Session Start Context Log
Fires once when a session begins and logs the session ID, working directory, and current git branch to the same audit.log the tool-call hook writes to. Pair the two together and you can reconstruct who ran what, where, and when — the actual question an SR 11-7 or SOX change-control review asks.
1. Save this as the hook script
#!/usr/bin/env python3
"""SessionStart hook — records which project, branch, and directory a session
started in, into the same audit.log the PostToolUse hook writes to."""
import json, sys, subprocess, datetime
from pathlib import Path
data = json.load(sys.stdin)
cwd = data.get("cwd", ".")
try:
branch = subprocess.run(["git", "rev-parse", "--abbrev-ref", "HEAD"],
cwd=cwd, capture_output=True, text=True, timeout=5).stdout.strip()
except Exception:
branch = "unknown"
log_path = Path(cwd) / ".claude" / "audit.log"
log_path.parent.mkdir(parents=True, exist_ok=True)
entry = {
"ts": datetime.datetime.utcnow().isoformat() + "Z",
"event": "session_start",
"session_id": data.get("session_id"),
"cwd": cwd,
"git_branch": branch,
}
with open(log_path, "a") as f:
f.write(json.dumps(entry) + "\n")
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/session-start-context-log.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"SessionStart": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/session-start-context-log.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks