session-start: re-copy the Stop hook when the setup script did not (infra#112)

[bdelanghe]

Row 3 of #85's table, closed the way #84 closed row 2. The setup script's cp of stop-hook-git-check.sh had gone missing along with its register-mcp.mjs call, so the dispatcher now re-copies it.

Measured 2026-08-01 in this container:

d124f7e8844ce1bd…  .claude/stop-hook-git-check.sh          5458 bytes   (matches SUM_stop_hook_git_check_sh)
1e1c49718621d862…  /root/.claude/stop-hook-git-check.sh    3262 bytes   (the platform's stock hook)

Why this one outlasted the MCP break

It fails quietly. The stock hook scopes its check to origin/<branch>..HEAD, which after a squash merge includes GitHub's own merge commit — so it warns "Unverified" after every successful merge and advises an --amend that would rewrite already-merged history.

Nothing looks broken, so nothing gets investigated. And a hook that cries wolf on every merge is worse than no hook, because it teaches you to ignore the one time it is right. #84's warning predicted this — "a field that has stopped calling register-mcp.mjs has probably stopped doing the rest of its job too" — and it was correct.

Design notes

• Compares bytes, not presence. The failure here is a wrong file, not a missing one, so an [ -f ]-style check would have reported this session healthy. stopHookAction is a pure function over the two files' bytes and is tested directly.
• Only the script is replaced. launcher-settings.json declares the Stop hook, is platform-managed, and gets rewritten — so the dispatcher swaps the file it already points at rather than touching the wiring.
• Late is not too late. Hooks are invoked per event, so a copy written during SessionStart is in force from that session's first Stop. Unlike the MCP case there was no ordering claim to disprove.
• homedir() is correct here and wrong for the session root: /root/.claude really is where the user settings live while the repos are under /home/user. That asymmetry is what sessionRootFrom exists for, so the comment says explicitly not to "fix" one to match the other.
• Degrades like the rest of the file. The bootstrap verifies each fetched file independently, so a refused digest can leave the dispatcher present and this one absent. That case is reported and leaves the platform's hook intact rather than overwriting it with an empty file.

Verification

• 116 tests pass across the six suites the schema job runs.
• 8 new tests: the three stopHookAction cases, plus real-fs runs covering replace-the-stock-hook, executable mode, target directory created, re-run is a no-op, and a missing source leaving the installed hook byte-identical. One further test asserts against this repo's actual file, so a rename or move fails rather than passing against a fixture — which is exactly how the setup script's copy failed.
• End-to-end against a scratch session root: stock hook in place → replaced with the 5458-byte copy at mode 755, warning on stderr; re-run → silent.

Not fixed here

The setup-script field itself, and the two remaining rows of #85. The CLAUDE_SESSION_ROOT prefix is benign with .github attached, and the settings.json write is the irreducible bootstrap — the hook that would self-heal it is the thing being installed. See the comment on #85 for why the field can't be CI-owned, and for the server-managed-settings route that might remove it entirely.

---

Generated by Claude Code