the failing output.

This is the seat that helps a non-developer most. The AI sometimes writes code where one spot has a type mismatch, then proceeds to issue the commit anyway. If you run that command, broken state lands in git history. This hook blocks that seat.

In saas-base specifically, lint also covers FSD boundaries and jsx-a11y. When the AI imports across features/ slices, or forgets alt on an <img>, this hook catches it.

Healthy shape (pass):

🔍 Pre-commit check (typecheck + lint)…
✓ typecheck + lint passed — proceeding to commit

Those two lines mean the commit went through.

Unhealthy shape (blocked):

🔍 Pre-commit check (typecheck + lint)…
❌ lint failed. Commit blocked. Show this message to the AI and ask it to fix:

src/features/checkout/ui/CheckoutButton.tsx
  14:7  error  Cross-feature import not allowed: features/checkout cannot import features/sign-in
  22:3  error  img elements must have an alt prop  jsx-a11y/alt-text

Copy those 30 lines verbatim into the Claude Code window and say “fix this.” The AI lands the seat and rewrites it. Run the commit again and the second attempt usually passes.

Package managers other than pnpm: the hook looks for pnpm-lock.yaml, yarn.lock, or package-lock.json and picks the matching manager automatically. The base default is pnpm, so pnpm runs in most cases.

Turning one off

If a specific safeguard rubs against your workflow, remove just that entry from .claude/settings.json. They are independent — pulling one does not affect the other two.

{
  "hooks": {
    "SessionStart": [...],
    "Stop": [...],
    "PreToolUse": [...]
  }
}

If the pre-commit check is the friction point, remove "PreToolUse": [...] outright. To bring it back, copy the entry out of the base’s original settings.json again.

The recommendation is to leave them on. All three cover the seats where non-developers slip most, and turning one off shifts that seat back into your responsibility.

Do you need to add a hook of your own

Almost never. The three the base ships already cover the biggest seats where context collapses in a non-developer workflow.

If a new seat genuinely comes up, you write a shell script. That is outside the scope of this guide. The Expert architecture page lays out the same hook system in a tighter pace — that is the place to start.

Next

With the automated safety net understood, the next chapter is shipping your SaaS so it reaches a user’s browser. Vercel, Netlify, Cloudflare Pages, and self-host — four routes in 08-distribution.md. If something broke in between, the symptom entries in 09-troubleshooting.md come first.