{"version":"2.1.277","anchor":"new-sandbox-gate-for-running-project-command-checks-hooks","canonical_anchor":"new-sandbox-gate-for-running-project-command-checks-hooks","heading":"Project hook commands now run sandboxed and verified for remote\/cloud sessions","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277\/e\/new-sandbox-gate-for-running-project-command-checks-hooks","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277","markdown":"### Project hook commands now run sandboxed and verified for remote\/cloud sessions\n\nProject-defined hook commands served to remote or cloud sessions now run in a read-only sandbox with tamper checks and approval prompts\n\n**What**\n\nWhen a computer serves project-defined hook commands (project command checks) to a cloud or remote session, Claude Code now:\n\n- Pins each project hook script by its sha256 hash and verifies it hasn't changed since it was 'served' remotely, before honoring its `PreToolUse` decision.\n\n- Runs these hook commands in a sandbox with a private `TMPDIR`, read-only for cloud\/remote sessions.\n\n- Tracks outcomes such as `held_changed_since_attach`, `held_changed_since_last_serve`, timeouts, and malformed output, and surfaces them back to the user via additional context text and telemetry.\n\n- Asks for approval when a check is mismatched or has changed, either per-session or with an option to auto-accept going forward; three approvals in a row suppress further prompting.\n\n- Rejects checks that try to rewrite the command outright for cloud sessions.\n\nThis is gated by a flag that defaults off.\n\n**Why**\n\nProject hook commands can execute arbitrary logic, so running them sandboxed and verifying they haven't been tampered with since being served protects remote and cloud sessions from a compromised or altered hook script while still letting users approve legitimate changes.\n\n- Flag `tengu_violin_peg`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.277; this account: on, anonymous baseline: on, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 3\/5"}