A hardened template runner exists inside the disabled cloud hook-template path.
A new runner executes hook scripts supplied by the cloud session. It picks the first absolute interpreter it can vet from a fixed list, writes the script to a per-process directory, and runs it through a wrapper that re-reads the file, enforces a size cap and re-checks its SHA-256 before executing. A mismatch exits with code 86 and is reported as an integrity failure.
- The spawn clears environment variables matching
LD_,DYLD_,GCONV_PATH,PYTHONand sets onlyCLAUDE_PROJECT_DIR. It runs detached in its own process group, which is killed on timeout or abort. - Registration and upload require two account flags together,
tengu_violin_woodandtengu_violin_amati. If neither has been served yet the request answers "hook_forwarding_not_ready: feature flags not yet available; retry". - Policy settings that restrict hooks to plugins, disable customization, allow only managed hooks, or disable hooks entirely clear the registry first.
- None of these strings exist in 2.1.241.
device hook template integrity check failed:
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_violin_wood Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.242: off
tengu_violin_amati Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.242: not a boolean we can read
Read once, for one account on one subscription tier, against v2.1.242. It isn't a statement about your account. What a flag value here can and cannot tell you
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.