* chore(claude): session-start and pre-bash hooks, deny .env reads
scripts/claude-hook.mjs, wired in .claude/settings.json:
- SessionStart warns when core.hooksPath is not .githooks, so a clone or a
new machine cannot silently run without the repo git hooks.
- PreToolUse on Bash refuses a top-level cd: the tool's shell is persistent,
so a cd leaks into every later command and a gate can report green from
the wrong directory. Subshells, git -C and root-relative paths pass.
permissions.deny gains Read(**/.env): the gitignored env files never enter
the model's context. Server/.env.example stays readable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwaz4CHGAz85Rpypjvto5a
* chore(lint): durationcheck on the server, noImplicitOverride on the client
Both measured at zero hits on dev, so they cost nothing today and only
block regressions: a Duration multiplied by a Duration-typed value, and an
override left behind when its base method is renamed.
rowserrcheck and sqlclosecheck were measured too and rejected: their six
production hits are all correct code (rows.Err is checked inside
scanEventRows behind the rowsScanner interface; the three Close sites close
on every path by hand).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwaz4CHGAz85Rpypjvto5a
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
