Module 15 — Master costs, context, security, and team deployment

The previous module put Claude Code in a cron, a GitHub Actions PR, and a Python SDK. What remains is what decides whether Kiosque keeps going in October: how much it costs, what it can see, and how to install it cleanly for five developers. Three axes — costs, context, security — on a single rule: anything not essential to the current turn burns tokens and grows the attack surface.

Read /usage

/usage is the first reflex. The Total cost line in the Session section shows the local cost, computed from tokens at the displayed rate; if a managed modelPricing is in effect, the phrase at your organization's configured rates appears. On Pro/Max, this number is indicative; actual billing runs through usage credits, visible in Usage credits and manageable via /usage-credits. /cost and /stats are aliases.

Starting with the second response, a Prompt cache (main) line is added: 14 requests · 91% of input tokens from cache · 2 misses (last 6m 10s ago, 310.2k tokens re-cached) · warm (1h TTL, last activity 40s ago). A high read ratio means the conversation mostly reads from cache, billed at the "cached" rate (about 10% of the input rate). A miss designates a request that reprocessed more than 5% and at least 2,000 tokens of what could have been served; a probable cause sometimes appears (likely cause: tool definitions changed). expected rebuilds are intentional (compaction, tool-result cleanup). warm 1h TTL: main conversation on the long window (guaranteed on subscription in included usage; on credits, API key, or cloud provider, five minutes by default).

Below these lines, the breakdown section (keys d and w) attributes recent usage to skills, subagents, plugins, and MCP servers, and flags at most three behavior flags (long context, cache misses…) when a behavior exceeds 10%. A Loops line lists /loop tasks ordered by tokens. /insights writes an HTML report to ~/.claude/usage-data/report.html by analyzing up to 200 recent local sessions.

Reduce tokens

costs.md ranks the moves. On Kiosque, five moves cut the bill by a factor of three: /clear between unrelated tasks (a context open all day bills the whole conversation on every turn; /rename before /clear to find it again through /resume); /compact with instructions (/compact focus on the auth fix keeps what matters, place at a natural pause); the right model (Sonnet handles 90% of Kiosque work at a lower cost than Opus; Opus for architecture decisions and multi-layer traces; model: haiku for a trivial subagent); fewer MCPs turned on (/mcp lists active servers); offload to a subagent (a read of ten files stays in its context, only a summary returns).

Extras: MAX_THINKING_TOKENS=8000 (or /effort medium) for simple work, migrate detailed instructions from CLAUDE.md to skills loaded on demand (aim for CLAUDE.md < 200 lines), specific prompts ("add validation in auth.ts" rather than "improve auth").

Understand the context

context-window.md describes the window in layers. Before the first keystroke, a Kiosque session loads: system prompt and tool definitions (~4.5 k tokens, replayed on any tool change), auto-memory (~700, first 200 lines or 25 KB of MEMORY.md), MCP tool names (~120, schemas deferred by tool search), skill descriptions (~450, absent after /compact except for invoked skills), ~/.claude/CLAUDE.md (~320), project CLAUDE.md (~1,800). Every read adds 1,000 to 3,000 tokens; every paths: rule joins the conversation when a matching file is read; a subagent maintains its own window.

After /compact: system prompt and output style remain (outside history), root CLAUDE.md and unfiltered rules reload from disk, up to five recently modified files are re-read, invoked skills are re-injected at 5,000 tokens each, capped at 25,000 cumulative. paths: rules reappear when a matching file is re-read. What is written to a file survives; what lives only in the conversation is summarized.

What invalidates the cache

prompt-caching.md is the second essential read. The cache is a prefix match: any modification inside forces reprocessing the tail. Costly invalidations: /model (each model has its own cache, Claude Code asks for confirmation while the cache is warm), mid-session effort change (except Fable 5.1 on API key or subscription), fast mode activation (the header changes the cache key, an uncached turn is billed at the fast-mode rate), connect/disconnect of an MCP whose tools are loaded in the prefix (tools deferred by tool search stay free in cache), full-tool deny on Bash or WebFetch, /compact (invalidates by construction), output style change, Claude Code update.

Editing a file, changing permission mode, invoking a skill, running /rewind or /recap: none of these break the cache. A subagent starts its own cache. Choose model and effort at the start of the session, keep /compact for pauses.

To confirm the TTL: claude -p "hello" --output-format json, then read usage.cache_creation.ephemeral_1h_input_tokens versus ephemeral_5m_input_tokens. Two settings, promptCacheTtl (main conversation) and subagentPromptCacheTtl (subagents, workflows, compaction, titles), accept 5m or 1h. FORCE_PROMPT_CACHING_5M=1 forces five minutes; ENABLE_PROMPT_CACHING_1H=1 requests one hour. On API key or cloud provider, set promptCacheTtl: 1h.

