chore(claude): add safer SessionStart hook (package-manager installs, no piped scripts) (#31)

Adds .claude/hooks/session-start.sh — best-effort, idempotent SessionStart hook provisioning reuse/shellcheck/asciidoctor via package managers only (no piped remote script; the curl-piped variant was safety-blocked). Wired into settings.json, .claude/hooks/ re-tracked in .gitignore, noted in CHANGELOG. shellcheck clean; valid JSON; reuse compliant; estate-rules green (validated locally).

Refs ADR-0005.

Author: hyperpolymath

.claude/hooks/session-start.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# SessionStart hook for Claude Code on the web. Best-effort and idempotent:
+# ensures the lint/compliance tools this repo's checks rely on are present so
+# a fresh session can run scripts/check-*.sh and `reuse lint` without manual
+# setup.
+#
+# Installs ONLY via standard package managers (pip / apt / gem) — there is
+# deliberately no piped remote script (no `curl ... | bash`). Never blocks a
+# session: each step is guarded by a `command -v` probe and trails `|| true`.
+set -u
+
+note() { printf '[session-start] %s\n' "$*"; }
+
+command -v reuse       >/dev/null 2>&1 || { note "installing reuse (pip)";       pip install --quiet reuse        >/dev/null 2>&1 || true; }
+command -v shellcheck  >/dev/null 2>&1 || { note "installing shellcheck (apt)";  apt-get install -y shellcheck    >/dev/null 2>&1 || true; }
+command -v asciidoctor >/dev/null 2>&1 || { note "installing asciidoctor (gem)"; gem install --silent asciidoctor >/dev/null 2>&1 || true; }
+
+have() { command -v "$1" >/dev/null 2>&1 && echo y || echo n; }
+note "tooling present: reuse=$(have reuse) shellcheck=$(have shellcheck) asciidoctor=$(have asciidoctor)"
+note "(the 'just' task runner is not auto-installed here; add it manually if you want recipe shortcuts)"
+exit 0

.claude/settings.json

@@ -15,5 +15,17 @@
       "Bash(just doctor:*)",
       "Bash(jq:*)"
     ]
+  },
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/session-start.sh"
+          }
+        ]
+      }
+    ]
   }
 }

.gitignore

@@ -14,12 +14,13 @@ Thumbs.db
 # Agent & editor scaffolding (standards#68) — local-only, never committed
 # estate-wide. Owner decision 2026-05-16: gitignore per-repo agent/editor
 # config rather than commit it. Updated 2026-05-30: the *shared* Claude
-# config (.claude/settings.json) is now tracked so sessions share a safe
-# permission allowlist; personal local overrides (e.g.
-# .claude/settings.local.json) stay ignored.
+# config (.claude/settings.json + .claude/hooks/) is now tracked so sessions
+# share a permission allowlist and a best-effort tool-provisioning hook;
+# personal local overrides (e.g. .claude/settings.local.json) stay ignored.
 .editorconfig
 .claude/*
 !.claude/settings.json
+!.claude/hooks/
 
 # Build
 /target/

CHANGELOG.md

@@ -14,9 +14,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `LICENSES/` directory (MPL-2.0, AGPL-3.0-or-later) and a root `REUSE.toml`
   declaring licensing for owner-authored files. The project is now fully
   compliant with version 3.3 of the REUSE Specification (`reuse lint` passes).
-- Claude Code project config (`.claude/settings.json`): a permission allowlist
-  for the safe git / reuse / shellcheck / estate-rules commands used to
-  validate this repo, reducing prompts in future sessions.
+- Claude Code project config under `.claude/`: a permission allowlist for the
+  safe git / reuse / shellcheck / estate-rules commands used to validate this
+  repo, plus a best-effort SessionStart hook that provisions the lint tooling
+  (reuse, shellcheck, asciidoctor) via package managers — no piped remote
+  scripts.
 
 ### Changed
 - Repaired the V-language ban check in the `estate-rules` workflow: a