configure-web-session

SessionStart hook for Claude Code web sessions to install tools (helm, terraform, gitleaks, just). Use when CI tools fail in remote sessions due to missing binaries.

Jump to install

Repository: laurigates/claude-plugins
Last source activity: July 18, 2026 at 11:51
Detected SKILL.md language: English
Stars: 49
Forks: 7

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	configure-web-session
description	SessionStart hook for Claude Code web sessions to install tools (helm, terraform, gitleaks, just). Use when CI tools fail in remote sessions due to missing binaries.
allowed-tools	Glob, Grep, Read, Write, Edit, Bash, AskUserQuestion, TodoWrite
args	[--check-only] [--fix] [--tools <list>]
argument-hint	[--check-only] [--fix] [--tools <list>]
created	"2026-02-25T00:00:00.000Z"
modified	"2026-06-21T00:00:00.000Z"
compatibility	claude-code
reviewed	"2026-06-21T00:00:00.000Z"

/configure:web-session

Check and configure a SessionStart hook that installs missing tools when Claude Code runs on the web.

When to Use This Skill

Use this skill when...	Use another approach when...
Pre-commit hooks fail in remote sessions (tool not found)	Project has no infrastructure tooling (plain npm/pip is enough)
`just` recipes fail because `just`, `helm`, `terraform`, or similar are absent	Tools are already available in the base image (check with `check-tools`)
Setting up a new repo for unattended Claude Code on the web tasks	Only need to set env vars — use environment variables in the web UI instead
Auditing whether `scripts/install_pkgs.sh` is current and idempotent	Debugging a specific hook failure — fix the hook itself first
Re-auditing already-onboarded repos for spec drift after the spec changed	The repo was never onboarded — run the full setup instead
Onboarding a repo to Claude Code on the web for the first time	Project uses only standard language runtimes (python, node, go, rust)

Context

Install script: !find . -name 'install_pkgs.sh' -path '*/scripts/*'
Settings hooks: !find . -maxdepth 3 -name 'settings.json' -path '*/.claude/*'
Pre-commit config: !find . -maxdepth 1 -name '.pre-commit-config.yaml'
Justfile: !find . -maxdepth 1 \( -name 'justfile' -o -name 'Justfile' \)
Has helm charts: !find . -maxdepth 3 -name 'Chart.yaml' -print -quit
Has terraform: !find . -maxdepth 3 \( -name '*.tf' -o -type d -name 'terraform' \) -print -quit

Parameters

Parse from $ARGUMENTS:

--check-only: Report current state without creating or modifying files
--fix: Apply all changes automatically without prompting
--tools <list>: Comma-separated list of tool names to install (overrides auto-detection)
- Supported: helm, , , , , , ,

terraform

tflint

actionlint

helm-docs

gitleaks

just

pre-commit

Signal	Tools needed
`.pre-commit-config.yaml` contains `gitleaks`	`gitleaks`, `pre-commit`
`.pre-commit-config.yaml` contains `actionlint`	`actionlint`, `pre-commit`
`.pre-commit-config.yaml` contains `tflint`	`tflint`, `pre-commit`
`.pre-commit-config.yaml` contains `helm`	`helm`, `helm-docs`, `pre-commit`
`Chart.yaml` exists anywhere	`helm`, `helm-docs`
`*.tf` or `terraform/` directory exists	`terraform`, `tflint`
`Justfile` or `justfile` exists	`just`
`--tools` flag provided	Use that list exactly
Any pre-commit hook present	`pre-commit`

Spec item	Drift signal to check
Renovate-managed pins	Each `<TOOL>_VERSION="x.y.z"` line carries a `# renovate: datasource=... depName=...` annotation (Step 3). A bare pin is DRIFT.
Pinned versions current	Each pinned version matches the Step 3 reference. A pin behind reference (e.g. `gitleaks 8.30.0` vs `8.30.1`, `just 1.40.0` vs `1.52.0`) is DRIFT.
`scripts/path-bootstrap.sh` wired first	`path-bootstrap.sh` exists and runs as the first `SessionStart` hook before `install_pkgs.sh` (Step 5). Missing or out-of-order is DRIFT.
Allowlist-safe downloads	No runtime `api.github.com/.../releases/latest` lookups — `api.github.com` is outside the web "Limited" allowlist and breaks the install. A `latest` lookup is DRIFT; replace with a pinned `github.com/.../releases/download/<tag>` URL.
Remote + idempotency guards	The `CLAUDE_CODE_REMOTE` guard and per-tool `command -v` guards are present (Step 4).

