[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage. — n/a: no src/ changes; the hook was exercised manually (see below).

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Tooling / security hardening. Claude Code on the web sessions now bootstrap Aikido Safe Chain automatically, as Codespaces and Cursor Cloud Agents already do.

Why

Claude Code cloud sessions don't run .devcontainer/devcontainer.json's postCreateCommand or .cursor/environment.json, so web sessions started with no ~/.safe-chain/shims and no node_modules. AGENTS.md forbids unshimmed pnpm, which left agents unable to install dependencies.

Changes

• .claude/hooks/session-start.sh (new, executable): runs only when CLAUDE_CODE_REMOTE=true, then:
  • runs scripts/setup-cloud-environment.sh from the project root. That script is unchanged: a checksum-pinned Safe Chain --ci install, then pnpm safe-chain-verify and pnpm install --frozen-lockfile.
  • sends the install log to stderr, because hook stdout becomes session context.
  • appends export PATH="$HOME/.safe-chain/shims:$HOME/.safe-chain/bin:$PATH" to $CLAUDE_ENV_FILE, once. Bash tool shells don't re-read ~/.bashrc, so without this pnpm still resolves to the unshimmed binary.
• .claude/settings.json (new): registers the hook as a synchronous SessionStart command with a 600 s timeout.
• .gitignore: .claude becomes .claude/* plus exceptions for settings.json and hooks/. Local state such as settings.local.json stays ignored.
• .github/CODEOWNERS: adds /.claude/, since a SessionStart hook runs commands in every web session.
• SECURITY.md and DEFENSE_IN_DEPTH.md: mention the Claude Code bootstrap.

Validation

• Hook with CLAUDE_CODE_REMOTE unset: exit 0, no output.
• Hook with CLAUDE_CODE_REMOTE=true, run twice: exit 0 both times, empty stdout, a single PATH line in the env file. A warm re-run takes about 4 s. Safe Chain reports OK: Safe-chain works! and the lockfile passes its supply-chain policies.
• With the env file sourced, pnpm resolves to ~/.safe-chain/shims/pnpm.
• pnpm exec biome check src/writr-cache.ts and pnpm exec vitest run test/writr-cache.test.ts (13 tests) both pass through the shims.
• pnpm build passes. pnpm test: Biome made no fixes; 8 files, 189 passed, 1 skipped.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FDGkvwCeXMsedfFUjqSrn9

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T04:21:52.918059Z	01d29c8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (22092ea) to head (3ee339c).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #553   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines          515       515           
  Branches       144       144           
=========================================
  Hits           515       515           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.