Add session-logger hook for durable session notes

[karanb192]

Summary

Adds a new hook — session-logger — that writes a human-readable markdown log of every Claude Code session: timestamps, cwd, git repo/branch, files touched, and bash commands run.

The repo's own CONTRIBUTING.md and README have had session-summary on the "Ideas for new hooks" list since day one. This ships it, scoped more broadly as a full session logger (covers start, during, and end of session).

Why

Claude Code sessions are ephemeral. You finish a session, switch repos, and two days later can't remember which session touched which file or ran which command. This hook gives you a durable, greppable (and Obsidian-friendly) record.

What it does

• SessionStart → creates a new note at <log-dir>/YYYY-MM-DD_HHmm_<sid-short>.md with YAML frontmatter (session_id, cwd, git_repo, git_branch, started, ended) and two pre-seeded sections: Files Touched and Commands Run.
• PostToolUse (Edit | Write | Read | Bash) → appends an entry to the right section.
• SessionEnd → fills in ended: in frontmatter and appends a final git status.

Design choices

• Register against SessionEnd, not Stop. Stop fires at the end of every Claude turn (many times per session); SessionEnd fires once when the session actually ends. The handler is also idempotent — if ended: is already filled, it no-ops, so accidentally registering against Stop is harmless.
• Abrupt terminal close is safe. PostToolUse writes synchronously during the session, so if the terminal is killed before SessionEnd fires, all activity up to the last tool call is preserved — the note just doesn't get a final ended: timestamp.
• Single script, three registrations — one file to install, dispatches on hook_event_name.
• Filename format YYYY-MM-DD_HHmm_<sid-short>.md — chronologically sortable in any file explorer, greppable by session id suffix.
• Session resume handling — on duplicate SessionStart with the same id, appends a Resumed at marker rather than overwriting.
• Bash safety — commands are truncated to the first line (200 chars) to avoid logging multi-line command bodies that may contain secrets.
• Configurable path — top-of-file SESSION_LOG_DIR constant (matches the existing SAFETY_LEVEL pattern), overridable via CC_SESSION_LOG_DIR env var. Point it at an Obsidian vault or iCloud folder for cross-device sync.
• Graceful errors — malformed JSON, missing files, non-git paths all fall through to {} output.

Changes

• hook-scripts/session/session-logger.js — new hook (~195 LOC).
• hook-scripts/tests/session/session-logger.test.js — 20 new tests, all passing (includes an explicit regression test that Stop events do not finalize the note, and an idempotency test for duplicate SessionEnd).
• README.md — added the new "Session" section to the hooks table, removed session-summary from the Ideas list (it's now shipped), bumped test badge 262 → 282.

Test plan

• node --test hook-scripts/tests/session/session-logger.test.js — 20/20 pass.
• npm test — 280/282 pass (the 2 failures are pre-existing notify-permission SLACK_WEBHOOK env issues on main, unrelated to this PR — verified by stashing untracked changes and re-running).
• Manual smoke test in a live Claude Code session — recommended before merge.

---

Update — review fixes (commit Serialize concurrent note writes + redact inline secrets)

Addressed two issues found in review, plus nits:

• Concurrency (bug): with PostToolUse "async": true, parallel tool calls invoke the script concurrently and the read-modify-write lost entries (reproduced ~2/10 dropped under 10 parallel calls). All note writes now go through a cross-process lockfile (withLock) with stale-lock stealing. Verified 20/20 concurrent entries preserved, no leftover .lock files.
• Secrets: single-line truncation didn't protect inline single-line secrets. Added best-effort redactSecrets() over bash commands (sensitive env assignments, --password/--token flags, Bearer tokens, well-known key prefixes like ghp_, xox…, sk-, AKIA…). Conservative — leaves ordinary commands like cp -pr untouched. Header/README wording corrected to be honest that this is best-effort, not a guarantee.
• Nits: fixed the no-op .filter(l => l !== null), aligned the ended: regex between check and replace, corrected the file header (SessionEnd, not Stop).

Tests: +6 (redaction unit + e2e, concurrency no-lost-updates) → 288 total, badge bumped. npm test → 286/288 (the 2 failures are the pre-existing notify-permission webhook-env tests on main, unrelated).