When to enable fast mode

fast-mode.md is explicit: /fast is an Opus configuration, not a different model. Available on Opus 5 and Opus 4.8, priced at $10/$50 per MTok input/output, billed on usage credits even on subscription. The first turn where fast mode activates makes you pay the entire uncached context at the fast-mode rate; enable it at the start rather than mid-session. Use cases: interactive debugging under pressure, tight iteration on a React patch. Avoid for a batch or an overnight PR review.

On Team/Enterprise, an Owner enables fast mode in Admin Settings > Claude Code; on Console, an admin in Claude Code preferences. Without provisioning, the API returns 429. Three env vars for gateway cases: CLAUDE_CODE_DISABLE_FAST_MODE=1, CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS=1, CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK=1. For a reset on every session: "fastModePerSessionOptIn": true.

Security in three layers

security.md sets the architecture. In Manual mode, Claude Code starts read-only and asks before every non-trivial write or execution; read Bash commands (ls, cat, git status…) go through without asking. In auto mode, a classifier separates safe, to-validate, and to-refuse actions; your deny/ask still take precedence. The directory boundary is strict: Claude only writes in the startup folder and its subfolders. Widen with additionalDirectories, narrow reads with denyRead under sandboxing.

Three defensive moves for Kiosque: block network commands (by default curl/wget ask in Manual; add them to permissions.deny), forbid secrets (Read(./.env) and Read(./.env.*) in permissions.deny), use the ConfigChange hook to audit or block a settings modification in session. The sandbox isolates Bash commands (filesystem, network). --bare remains the only reliable protection against injection in -p: without it, a hostile CLAUDE.md, hook, or MCP server from the current directory is loaded with no trust dialog. Against prompt injection: reread every command before approval, avoid piping untrusted content directly, run risky scripts in a VM or a devcontainer. WebFetch uses its own window. On Windows, disable WebDAV and refuse \\* paths.

The security-guidance plugin

security-guidance.md installs a three-layer review, free for the pattern layer: on every edit, matching expressions/substrings (eval(, new Function, os.system, child_process.exec, pickle, dangerouslySetInnerHTML, .innerHTML =, document.write, edits in .github/workflows/) with no model call; at end of turn, background model review over the cumulative diff (up to 30 files, three cascading passes at most); on every git commit or git push launched by Claude through Bash, deeper agentic review that reads callers and sanitizers (cap 20 per rolling hour; your shell commits are not reviewed).

Install: /plugin install security-guidance@claude-plugins-official, then /reload-plugins. For the whole team, "enabledPlugins": {"security-guidance@claude-plugins-official": true} in .claude/settings.json. Two additive local extensions: .claude/claude-security-guidance.md (in-house threat model), .claude/security-patterns.yaml (project patterns). Neither can disable a native check. Four variables cut a layer: ENABLE_PATTERN_RULES=0, ENABLE_STOP_REVIEW=0, ENABLE_COMMIT_REVIEW=0, ENABLE_CODE_SECURITY_REVIEW=0. SECURITY_GUIDANCE_DISABLE=1 disables everything.

Complementary, /security-review does a single pass over the diff of the current branch versus the origin default branch. Useful before opening the PR. Without origin, the command fails with the ambiguous argument documented in errors.md.

Configure the team

settings.md defines five scopes, highest priority first: Managed, Command line (--settings), Project local (.claude/settings.local.json), Shared project (.claude/settings.json), User (~/.claude/settings.json). Lists merge (permissions.allow adds up instead of being replaced), four exceptions for model lists (fallbackModel, modelPicker, availableModels, modelSettings).

For Kiosque, the shared file sets the invariants:

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(make test)",
      "Bash(make lint)",
      "Bash(ruff *)",
      "Bash(pytest *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Bash(curl *)",
      "Bash(wget *)"
    ]
  },
  "enabledPlugins": {
    "security-guidance@claude-plugins-official": true,
    "kiosque-tools@kiosque-marketplace": true
  }
}

.claude/settings.local.json, in .gitignore, holds personal exceptions. allow and additionalDirectories from a shared settings only activate after folder trust (workspace trust); deny and ask apply immediately. /status lists the files actually loaded in Setting sources. claude doctor details rejected entries.

Some keys are ignored in the shared file (Scope column User, local, or managed in settings-reference.md). Administrators define policies through managed settings that nothing local can loosen, except for a few security-sensitive exceptions where the stricter value wins (disableClaudeAiConnectors: true, enableArtifact: false, isolatePeerMachines: true…). Onboarding a new developer goes through /team-onboarding: Claude analyzes the last 30 days of local sessions and writes a markdown guide to copy-paste as the first message; on claude.ai, a shareable link is also returned. /privacy-settings remains reserved to Pro and Max subscribers.

Summary

Read /usage every week, the Prompt cache (main) line every day the cost climbs. Clear between unrelated tasks, compact at pauses, keep Sonnet as the default, Opus for hard decisions. Only enable /fast at the start of a latency-sensitive session. Lock permissions down in shared .claude/settings.json, install security-guidance for the whole team, complement with /security-review, and distribute configuration through managed settings when a point is non-negotiable.

Next module: Project: the Kiosque team's complete Claude Code toolkit.