nightshift

name	nightshift
description	Run Claude Code autonomously overnight with a validated runbook, security hooks, heartbeat watchdog, and kernel sandbox. Use when someone wants unattended Claude runs, headless batch work, or autonomous overnight coding.
allowed-tools	Bash Read Write Grep Glob
argument-hint	[project-path] [task-description]
shell	bash

Claude Nightshift

Generates a complete autonomous Claude Code setup — validated runbook, security hooks with enforced error budgets, heartbeat watchdog, and cross-platform sandbox (macOS Seatbelt + Linux Docker). The user provides a project path and a task description; the skill produces everything needed to let Claude Code work unattended.

Why this exists

Running Claude Code with --dangerously-skip-permissions alone breaks down after ~20 minutes: context gets compacted, Claude forgets the plan, repeats steps, or drifts. Nightshift solves this with four layers: a validated runbook as external memory, a compact-recovery hook that re-injects the plan, security hooks that block destructive commands, and a watchdog that monitors liveness.

Input

$ARGUMENTS — interpret as:

Input	Action
(empty)	Interactive: ask for project path, task, genre
[path] [task]	Direct: auto-detect genre, confirm with user
genre list	Show all 8 genre templates with phases
validate [path/runbook.md]	Validate an existing runbook

Workflow

Step 1: Gather input

Ask the user for:

1. Project path — absolute path to the project directory
2. Task — what Claude should accomplish
3. Stack info (optional) — auto-detect from package.json, Cargo.toml, pyproject.toml if available
4. Security level (optional) — strict, normal (default), or permissive

Step 2: Select genre

Suggest the most fitting genre based on the task description. Available genres: refactoring, feature, migration, bugfix, testing, cleanup, devops, documentation. Genre definitions are in ${CLAUDE_SKILL_DIR}/../../scripts/shared/genres.py.

Step 3: Generate runbook

Fill the genre template with concrete, project-specific steps. Every step needs at least one of: a file path, a shell command, or a concrete action with function/class names.

Good step: - [ ] Create src/services/token-service.ts with: generateAccessToken(userId), verifyToken(token) Bad step: - [ ] Implement the auth module

Include autonomy zones (green/yellow/red) and error budget with stop conditions in the runbook.

Step 4: Validate runbook

Run the 15-point validation. The validation catches: missing rollback section, vague steps, paths outside the project, hardcoded secrets, too many/few steps, missing autonomy zones, missing error budget.

Step 5: Generate ZIP

PLUGIN_ROOT="${CLAUDE_SKILL_DIR}/../.."
export NIGHTSHIFT_PROJECT="[project-path]"
python3 "${CLAUDE_SKILL_DIR}/scripts/build_zip.py"

Set these environment variables before running:

• NIGHTSHIFT_PROJECT — absolute project path
• NIGHTSHIFT_TASK — task title
• NIGHTSHIFT_TASK_SHORT — short title for git commit
• NIGHTSHIFT_TEST_CMD — test command (e.g., npm test)
• NIGHTSHIFT_STACK — detected technologies
• NIGHTSHIFT_GENRE — selected genre
• NIGHTSHIFT_SECURITY — security level (strict/normal/permissive)
• NIGHTSHIFT_RUNBOOK — the validated runbook text

Step 6: Present output

Show the ZIP contents, installation guide with concrete paths, and runbook summary (genre, step count, phases).

Security layers

1. PreToolUse hook: Blocks destructive commands (rm -rf, sudo, eval, etc.) + enforces path restrictions (red zone)
2. PostToolUse hook: Writes heartbeat + tracks error count
3. Error budget: Auto-stops after 3+ errors (technically enforced, not just documented)
4. SessionStart hook: Re-injects runbook after context compaction
5. Stop hook: Repeats autonomy zones every 5 completed steps
6. Sandbox: macOS Seatbelt profile OR Linux Dockerfile — restricts filesystem to project + /tmp
7. Watchdog: Heartbeat monitor with cross-platform notifications