Spec item	Status
Renovate pin annotations	PRESENT / DRIFT / ABSENT
Pinned versions vs reference	CURRENT / STALE (list each stale tool)
`path-bootstrap.sh` wired first	PRESENT / DRIFT / ABSENT
Allowlist-safe downloads	OK / USES api.github.com

Tool	Install method	Version source
`pre-commit`	`pip install pre-commit`	latest
`helm`	Official get-helm-3 script from `raw.githubusercontent.com`	latest stable
`terraform`	Binary from `releases.hashicorp.com` (`.zip`)	Pin to `.pre-commit-config.yaml` rev or latest
`tflint`	GitHub release binary (`.zip`)	Pin to `.pre-commit-config.yaml` rev
`actionlint`	GitHub release binary (`.tar.gz`)	Pin to `.pre-commit-config.yaml` rev
`helm-docs`	GitHub release binary (`.tar.gz`)	Pin to `.pre-commit-config.yaml` rev
`gitleaks`	GitHub release binary (`.tar.gz`)	Pin to `.pre-commit-config.yaml` rev
`just`	GitHub release binary (`.tar.gz`)	latest stable

Remote guard — exit immediately if not in a remote session:

if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
  exit 0
fi

Idempotency guard per tool — use command -v <tool> before downloading:

if ! command -v helm >/dev/null 2>&1; then
  # install helm
fi

Install to ~/.local/bin — writable without sudo regardless of whether the session runs as root. Ensure this directory is on the PATH that agent subshells inherit: add it to a path-bootstrap.sh SessionStart hook (see this repo's scripts/path-bootstrap.sh) or append it to $CLAUDE_ENV_FILE. A bare export PATH=... inside the install script does not persist to later tool calls (see .claude/rules/sandbox-guidance.md).

Temp directory cleanup — use a temp dir per download, remove it after:

tmp_dir=$(mktemp -d)
# ... download and extract ...
rm -rf "$tmp_dir"

unzip bootstrap — terraform and tflint ship as .zip; install unzip via apt if absent.
One install block per tool in this order: pre-commit, helm, terraform, tflint, actionlint, helm-docs, gitleaks, just.

"hooks": {
  "SessionStart": [
    {
      "matcher": "",
      "hooks": [
        {
          "type": "command",
          "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/install_pkgs.sh\""
        }
      ]
    }
  ]
}

Web session configuration complete
===================================
scripts/install_pkgs.sh  [CREATED/UPDATED]
.claude/settings.json    [CREATED/UPDATED]

Tools configured: helm, terraform, tflint, actionlint, gitleaks, just, pre-commit

Next steps:
1. Commit both files: git add scripts/install_pkgs.sh .claude/settings.json
2. Smoke-test locally: CLAUDE_CODE_REMOTE=true bash scripts/install_pkgs.sh
3. Run again to verify idempotency: CLAUDE_CODE_REMOTE=true bash scripts/install_pkgs.sh
4. Start a remote session on claude.ai/code and confirm tools are available

# Discover onboarded repos under a portfolio root (each has scripts/install_pkgs.sh)
find . -maxdepth 3 -path '*/scripts/install_pkgs.sh' -print | while read -r script; do
  repo_dir=$(dirname "$(dirname "$script")")
  echo "=== ${repo_dir} ==="
  # Re-audit against the current spec (Step 2b drift checks)
  grep -q 'renovate:' "$script" && echo "renovate-pins: PRESENT" || echo "renovate-pins: DRIFT"
  find "${repo_dir}/scripts" -maxdepth 1 -name 'path-bootstrap.sh' -print -quit | grep -q . \
    && echo "path-bootstrap: PRESENT" || echo "path-bootstrap: ABSENT"
  grep -q 'api.github.com' "$script" && echo "allowlist: USES api.github.com (DRIFT)" || echo "allowlist: OK"
done

Context	Command
Check only (CI audit)	`/configure:web-session --check-only`
Auto-fix with detected tools	`/configure:web-session --fix`
Override tool list	`/configure:web-session --fix --tools helm,terraform,gitleaks`
Smoke-test install script	`CLAUDE_CODE_REMOTE=true bash scripts/install_pkgs.sh`
Verify idempotency	`CLAUDE_CODE_REMOTE=true bash scripts/install_pkgs.sh` (run twice)
Drift re-audit (onboarded repo)	`/configure:web-session --check-only`
Portfolio sweep for spec drift	`find . -maxdepth 3 -path '*/scripts/install_pkgs.sh'` then re-audit each