Fix hook wiring so permission-approval hooks actually run

[dirkraft]

Noticed this while trying to figure out what the "hooks" mentioned in the README's install snippet actually are — the term appears exactly once and isn't explained anywhere. Tracing it into plugins/*/hooks/ turned up wiring bugs, so opening as a draft in case it's useful.

The problem

Three of the four permission-approval hooks were registered incorrectly, so asta and bd commands were never auto-approved — users got prompted for them every session, which is exactly what these hooks exist to prevent.

Two independent regressions:

PR	What happened
#80 (plugin reorganization)	Created plugins/asta-flows/hooks/hooks.json referencing approve-asta-bash.sh, but only copied approve-bd-bash.sh into that plugin. The referenced script doesn't exist there, so bd auto-approval never fired.
#81 (Fix pdf-download location)	Dropped the entire Bash matcher block from plugins/asta-tools/hooks/hooks.json as unrelated collateral (13 ------------- in a PDF-path commit), orphaning approve-asta-bash.sh.

Before #80, asta-preview/hooks/hooks.json correctly wired all three scripts, so this is a regression rather than something that never worked.

Fixes

• asta-flows/hooks.json now references approve-bd-bash.sh.
• asta-tools/hooks.json re-registers approve-asta-bash.sh under a Bash matcher.
• Removed plugins/asta-tools/hooks/approve-bd-bash.sh — a byte-identical leftover of the Plugin reorganization #80 split. bd is only used by asta-flows skills, and tests/test_hooks.py already treats the asta-flows copy as canonical. Flagging this one since it's a deletion — happy to keep it if you'd rather asta-tools also approve bd.

Prevention

tests/test_hooks.py only checked that scripts exist and behave correctly — it never checked that hooks.json commands resolve to real files, which is how both bugs shipped green.

New test_hooks_json_commands_resolve walks every plugins/*/hooks/hooks.json and asserts:

1. each ${CLAUDE_PLUGIN_ROOT}-relative command resolves to an existing, executable script;
2. no *.sh in a hooks dir is left unregistered (catches the orphan case).

Verified it fails on each of the two bugs independently:

AssertionError: plugins/asta-flows/hooks/hooks.json (PermissionRequest) references missing script: /hooks/approve-asta-bash.sh
AssertionError: plugins/asta-tools/hooks/approve-asta-bash.sh is not registered in plugins/asta-tools/hooks/hooks.json

Also: CI's shellcheck scandir covered ./plugins/asta-tools/hooks but not ./plugins/asta-flows/hooks, so the latter was unlinted. Added it.

Testing

191 passed (full suite), make lint and make format-check clean. shellcheck isn't installed locally, but the newly-scanned asta-flows/approve-bd-bash.sh is byte-identical to the asta-tools copy that was already passing CI.

Not addressed

Two doc gaps I noticed but left alone, since fixing them means writing docs rather than code — happy to follow up:

• README.md:37 is the only mention of "hooks" in the README, with no explanation of what they do.
• DEVELOPER.md:114 links to docs/plugins.md for "Authoring skills and hooks", but there's no docs/ directory in the repo.

🤖 Generated with Claude Code