Add whole-string quoting rule to bash style guide

.claude/hooks/shellcheck.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -E -o errexit -o nounset -o pipefail
+
+# Exit silently if required tools are missing
+command -v shellcheck > /dev/null 2>&1 || exit 0
+command -v file > /dev/null 2>&1 || exit 0
+command -v jq > /dev/null 2>&1 || exit 0
+
+input=$(cat)
+file_path=$(printf '%s' "$input" | jq -r '.tool_input.file_path // empty')
+
+[[ -z "$file_path" || ! -f "$file_path" ]] && exit 0
+
+file_type=$(file --brief "$file_path")
+case "$file_type" in
+  *"Bourne-Again shell"*|*"bash"*|*"/bin/bash"*) ;;
+  *"shell script"*|*"/bin/sh"*) ;;
+  *) exit 0 ;;
+esac
+
+shellcheck --format=gcc "$file_path" >&2

.claude/rules/bash-style.md

@@ -48,6 +48,7 @@ function do_thing() {
 - `(( ))` for arithmetic comparisons
 - `$(command)` for substitution, never backticks
 - Double quotes around expansions: `"$var"`, `"${array[@]}"`
+- Quote the whole string, not just the variable: `"$HOME/.local/bin"` not `"$HOME"/.local/bin`
 - Single quotes for literals that must not expand
 - `printf` over `echo` when output contains escapes or format strings
 

.claude/settings.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".claude/hooks/shellcheck.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

.shellcheckrc

@@ -0,0 +1,12 @@
+# Default shell for sourced files without shebang (SC2148)
+shell=bash
+
+# Sourced files define variables used by other files after source
+disable=SC2034
+
+# Non-constant and external source paths are intentional
+disable=SC1090
+disable=SC1091
+
+# Functions invoked indirectly via trap/callback
+disable=SC2317

CLAUDE.md

@@ -54,3 +54,4 @@ Installers (`install/*.sh`) MUST be idempotent — check before installing.
 ## Commits
 
 Do not add `Co-Authored-By` lines to commit messages.
+Prefer one-line commit messages. Add a longer description only when necessary for better understanding.

rc/claude-code.sh

@@ -1 +1 @@
-append_path_try $HOME/.local/bin
+append_path_try "$HOME/.local/bin"

rc/enhancd.sh

@@ -1,7 +1,7 @@
-_INIT_FILE=$WORKSPACE/opt/enhancd/init.sh
+_INIT_FILE="$WORKSPACE/opt/enhancd/init.sh"
 
 if [[ -f $_INIT_FILE ]]; then
-  source $_INIT_FILE
+  source "$_INIT_FILE"
   unalias cd
   alias ecd="__enhancd::cd"
 fi

rc/gocryptfs.sh

@@ -1,12 +1,12 @@
 
-CRYPTED_DIR=$HOME/Sync/safe
-DECRYPTED_DIR=$HOME/mnt/safe
+CRYPTED_DIR="$HOME/Sync/safe"
+DECRYPTED_DIR="$HOME/mnt/safe"
 
 function safe-mount() {
-  gocryptfs $CRYPTED_DIR $DECRYPTED_DIR
+  gocryptfs "$CRYPTED_DIR" "$DECRYPTED_DIR"
 }
 
 function safe-unmount() {
-  fusermount -u $DECRYPTED_DIR
+  fusermount -u "$DECRYPTED_DIR"
 }
 

rc/version.sh

@@ -1 +1 @@
-$WORKSPACE/scripts/changes.sh
+"$WORKSPACE/scripts/changes.sh"