SessionStart hook: auto-pull claude-custom main to keep hooks current #164

New issue

Closed

opened 2026-03-26 04:17:36 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-26 04:17:36 +00:00

Contributor

Type

Feature

Lineage

Discovered scope from GroupMe incident remediation (2026-03-25). Hook deployed via PR #163 but didn't fire because local repo was behind Forgejo.

Repo

forgejo_admin/claude-custom

User Story

As platform operator,
I want the SessionStart hook to auto-pull claude-custom main,
So that newly merged hooks and settings.json changes are live on session start without manual git pull.

Context

Incident (2026-03-25): The GroupMe PreToolUse hook (PR #163) merged on Forgejo but the local ~/claude-custom repo hadn't pulled. Session started with stale settings.json — the new mcp__groupme__send_message matcher wasn't loaded. Hook file didn't exist locally. Two messages sent without approval before discovering the gap.

Existing hook: check-claude-custom-clean.sh already runs at SessionStart and checks for uncommitted changes. But it doesn't git pull — it only warns about dirty state.

Fix: Add a git fetch origin && git pull origin main --ff-only step. If the pull fails (diverged branches, dirty state), warn but don't block the session — the existing check-claude-custom-clean.sh already handles that case.

File Targets

Files to modify:

hooks/check-claude-custom-clean.sh — ADD git fetch origin && git pull origin main --ff-only before the dirty-state check. If ff-only fails, log a warning but continue.

Files NOT to touch:

settings.json — no new hook entry needed, reuses existing SessionStart matcher
Other hooks — no changes

Acceptance Criteria

SessionStart hook pulls claude-custom main before checking dirty state
If pull succeeds, session starts with latest hooks and settings.json
If pull fails (diverged, dirty), warns user but does not block session
Existing dirty-state warning still works

Test Expectations

Manual test: merge a PR on Forgejo, start new session, verify hook file appears without manual pull
Manual test: create local uncommitted changes, start session, verify warning appears and pull is skipped/warned
Run command: N/A (SessionStart hooks are tested by starting a session)

Constraints

Must use --ff-only to avoid accidental merge commits in claude-custom
Must not block session on pull failure — warn only
Keep the hook idempotent — multiple runs should be safe

Checklist

PR opened
Tests pass
No unrelated changes

claude-custom#160 — GroupMe incident that exposed this gap
project-pal-e-agency — enforcement architecture

### Type Feature ### Lineage Discovered scope from GroupMe incident remediation (2026-03-25). Hook deployed via PR #163 but didn't fire because local repo was behind Forgejo. ### Repo `forgejo_admin/claude-custom` ### User Story As platform operator, I want the SessionStart hook to auto-pull claude-custom main, So that newly merged hooks and settings.json changes are live on session start without manual git pull. ### Context **Incident (2026-03-25):** The GroupMe PreToolUse hook (PR #163) merged on Forgejo but the local `~/claude-custom` repo hadn't pulled. Session started with stale settings.json — the new `mcp__groupme__send_message` matcher wasn't loaded. Hook file didn't exist locally. Two messages sent without approval before discovering the gap. **Existing hook:** `check-claude-custom-clean.sh` already runs at SessionStart and checks for uncommitted changes. But it doesn't `git pull` — it only warns about dirty state. **Fix:** Add a `git fetch origin && git pull origin main --ff-only` step. If the pull fails (diverged branches, dirty state), warn but don't block the session — the existing `check-claude-custom-clean.sh` already handles that case. ### File Targets Files to modify: - `hooks/check-claude-custom-clean.sh` — ADD `git fetch origin && git pull origin main --ff-only` before the dirty-state check. If ff-only fails, log a warning but continue. Files NOT to touch: - `settings.json` — no new hook entry needed, reuses existing SessionStart matcher - Other hooks — no changes ### Acceptance Criteria - [ ] SessionStart hook pulls claude-custom main before checking dirty state - [ ] If pull succeeds, session starts with latest hooks and settings.json - [ ] If pull fails (diverged, dirty), warns user but does not block session - [ ] Existing dirty-state warning still works ### Test Expectations - [ ] Manual test: merge a PR on Forgejo, start new session, verify hook file appears without manual pull - [ ] Manual test: create local uncommitted changes, start session, verify warning appears and pull is skipped/warned - Run command: N/A (SessionStart hooks are tested by starting a session) ### Constraints - Must use `--ff-only` to avoid accidental merge commits in claude-custom - Must not block session on pull failure — warn only - Keep the hook idempotent — multiple runs should be safe ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `claude-custom#160` — GroupMe incident that exposed this gap - `project-pal-e-agency` — enforcement architecture