Fresh install activates Claude name-guard hook before workspace linking supplies its target #237

On a fresh workstation, openRepoTools --install writes Claude hooks before workspace initialization provides the executable path those hooks call. Please fix this in openRepoTools; workBenches will consume the corrected upstream pin rather than patching its vendored copy.

Upstream implementation request for workBenches #107. Brett requested this issue on 2026-10-17 while preparing workBenches 1.5.1. This report requests tracking and a fix here; no implementation approach has been selected.

Current behavior

The installer merges these entries into bare-user ~/.claude/settings.json:

• SessionStart: ~/projects/xFactory/lanes-edit.sh session-start || true
• UserPromptSubmit: ~/projects/xFactory/lanes-edit.sh guard

Before openRepoTools wip init creates workspace configuration and link-estates provides the link, the target may not exist. The same window occurs if setup is interrupted between tool installation and workspace initialization. The SessionStart suffix suppresses its failure; the name guard can emit a command-not-found hook error on every prompt (exit 127 rather than its intended guard refusal, exit 2).

workBenches deliberately installs the command before running its wip init subcommand, so simply swapping the caller's setup order does not solve the dependency. Its current vendored openRepoTools pin is b1015f4672f9c107d939803c39846f8dbd3d78f3; the inspected upstream checkout also retains these hook command strings. No fresh runtime reproduction was performed for this upstream filing; the original report and current source inspection establish the path dependency.

Reproduction to cover

1. Use a disposable home with no workspace configuration and no ~/projects/xFactory/lanes-edit.sh link.
2. Run the installer with its supported prerequisites and payload.
3. Inspect the installed Claude hook entries and invoke the prompt hook before workspace initialization.
4. Initialize/link the workspace, then verify hooks work and real guard refusals still propagate.
5. Repeat with setup interrupted before initialization and with a dangling workspace link.

Expected result and constraints

• Fresh and interrupted setup must not leave a prompt hook calling a nonexistent executable.
• Once workspace initialization completes, required hooks are active and idempotent without manual settings repair.
• Preserve the intended name-guard enforcement, including exit 2 for real refusals. Do not append blanket || true to the guard.
• Keep openRepoTools as the sole installer/settings writer and reconcile the solution with its exact-string hook identity, conflict detection, and all-or-nothing install contract.
• Preserve unrelated user hooks/settings and private file modes; cover existing installs and migration of previously installed canonical entries.
• Add hermetic regressions for fresh install, interruption, successful initialization, repeat install, conflicts, and genuine guard rejection.

Possible approaches include deferring hook activation until successful workspace linking or using an upstream-owned stable hook entry point. Choose the approach in openRepoTools and document any contract change explicitly.

Downstream follow-up

After the upstream fix lands, workBenches should deliberately update its vendored pin and run estate/workspace installation and launcher acceptance. Keep workBenches #107 open to track that integration; filing this issue does not mean the defect is fixed or included in a published patch.