Project-defined hook commands served to remote or cloud sessions now run in a read-only sandbox with tamper checks and approval prompts
What
When a computer serves project-defined hook commands (project command checks) to a cloud or remote session, Claude Code now:
- Pins each project hook script by its sha256 hash and verifies it hasn't changed since it was 'served' remotely, before honoring its
PreToolUsedecision. - Runs these hook commands in a sandbox with a private
TMPDIR, read-only for cloud/remote sessions. - Tracks outcomes such as
held_changed_since_attach,held_changed_since_last_serve, timeouts, and malformed output, and surfaces them back to the user via additional context text and telemetry. - Asks for approval when a check is mismatched or has changed, either per-session or with an option to auto-accept going forward; three approvals in a row suppress further prompting.
- Rejects checks that try to rewrite the command outright for cloud sessions.
This is gated by a flag that defaults off.
Why
Project hook commands can execute arbitrary logic, so running them sandboxed and verifying they haven't been tampered with since being served protects remote and cloud sessions from a compromised or altered hook script while still letting users approve legitimate changes.
tengu_violin_peg Off by default, switched on for this accountThe shipped code defaults this off, and the flag server returned on for the one account this site reads on this version. That is the reading that makes the entry above worth a second look, and it still says nothing about your account.
This account: on · anonymous baseline: on · compiled default in v2.1.277: off
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.277. It isn't a statement about your account. What a flag value here can and cannot tell you
New in this build: tengu_violin_peg