[FEATURE] Add --no-hooks flag to claude -p (non-interactive mode without breaking OAuth/subscription auth)

[kamegg13]

Problem

When running `claude -p` in headless/scripted mode, there is no clean way to disable hooks without also losing OAuth subscription auth.

The only current option to skip hooks is `--bare`, but `--bare` deliberately ignores OAuth tokens and requires `ANTHROPIC_API_KEY` — which means paying per-token even if you have a Pro/Max/Team subscription.

This creates a forced tradeoff:

Goal	Flag	Side effect
Disable hooks	`--bare`	❌ Breaks OAuth, requires API key
Keep OAuth subscription	(no flag)	❌ Hooks always run
Disable hooks + keep OAuth	❌ Impossible today	—

The workaround — creating a custom `settings.json` with `disableAllHooks: true` and passing `--settings ./no-hooks.json` — works but is awkward for scripted environments and requires managing an extra file per project.

Concrete use case

I run Claude as an autonomous agent triggered by Dagster pipeline failures on my local machine. The sensor posts to a local FastAPI webhook, which calls:

```bash
claude -p
--model sonnet
--max-turns 15
--allowedTools "Read" "Edit" "Bash(git *)" "Bash(gh pr create *)"
"Job failed: $JOB_NAME — Error: $ERROR. Read logs, fix the code, open a PR."
```

I want this to:

• ✅ Use my existing Max subscription (not burn API credits)
• ✅ Skip all hooks (session-start hooks, stop hooks, etc. are irrelevant in automated context)
• ✅ Be a one-liner, not require a settings file sidecar

Today this is impossible. `--bare` solves hooks but kills OAuth. `--settings` solves it but adds file management overhead.

Proposed solution

Add a `--no-hooks` flag that:

• Skips all hook execution (PreToolUse, PostToolUse, Stop, etc.)
• Does not affect the auth chain — OAuth subscription still works normally
• Is composable with all existing `-p` flags

```bash

Desired behavior

claude -p --no-hooks --model sonnet --max-turns 10 "query"

→ runs with subscription auth, no hooks fired

```

Internally this is equivalent to injecting `{ "disableAllHooks": true }` into the effective settings without touching the auth stack — which `--bare` does too aggressively.

Why this matters

The headless use case (`claude -p`) is increasingly used for:

• Webhook-triggered autonomous agents (CI, monitoring, on-call)
• Local automation scripts replacing cron jobs
• Pipe-based scripting (`cat logs | claude -p "summarize"`)

In all these contexts, hooks are irrelevant or actively harmful (they add latency, side effects, and are designed for interactive sessions). But these users often have subscriptions — they should not be forced onto the per-token API key model just to avoid hooks.

Alternatives considered

Option	Works?	Drawback
`--bare`	Hooks disabled ✅	OAuth broken ❌
`--settings ./no-hooks.json`	Both work ✅	Extra file to manage, not composable inline ❌
`ANTHROPIC_API_KEY` env var	Works ✅	Pays per-token, bypasses subscription ❌
`--no-hooks` (proposed)	Both work ✅	—

Related

• The `disableAllHooks` setting already exists in `settings.json` — this flag would just expose it as a CLI argument, consistent with how `--tools ""` exposes tool restrictions inline.

[github-actions]

Found 3 possible duplicate issues:

1. [FEATURE] --bare mode: option to preserve OAuth/keychain auth while skipping context #38022
2. claude -p --no-session-persistence still runs SessionStart hooks from CWD project, causing hangs #42458
3. Stop hook breaks -p (print/pipe) mode — output is silently empty #39050

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[0xbrainkid]

The forced tradeoff between hook execution and OAuth subscription auth is a real gap — headless/scripted automation is a primary use case for claude -p, and requiring --bare (which drops OAuth) to disable hooks creates an unnecessary cost penalty.

From an agent identity perspective, this matters because the agent's authorization context (which subscription tier it can use, what rate limits apply, what models are available) is determined by the auth method. Forcing API key auth just to disable hooks changes the agent's capability set in ways unrelated to hooks.

The --no-hooks flag is the right solution — hooks are a behavioral layer on top of the session, and disabling them should not affect the auth layer. The implementation path is straightforward: hooks are loaded and registered in a separate step from auth resolution. --no-hooks skips the hook registration step while leaving the auth path unchanged.

The --settings ./no-hooks.json workaround works but is fragile for scripted environments (path management, file must exist, etc.). A first-class flag is the right abstraction.

Two additional flags worth considering alongside --no-hooks:

• --no-hooks-pre: disable only PreToolUse hooks (let PostToolUse and Stop hooks run)
• --no-hooks-post: disable only PostToolUse and Stop hooks (let PreToolUse run as a guard)

This gives scripted automation fine-grained control: a Dagster failure-handler might want PreToolUse hooks for safety (blocking dangerous commands) while skipping PostToolUse hooks that post Slack notifications on every tool call.

[bojanstef]

Seeing the Dagster → FastAPI → claude -p setup here, I've been building Pylon (github.com/pylonto/pylon), a Go daemon that's this pattern productionized: HMAC-verified webhook ingest, Docker sandbox per run, Telegram/Slack approval gate, SQLite job history.

Doesn't solve the --no-hooks + subscription-auth ask (that's Claude Code itself), but it would let you drop the FastAPI shim.

Happy to share a pylon.yaml for the pipeline-failure case if useful.

(Full disclosure: I built Pylon)