bug(claude-code): supported hook setup omits required jq and curl dependencies

[dnlrsls]

📝 Bug Description

The supported complete Claude Code plugin setup does not declare or verify the jq and curl executables required by its shared Bash hooks. Multiple hooks parse JSON with jq and send requests through engram_curl, which invokes external curl.

When either executable is unavailable, the hooks fail open. For SessionEnd, that means the process exits successfully without posting /sessions/{id}/end, leaving sessions.ended_at unset even though the documented setup completed successfully.

🔄 Steps to Reproduce

1. Install Engram and run the documented supported setup with engram setup claude-code.
2. Run Claude Code in a supported Bash environment where jq or curl is unavailable on PATH.
3. Start and end a Claude Code session so the SessionEnd hook executes.
4. Inspect the corresponding Engram session.

✅ Expected Behavior

The supported setup should establish every runtime dependency needed by Claude Code hooks. It should either declare and verify the required executables or use a self-contained Engram entrypoint so session closure works after a successful setup.

❌ Actual Behavior

Setup completes without checking or declaring jq and curl. The hook then exits successfully without closing the session when either command is missing, and sessions.ended_at remains unset.

Operating System

Windows

Engram Version

main-5d5bf835

Agent / Client

Claude Code

📋 Relevant Logs

No output is emitted because the hook is intentionally fail-open and suppresses transport errors.

💡 Additional Context

The problem predates PR #1132 and affects the shared Claude hook adapter boundary, not only SessionEnd. The Engram binary documentation states that the binary has no runtime dependencies, while the supported complete Claude setup names the Engram binary and Bash behavior but does not establish the external JSON and HTTP tools used by the hooks.

This issue should make one plugin-wide product and architecture decision:

1. Explicitly declare and verify or install bash, jq, and curl for supported hook setups, including Windows behavior; or
2. Add a dependency-free Engram core entrypoint for hook JSON and HTTP operations, then keep shell adapters thin.

PR #1132 intentionally did not expand into this redesign because it addressed the separate Stop-to-SessionEnd lifecycle defect from #1118.

[Kallheset]

Additional occurrence on native Windows (observed evidence)

• OS: Windows 11, Claude Code desktop app, Git Bash as the hook shell
• Engram v2.0.0-rc.8; Claude Code plugin 0.1.2 build that still closes sessions on Stop (predates fix(plugin): close Claude sessions on SessionEnd #1132)
• jq absent from the hook shell PATH (jq: command not found); curl present

Observed:

• session-start.sh fails open too: SESSION_ID parses empty, so POST /sessions never runs. The store had 1,906 sessions and none carried a Claude Code session id; GET /sessions/<active-claude-session-id> returned session not found.
• The close hook exits early for the same reason; the most recent ended_at in the whole store was about seven weeks old.
• Nothing surfaces to the user (no hook output, no doctor finding) while the MCP tools keep working, so the gap only showed up indirectly: on rc.8 (before fix(store): bound active runtime sessions by recent activity #1102), mem_save and mem_session_summary failed with multiple active runtime sessions match the current project and directory, because other clients had also left sessions open.

Workaround: installing jq (winget install jqlang.jq, 1.8.2) makes the hook JSON parsing return the session id. Not yet re-verified end to end after restarting Claude Code.

On Windows the missing dependency turned the whole Claude Code session lifecycle into a silent no-op, not only SessionEnd, which supports option 2 (a dependency-free entrypoint) or at least a setup-time check.