Function Hooks and ant apply: Claude Code's Terraform Moment

Anthropic's developer account, @ClaudeDevs, posted two extensibility announcements eleven hours apart on September 3 and 4, 2026. Neither is small. One is a not-yet-shipped preview of Function Hooks for Claude Code — TypeScript middleware that would let plugins rewrite tool calls, gate actions, and intercept UI events, gathering feedback before Anthropic commits to building it. The other is ant apply, a command that already shipped in the ant CLI, and it does for Claude's Managed Agents platform roughly what terraform apply does for cloud infrastructure: declare agents, skills, memory stores, and deployments as files, and let the tool reconcile the live API to match.

They're the same account, the same week, and both are about the same underlying shift — Claude's tooling is moving from "configure it in a UI or a JSON blob" toward "declare it in version control, diff it, apply it." That's explainx.ai's core beat: agent tooling, Claude Code extensibility, and infrastructure-as-code patterns applied to agents rather than servers. Here's what actually shipped, what's still an RFC, and where the real friction is.

TL;DR

Function Hooks: hooks that run code, not just shell commands

Claude Code's existing hooks — PreToolUse, PostToolUse, and the rest configured in .claude/settings.json — are shell commands. Claude Code fires an event, runs your command, reads the exit code and stdout/stderr, and decides whether to proceed. That model is simple and has held up well for linting, blocking dangerous commands, and audit logging. It was never built for rewriting a tool call in-place or reaching into the UI.

Function Hooks, as posted by @ClaudeDevs, is a proposal to add exactly that. According to Anthropic's own framing (not yet documented outside the announcement and the GitHub issue), it borrows its composition model directly from Express and Koa-style middleware:

• Handlers compose in registration order, and each one can short-circuit the pipeline instead of passing control forward.
• A parameterized $ object carries the side effects a hook is allowed to perform. An admin-registered hook that runs first can strip methods off $ before any downstream plugin's hooks ever see them — a permission boundary enforced structurally, not by convention.
• A wildcard hook on * sees every event, including other plugins' own calls into $, which is what makes comprehensive audit logging possible without every plugin author cooperating.
• Hooks can intercept UI events across both the terminal and desktop app from a single registration — Anthropic's example is a hook on ui.press that fires identically whether the button was clicked in the TUI or the Electron-based desktop client.

The demo use cases are concrete: a plugin that strips secrets from tool output before the model ever reads them, built and validated end-to-end from a single natural-language prompt, and a screen-share privacy mode that masks sensitive values in Claude Code Desktop and reveals them only on hover.

None of this has shipped. Anthropic's post is explicit: "It hasn't shipped yet, we'd love feedback on this on our GitHub issue." That issue is anthropics/claude-code#91870, "Function Hooks - make plugins 10x more powerful" — the actual place to weigh in, not a placeholder. Anthropic has said the response there likely determines whether the feature lands at all, so this genuinely is an RFC, not a soft launch.

Real reactions worth tracking

The replies under the announcement are more informative than most launch-thread noise:

• "Can't you just add support for AGENTS.md?" — a fair ask. Anthropic already reads AGENTS.md and .agents/skills alongside CLAUDE.md elsewhere in Claude Code, so cross-tool interop with the emerging AGENTS.md convention is a reasonable expectation for a plugin system this deep. Neither the Function Hooks post nor the GitHub issue mentions it as of this writing — worth tracking, not yet answered.
• "Wont the high entropy thing mess with log files that uses hashses and uuids?" — a garbled but pointed question about whether hash/UUID-heavy output interferes with hook matching or log correlation. Not addressed in the public announcement; a legitimate open question for anyone planning to wire Function Hooks into existing log pipelines.
• "Can we integrate with the enterprise's access control system" — points at the same gap the $ capability-stripping design is meant to solve, but for org-wide RBAC/SSO systems rather than plugin-to-plugin boundaries. Not yet addressed.
• "Nice functionality, awful video - don't speak claudish." and "Not surprised to hear Claudish spoken in the video. Please fix Opus 5. It's hurting everyone, even your video voiceovers." — pointed criticism that the demo voiceover leaned on internal Anthropic jargon ("Claudish") that reads as impenetrable even to developers who'd want this feature. It's a small complaint with a real signal: a company whose own promotional video needs a translator has a communication problem, not just a marketing one. explainx.ai covered the community's own fix for this exact pattern — a plugin that rewrites Claude's jargon-heavy replies into plain English locally via Ollama — and this reaction suggests the jargon habit extends past chat replies into Anthropic's own external comms.

ant apply: declare your agent stack, sync it like infrastructure

The second announcement, posted roughly five hours later on September 4, is less flashy and more immediately useful: ant apply, a new command in the ant CLI (Anthropic's CLI for the Claude API and Claude Managed Agents — distinct from Claude Code's own CLI). @ClaudeDevs' framing: "you can declare Claude Managed Agent environments, agents, skills, memory stores, and deployments as files in your repository and keep the API's resources in sync with them using ant apply."

That's the single most important detail: this is explicitly a declare-desired-state, apply-reconciles pattern, the same shape as terraform apply or kubectl apply. One reply nailed the comparison directly: "Is there a terraform integration so we don't have to build some bespoke thing just for this?" The answer, per the shipped docs at platform.claude.com/docs/en/cli-sdks-libraries/cli/apply, is that Anthropic built the bespoke thing itself, scoped to its own platform rather than wiring into Terraform's provider ecosystem.

What you can declare, and how

A minimal agent file:

---
name: Summarizer
model: claude-opus-5
tools:
  - type: agent_toolset_20260401
---

You are a helpful assistant that writes concise summaries.

