Hook packs

Install portable hook packs.

The public CLI generates harness-native telemetry configuration. The customer-cloud distribution adds PreToolUse enforcement.

Compile or install

Compile first when you want to inspect generated files. Install writes harness config into the current repository.

bash
verifier hook pack compile --provider claude-code,cursor,codex --mode telemetry
verifier hook pack install --provider claude-code,cursor --mode telemetry
HarnessGenerated files
Claude Code`.claude/settings.json`
Cursor`.cursor/hooks.json`
Codex.codex/config.toml and .codex/hooks.json

Telemetry mode

Lifecycle hooks call the verifier hook lifecycle command and emit signed hook events.

bash
verifier hook lifecycle <provider> <event>
  • Emits hook.completed or hook.failed records.
  • Carries harness, repository, developer, session, tool, matcher, duration, and hook status.
  • Carries hook pack profile metadata for portal provenance.
  • Fails open for telemetry-only capture so the developer workflow can continue.

Customer-cloud enforced mode

The public npm package does not contain local policy enforcement. The customer-cloud distribution provides this command.

bash
# Customer-cloud enterprise distribution only
verifier hook guard <provider> PreToolUse

Blocking behavior

Do not install public hooks with --mode enforce. The public CLI rejects this mode. Use the customer-controlled enterprise distribution for local blocking behavior.

Current limits

What ships today, and where each harness stands.

  • Claude Code lite activity connector is implemented, but live walkthrough remains pending.
  • Cursor lifecycle telemetry hooks and Cursor Agent CLI stream-json ingestion are implemented; full IDE chat history and edit-stream ingestion remain roadmap.
  • Copilot CLI connector is not implemented (roadmap).
  • Pi, OpenCode, Antigravity / Gemini CLI, and Factory AI Droid instrument through the SDK connector contract; harness-specific hook packs remain roadmap.
  • Client-submitted cognitive-debt or drift scores are ignored unless the event source is trusted.