{"version":"2.1.242","anchor":"cloud-supplied-hook-templates-run-as-vetted-python3-scripts","canonical_anchor":"cloud-supplied-hook-templates-run-as-vetted-python3-scripts","heading":"Cloud-supplied hook templates run as vetted python3 scripts","tier":"soon","area":"Hooks","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/cloud-supplied-hook-templates-run-as-vetted-python3-scripts","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### Cloud-supplied hook templates run as vetted python3 scripts\n\nCloud-supplied hook scripts run through a vetted python3 wrapper that rechecks their checksum.\n\n**What**\n\nA new runner executes hook scripts supplied by the cloud session. It picks the first absolute interpreter it can vet from a fixed list, writes the script to a per-process directory, and runs it through a wrapper that re-reads the file, enforces a size cap and re-checks its SHA-256 before executing. A mismatch exits with code 86 and is reported as an integrity failure.\n\n**Details**\n\n- The spawn clears environment variables matching `LD_`, `DYLD_`, `GCONV_PATH`, `PYTHON` and sets only `CLAUDE_PROJECT_DIR`. It runs detached in its own process group, which is killed on timeout or abort.\n- Registration and upload require two account flags together, `tengu_violin_wood` and `tengu_violin_amati`. If neither has been served yet the request answers \"hook_forwarding_not_ready: feature flags not yet available; retry\".\n- Policy settings that restrict hooks to plugins, disable customization, allow only managed hooks, or disable hooks entirely clear the registry first.\n- None of these strings exist in 2.1.241.\n\n**Evidence**\n\n`device hook template integrity check failed: `\n\n- Flag `tengu_violin_wood`: Off in both readings (read for one account on one subscription tier against v2.1.242; this account: off, anonymous baseline: off, compiled default: off)\n- Flag `tengu_violin_amati`: Off in both readings (read for one account on one subscription tier against v2.1.242; this account: off, anonymous baseline: off, compiled default: not a boolean we can read)\n- Area: Hooks\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 3\/5\n- Present in the build but not switched on"}