
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
hookflow-cli
Advanced tools
Agent hook workflow engine - run GitHub Actions-like workflows triggered by Copilot hooks
Local workflow engine for agentic DevOps - run GitHub Actions-like workflows triggered by Copilot agent hooks.
npm install -g hookflow
Or with other package managers:
# Go
go install github.com/htekdev/hookflow/cmd/hookflow@latest
# Direct download
curl -sSL https://raw.githubusercontent.com/htekdev/hookflow/main/scripts/install.sh | sh
# Initialize hookflow in your repo
cd your-project
hookflow init
# Create a workflow using AI
hookflow create "block edits to .env files"
# Test a workflow with a mock event
hookflow test --event commit --workflow lint.yml
# List workflows
hookflow discover
hookflow lets you run "shift-left" DevOps checks during AI agent editing sessions. Instead of waiting for CI to catch issues on pull requests, you can:
| Command | Description |
|---|---|
init | Initialize hookflow for a repository |
create <prompt> | Create a workflow using AI (Copilot SDK) |
shift left | Analyze CI workflows and suggest hooks |
shift right | Generate GitHub Actions from hooks |
discover | List workflows in the current repository |
validate | Validate workflow YAML files |
test | Test a workflow with a mock event |
run | Run workflows (used by hooks) |
version | Show version information |
Workflows use a GitHub Actions-like syntax:
name: Block .env edits
description: Prevent modifications to environment files
on:
file:
paths:
- '**/.env*'
- '**/secrets/**'
steps:
- name: Block sensitive file edit
run: |
echo "Blocked: Cannot modify sensitive files"
exit 1
MIT
FAQs
Agent hook workflow engine - run GitHub Actions-like workflows triggered by Copilot hooks
We found that hookflow-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.