Posthook

Line-level AI attribution from Claude Code, Cursor, and Codex CLI, tied back to the commits that shipped.

Posthook is a small CLI that runs on each engineer’s machine. It hooks into the AI coding agents they already use — Claude Code, Cursor, and Codex CLI — and puts a lightweight shadow in front of git, so Bilanc can see both sides of the work: what the agent wrote, and what the engineer committed.

Where the AI Coding Tools connections give you seat- and token-level adoption, posthook gives you attribution: which lines of which commits were written by an agent, by which model, from which session, and what the engineer prompted to get them.

How it works

1. Hooks in each agent’s global config (~/.claude/settings.json, ~/.cursor/hooks.json, ~/.codex/config.toml) record every edit and prompt, with the exact line ranges the agent touched.
2. A git shadow — a git symlink installed ahead of the real binary on PATH — records every commit and clone, on every repo, with no per-repo setup.
3. Everything lands in a local SQLite file at ~/.posthook/posthook.db. Engineers can query it themselves with posthook blame, posthook metrics, and posthook dash.
4. A background sync daemon (launchd on macOS, systemd on Linux) flushes new rows to your Bilanc workspace every few seconds, authenticated with a team install key.

The result appears in the Posthook section of the Bilanc dashboard: org-wide AI share of committed code, per-engineer and per-repo breakdowns, and a session viewer that shows prompts, files touched, and resulting commits.

Requirements

• macOS or Linux on Intel or Apple Silicon / arm64. Windows is not supported yet.
• curl or wget, and git on PATH. Nothing else — the installer downloads a static binary.
• Node.js 24+ is optional, only for the engineer’s local posthook dash web view. Team sync does not need it.

Installing

There are two ways to roll posthook out. Both use the same install link; they differ only in who runs it.

Share a link

Each engineer runs one command in their terminal. Best for teams up to a few dozen people.

MDM deployment

Push the install through Jamf, Kandji, Intune, or any MDM that runs scripts. Recommended for org-wide rollouts.

Get an install link

Who needs to do it: a Bilanc Owner or Manager.

1. Sign in to app.bilanc.co and go to Admin → Connections.

2. Under AI Tools, click Connect on the PostHook card.

3. Click Generate install link and copy the command shown. It looks like this:

   curl -fsSL "https://api.bilanc.co/posthook/install.sh?apiKey=<team-key>" | sh
   

The command embeds your team’s install key, and Bilanc only shows it once. Store it somewhere your team already keeps secrets. If it’s lost, generate a new link and revoke the old one from the same dialog.

The key is org-scoped and write-only. It lets a machine send posthook data into your workspace and nothing else — it is rejected by every Bilanc read API, and engineers do not need Bilanc accounts to install. One key serves the whole team. Revoking it stops sync for every machine that installed with it.

Share a link

Send the command to your engineers. Each of them runs it once in a terminal. The installer:

• downloads the latest release for their OS and CPU, verifies the SHA-256 checksum, and installs it to ~/.local/bin
• writes the team key and endpoint into ~/.posthook/config.json
• runs posthook init, which installs hooks for every agent it detects and sets up the git shadow
• prompts for the engineer’s work email so the dashboard can attribute their sessions (it suggests their git identity as a default)
• installs the background sync daemon and starts it

Engineers verify with posthook status. If ~/.local/bin isn’t ahead of git on their PATH, the installer prints the line to add to their shell profile.

For anything larger than a handful of machines, or where you want the install to happen without engineers doing anything, see MDM deployment.

What gets sent

Team sync is a faithful, append-only replica of the local database. Nothing leaves the machine until an install key is configured, and posthook never phones home in local-only mode.

Table	Contents
Sessions	agent, model, start/end, engineer identity, working directory
Events	every tool call and edit, including the verbatim tool-call payload and the line ranges written
Prompts	the text the engineer typed to the agent (powers the session viewer)
Commits	SHA, repo, author, timestamps, files, for every commit made through the shadow
Attribution	per-line AI / human tags linking commits back to the session and event that produced each line

Prompts and tool payloads can contain source code. If that’s a concern for a particular repository, talk to us about exclusions before rolling out.

Everyday commands

Command	What it does
posthook status	Is everything wired up and capturing? Counts, shadow health, recent activity
posthook identity	Show which email sessions are attributed to. --set-email [e-mail] to change it
posthook sync --status	Pending rows, last flush time and result
posthook service status	Whether the background daemon is installed and running
posthook init	Re-detect agents and reinstall hooks. Safe to re-run at any time
posthook update	Upgrade to the latest release, re-run init, and restart the daemon
posthook blame <file>	Per-line AI vs human attribution for a file
posthook metrics	Local AI share and session stats by agent, model, and repo

Posthook is open source: github.com/Bilanc/posthook.