feat(shared-vault-sync): sync the nested devops-shared-vault subrepo

Detection order is now SHARED_VAULT_DIR, then $PWD, then $PWD/Areas/DevOps
(the nested shared subrepo inside the personal vault). Bump to 0.1.1.

Co-Authored-By: Claude <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -18,7 +18,7 @@
       "name": "shared-vault-sync",
       "source": "./plugins/shared-vault-sync",
       "description": "Safely pulls the shared vault at session start.",
-      "version": "0.1.0"
+      "version": "0.1.1"
     }
   ]
 }

plugins/shared-vault-sync/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "shared-vault-sync",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Safely pulls the shared vault at interactive session start.",
   "author": { "name": "Senkensha" },
   "hooks": "./hooks/claude-codex-hooks.json"

plugins/shared-vault-sync/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "shared-vault-sync",
-  "version": "0.1.0",
+  "version": "0.1.1+codex.20260901101401",
   "description": "Safely pulls the shared vault at interactive session start.",
   "author": {
     "name": "Local developer"

plugins/shared-vault-sync/README.md

@@ -2,7 +2,12 @@
 
 Pulls a clean shared vault at `SessionStart` without blocking Claude Code or Codex when the network is unavailable.
 
-Set `SHARED_VAULT_DIR` to the vault directory to sync it from any working directory. Without it, the hook acts only when the session starts inside a repository whose `AGENTS.md` identifies it as the shared persistent vault.
+Target detection, in order:
+1. `SHARED_VAULT_DIR` — explicit override (e.g. the `devops-shared-vault` clone path).
+2. `$PWD` — when the session starts inside the shared vault itself.
+3. `$PWD/Areas/DevOps` — the nested shared subrepo inside the personal vault.
+
+A directory is treated as the shared vault only if its `AGENTS.md` contains the marker `This is the shared persistent vault` and it is inside a git work tree.
 
 The hook skips a dirty worktree and uses `git pull --ff-only`; it never rebases, merges, or pushes.
 

plugins/shared-vault-sync/hooks/pull-shared-vault.sh

@@ -2,16 +2,33 @@
 # Pull only the designated shared vault; never block a new agent session.
 set -u
 
-vault_dir="${SHARED_VAULT_DIR:-${PWD:-}}"
-
 emit() {
   printf '{"continue":true,"suppressOutput":true,"hookSpecificOutput":{"additionalContext":"%s"}}\n' "$1"
 }
 
-if [ ! -f "$vault_dir/AGENTS.md" ] || ! grep -Fq 'This is the shared persistent vault' "$vault_dir/AGENTS.md" || ! git -C "$vault_dir" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+is_shared_vault() {
-  emit 'Shared vault sync skipped: set SHARED_VAULT_DIR or start the session from the shared vault.'
+  [ -f "$1/AGENTS.md" ] \
+    && grep -Fq 'This is the shared persistent vault' "$1/AGENTS.md" \
+    && git -C "$1" rev-parse --is-inside-work-tree >/dev/null 2>&1
+}
+
+detect_vault() {
+  # explicit override wins
+  if [ -n "${SHARED_VAULT_DIR:-}" ]; then
+    is_shared_vault "$SHARED_VAULT_DIR" && { printf '%s' "$SHARED_VAULT_DIR"; return 0; }
+    return 1
+  fi
+  # session started inside the shared vault itself
+  if is_shared_vault "${PWD:-}"; then printf '%s' "${PWD:-}"; return 0; fi
+  # nested shared subrepo relative to the session dir (e.g. personal vault's Areas/DevOps)
+  if is_shared_vault "${PWD:-}/Areas/DevOps"; then printf '%s' "${PWD:-}/Areas/DevOps"; return 0; fi
+  return 1
+}
+
+vault_dir="$(detect_vault)" || {
+  emit 'Shared vault sync skipped: no shared vault detected (set SHARED_VAULT_DIR, or start the session from the shared vault or its Areas/DevOps subrepo).'
   exit 0
-fi
+}
 
 if [ -n "$(git -C "$vault_dir" status --porcelain)" ]; then
   emit 'Shared vault sync skipped: the worktree has local changes.'