feat: sync shared vault at session start

plugins/shared-vault-sync/hooks/claude-codex-hooks.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/pull-shared-vault.sh\"",
+            "timeout": 15,
+            "statusMessage": "Synchronizing shared vault..."
+          }
+        ]
+      }
+    ]
+  }
+}

plugins/shared-vault-sync/hooks/pull-shared-vault.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Pull only the designated shared vault; never block a new agent session.
+set -u
+
+vault_dir="${SHARED_VAULT_DIR:-${PWD:-}}"
+
+emit() {
+  printf '{"continue":true,"suppressOutput":true,"hookSpecificOutput":{"additionalContext":"%s"}}\n' "$1"
+}
+
+if [ ! -f "$vault_dir/AGENTS.md" ] || ! grep -Fq 'This is the shared persistent vault' "$vault_dir/AGENTS.md" || ! git -C "$vault_dir" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  emit 'Shared vault sync skipped: set SHARED_VAULT_DIR or start the session from the shared vault.'
+  exit 0
+fi
+
+if [ -n "$(git -C "$vault_dir" status --porcelain)" ]; then
+  emit 'Shared vault sync skipped: the worktree has local changes.'
+  exit 0
+fi
+
+if GIT_TERMINAL_PROMPT=0 git -C "$vault_dir" pull --ff-only --quiet; then
+  emit 'Shared vault sync completed.'
+else
+  emit 'Shared vault sync failed; run git pull --ff-only from the vault when it is safe to do so.'
+fi