Per-hook cloud offer decisions with digest pinning and a /hooks cloud panel belong to the disabled device-hooks path.
What
New code decides for each locally configured hook whether it is offered to a cloud session driven from this machine, and /hooks gained a cloud-session panel to review the decisions. Command hooks are pinned by digest and refused when their script sits somewhere the cloud session can write; HTTP hooks have no script to pin.
Details
- A new table classifies each hook event that is not forwarded, surfacing as "this event happens on this machine, not in the cloud" or "this event is not forwarded yet".
- No feature flag for this appears in the bundle; the only visible condition is that a cloud-session panel exists, so what makes that panel appear is decided elsewhere.
- None of these strings exist in 2.1.241.
Evidence
event_container_internal
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundle/hooks
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Choose a sandbox environment touched a line naming /hooks after this was published.
* [MCP](/docs/en/mcp) servers and [command hooks](/docs/en/hooks#command-hook-fields) are separate processes that run unconstrained on the host.sandbox-environments see the edit
Confirmed since
Anthropic's documentation has since written up /hooks, on Configure auto mode.
Two other places on screen that report denials leave out the command or URL: the notice near the input box, such as `bash denied by auto mode · [Data Exfiltration] · /permissions`, gives the tool and the reason, and the **Recently denied**…auto-mode-config see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up /hooks, on Configure auto mode.