A new headless path can forward the hooks configured on your machine to a cloud session, but only after you have explicitly accepted on this machine. If the machine is unbound, or consent is declined, unset or unreadable, hook forwarding reports off with a reason. With no stored consent at all, the report tells you to run /hooks locally to decide. Forwarding also requires the feature's own enabled check to pass.
- Turning off emits
tengu_device_hooks_headless_offwith the reason and whether this was a reattach. - Consent in the "unset" state falls back to off rather than prompting.
Hooks from this machine are not used in cloud sessions yet: run /hooks in claude on this machine to decide.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
* [MCP](/docs/en/mcp) servers and [command hooks](/docs/en/hooks#command-hook-fields) are separate processes that run unconstrained on the host.sandbox-environments see the edit
Two other places on screen that report denials leave out the command or URL: the notice near the input box, such as `bash denied by auto mode · [Data Exfiltration] · /permissions`, gives the tool and the reason, and the **Recently denied**…auto-mode-config see the edit
Anthropic's documentation has since written up /hooks, on Configure auto mode.