Running ant apply agents/summarizer.md in an interactive terminal prints a plan (+ ./agents/summarizer.md create) and waits for y/n/d (details) before touching anything — the same UX pattern as terraform plan followed by confirmation. --dry-run prints the plan and exits without applying.

The state file is the whole mechanism

The first successful apply writes claude-lock.json in the directory you ran it from. It records, per file, the resource's live ID, a version number, and two hashes — one fingerprinting what was last sent, one fingerprinting what the API returned. That's how a later run detects a locally edited file versus a resource that changed out-of-band (edited directly in the Claude Console, for example) — in the latter case, ant apply refuses with "this plan cannot be applied" unless you pass --force.

Resources reference each other by relative file path rather than by ID — an agent's skills: list can point at ../skills/pr-summary, and a deployment's agent: field can point at ./reviewer.md. ant apply resolves the whole directory in dependency order and pins referenced agents/skills to the version it just applied, so editing a shared skill propagates to everything referencing it in the same run. You can also reference a GitHub-hosted skill directory directly (https://github.com/<owner>/<repo>/tree/<branch>/<dir>), pinned to a resolved commit until you pass --upgrade — a path built for pulling from Anthropic's open-source skills repository without vendoring it.

Deleting a file doesn't delete the live resource by default — it just leaves it orphaned with a warning. --prune is the explicit "actually remove what's no longer declared" flag, mirroring Terraform's separation between plan drift and destructive cleanup.

Running it in CI

ant apply without a terminal refuses to guess: it prints the plan and exits with cannot ask for confirmation without a terminal; re-run with --yes to apply, or --dry-run to see the plan only. The documented pattern is ant apply --yes . on your default branch after merge, ant apply --dry-run . on pull requests so reviewers see the diff before merge, and committing the updated lockfile at the end of the job even on a failed apply (a partial apply still creates some resources, and the lockfile needs to reflect that). Anthropic recommends Workload Identity Federation over a static API key for CI auth — ant apply refuses credentials that resolve to a different org or workspace than the one recorded in the lockfile, which closes an obvious "accidentally applied to prod" failure mode.

This is a meaningfully different operating model from the console-driven workflow explainx.ai covered when Anthropic added memory stores and domain controls to the Managed Agents console in August — that update was about making the UI more capable; ant apply is about making the UI optional, by moving the source of truth into your repository where it goes through the same code review as everything else you ship.

The jokes were right there too

Not every reply was substantive. "We gave the ant a CLi. Civilization has peaked" got the most-liked laugh out of the ant name, and "can I get my weekly limit restarted? Thanks" was the now-standard off-topic Claude usage-limit joke that shows up under nearly every Anthropic announcement. Neither changes the technical picture, but both are a reminder that even a genuinely useful infra tool gets read first as a name joke and a limits complaint before anyone reads the docs.

How Function Hooks and ant apply fit together

They're solving adjacent but distinct problems. ant apply is about which resources exist — agents, skills, memory stores, deployments — and keeping the API in sync with a declared list of them. Function Hooks is about what happens during a session — intercepting and rewriting tool calls and UI events in-process. You could plausibly use both together: declare an agent's skills and environment via ant apply, then use Function Hooks (if it ships) to enforce a policy — say, redacting secrets — across every session that agent runs, regardless of which skill triggered the tool call. Anthropic hasn't announced that integration; it's a reasonable inference from the shapes of the two systems, not a confirmed roadmap item.

Both also sit inside a broader pattern explainx.ai has tracked all year: Claude's tooling keeps converging on files-in-a-repo as the interface, whether that's CLAUDE.md, SKILL.md, and hooks as customization primitives, the broader steering surface of Claude Code, or now claude-lock.json doing for Managed Agents what a terraform.tfstate file does for cloud infra. The Claude Code commands reference and subagent/multi-agent workflow guide are worth a re-read with this lens: nearly every extensibility surface Anthropic ships now assumes your configuration lives in version control, not a dashboard.

What to actually do this week

• If you run Claude Managed Agents in production: try ant apply --dry-run . against your current console-configured setup first — it will not adopt existing console-created resources automatically (a gotcha the docs call out explicitly), so plan a deliberate migration rather than running ant apply cold against a live workspace.
• If you have opinions on Function Hooks: leave them on GitHub issue #91870, not in a tweet reply — Anthropic has said this specific thread's response volume and content is what decides whether the feature gets built at all.
• If you maintain a Claude Code plugin today: nothing changes yet. Function Hooks hasn't shipped, and existing shell-command hooks aren't going away in the interim.
• If you want AGENTS.md interop: say so on the issue. It's an unanswered, reasonable ask, and public GitHub feedback is the only channel that's been named for this RFC.

Related reading

• Claude Code Hooks: Automate Actions Before and After Every Tool Call
• Skills vs Hooks vs Prompts: When to Use Each
• Claude Code settings.json Complete Reference
• Claude Code Commands Complete Reference Guide
• Claude Code Subagents and Multi-Agent Workflows
• Claude Managed Agents: Memory and Domain Controls Console Update
• Tobi Threatens Claude Code Ban Over AGENTS.md — Shopify Split-Brain Problem
• Claudish-to-English: The Claude Code Plugin That Rewrites AI Jargon
• Official: Manage resources as code with ant apply
• GitHub issue #91870: Function Hooks - make plugins 10x more powerful

Version details, CLI flags, and feature status reflect Anthropic's public announcements and documentation as of September 4, 2026. Function Hooks is unshipped and may change substantially — or not ship at all — based on feedback in the linked GitHub issue.