Own Your Context Window

The one line: everything the model reads is a file you can open, and most of it loaded before you typed a word.

The order of a session

A session is a stack, assembled in this order:

1. Your prompt. The only part you wrote.
2. Tool definitions. One schema per callable tool: MCP servers, LSP, task and worktree tools, web fetch, browser and computer-use. The biggest block, and the one you control.
3. The client-side system prompt. Your harness's own instructions. You cannot edit it, and the server-side half you never see.
4. Rules files. CLAUDE.md and AGENTS.md at each scope, plus auto memory. See Rules Files and Scope.
5. The skill listing. Name and description for every installed skill, global and project, roughly 100 tokens each.
6. The turn: tool calls and tool results, which is what actually fills the window.

Steps 2 to 5 are your baseline, paid on every turn whether the work needs it or not.

Look at the file, not the UI

Claude Code writes each session to disk as JSONL under ~/.claude/projects/<encoded-project-path>/, your project path with slashes swapped for dashes. Every line is one event, in order: your prompt, the attachments block, each tool_use and its tool_result. Sub-agent transcripts sit in the same tree. Open one and you see what the model saw.

/context prints the current window broken down by what is holding it, /context all for the fuller listing (docs). The JSONL shows how it got there.

Read the JSONL with something

One turn of raw JSONL is a wall of metadata around the few hundred tokens you care about.

I wrote peektrace for this. peektrace serve opens every Claude Code, Codex and Pi session in your browser. It charts peak context against the window, split into system and tool definitions, CLAUDE.md / AGENTS.md, files, prompts, tool results and hidden thinking, and marks the turn the session went dumb plus every compaction cliff after. Artifacts and tool calls are searchable, and you can run it as a one-shot command: peektrace sessions ls, peektrace sessions analyze <session-id>, --json to pipe. The server binds 127.0.0.1, transcripts are secret-redacted, nothing is sent to a model. Free and open source (GitHub).

curl -fsSL https://raw.githubusercontent.com/Mark-Life/peektrace/main/scripts/install.sh | sh

Tool definitions are the lever

Open the attachments block of a fresh session and read the tool list. Then run /mcp, turn off the Chrome and computer-use tools, restart and read it again: visibly shorter, and those tools bundle their own usage skill, so that goes too. If /mcp lists no servers, skip ahead to MCP Without Tool Bloat and come back.

Tool search is on by default: only names and server instructions load at startup, and ToolSearch fetches schemas on demand. ENABLE_TOOL_SEARCH tunes it: unset defers MCP tools, true always defers, auto loads everything upfront only if it fits inside 10 percent of the window (auto:N for your own), false loads all upfront. Anthropic measured 58 tools across 5 servers at roughly 55K tokens before you type, and Opus 4.5 tool-call accuracy rising from 79.5 to 88.1 percent once schemas load on demand (advanced tool use).

Past roughly 40 tool definitions the model starts picking the wrong one. Turn the browser tools on for the hour you need them, then turn them off.

A settings.json that cuts the baseline

My ~/.claude/settings.json, trimmed to the keys that touch context:

{
  "permissions": {
    "deny": [
      "EnterPlanMode",
      "ExitPlanMode",
      "NotebookEdit",
      "AskUserQuestion",
      "ScheduleWakeup",
      "CronCreate",
      "CronDelete",
      "CronList"
    ]
  },
  "disableClaudeAiConnectors": true,
  "disableBundledSkills": true,
  "disableRemoteControl": true,
  "effortLevel": "high",
  "tui": "fullscreen",
  "skipDangerousModePermissionPrompt": true
}

Every key is in the settings reference. disableClaudeAiConnectors cuts the most: it drops the built-in connectors and their tool definitions. disableBundledSkills removes the shipped skills, leaving /doctor; the environment variable CLAUDE_CODE_DISABLE_BUNDLED_SKILLS=1 does the same. disableRemoteControl blocks Remote Control, tui: "fullscreen" picks the alt-screen renderer.

The denies are personal: I plan in the window or in a markdown file and write no Python notebooks. Deny what you never invoke.

The danger zone

Quality falls off well before the window is full. My working number is roughly 40 percent: past that, hallucinations and dropped instructions get noticeably more common. A heuristic from watching sessions, not a published figure.

Compaction re-injects the system prompt, project-root CLAUDE.md, unscoped rules and auto memory, but drops path-scoped rules, nested CLAUDE.md files and the skill listing. A new session with a three-line handoff prompt gives the model a cleaner stack. /clear between tasks costs you nothing.

Skipping the permission prompts

I run alias tc='claude --dangerously-skip-permissions' and have for about a year.

The flag equals --permission-mode bypassPermissions. The docs say to use it only in "isolated environments like containers, VMs, or dev containers without internet access" and that it "offers no protection against prompt injection" (permission modes). It refuses to start as root or sudo, and still stops for explicit ask rules and the rm -rf / circuit breaker, but it allows writes to protected paths like .git and .claude. Outside a sandbox, anything the model runs, runs. Nothing has gone wrong for me: one person's sample.

Auto mode is the better default now

From 14 August 2026, auto is the default permission mode for new sessions on Pro, Max and Team plans. Set your own default and it stays; accept the one-time prompt and you move.

A separate classifier model reviews each action and blocks "anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read". It owns the rm -rf / and rm -rf ~ decision too. Blocked by default: curl | bash, sensitive data to external endpoints, production deploys and migrations, mass deletion on cloud storage, granting IAM or repo permissions. Your working directory and the git remotes present at session start are trusted, one added mid-session is not. Explicit ask rules still prompt. It needs Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5 on the Anthropic API.

That is safer than what I run, with no prompts to answer, though Anthropic hedges: auto mode "reduces permission prompts but does not guarantee safety". defaultMode: "auto" works only in ~/.claude/settings.json; project files are ignored, so a repository cannot grant itself auto mode.

I stay on bypass out of habit, not analysis. Bypass is faster: auto mode puts a classifier call in front of every action. Setting this up today, start on auto.

Audit your own setup

Your baseline drifts: a plugin here, a skill you tried once, an MCP server from three months ago. My context-doctor skill reads what auto-loads into every session, checks it against what you invoke, and ranks the cuts as prune, gate behind a trigger, or route elsewhere. Skills you never call get flagged; you can keep them and hide them from the model, covered in Skills.

What to do

• Install peektrace, run peektrace serve, and read one session's attachments block top to bottom.
• Run /mcp, turn off the Chrome and computer-use tools, restart, compare the tool list.
• Add disableClaudeAiConnectors and disableBundledSkills to ~/.claude/settings.json, then deny every tool you never invoke.
• Check /context mid-task; past roughly 40 percent, /clear and restate the task in three lines.
• Run auto mode unless you have a reason not to; put defaultMode: "auto" in ~/.claude/settings.json, not in the project settings.