diff --git a/.claude/settings.json b/.claude/settings.json
index a17e1dd3..cbba8a59 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -52,6 +52,10 @@
             "type": "command",
             "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/path-bootstrap.sh\"",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/install_pkgs.sh\""
           }
         ]
       }
diff --git a/scripts/install_pkgs.sh b/scripts/install_pkgs.sh
new file mode 100755
index 00000000..95b11b0d
--- /dev/null
+++ b/scripts/install_pkgs.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# SessionStart hook: install development tools when running in Claude Code on the web.
+# Idempotent: each tool is skipped if already on PATH.
+# Generated by /configure-plugin:configure-web-session.
+set -euo pipefail
+
+if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
+  echo "[install_pkgs] Not a remote environment, skipping."
+  exit 0
+fi
+
+INSTALL_DIR="/usr/local/bin"
+
+has() { command -v "$1" >/dev/null 2>&1; }
+
+# --- pre-commit (via pip) ---
+if ! has pre-commit; then
+  echo "[install_pkgs] Installing pre-commit..."
+  pip install --quiet pre-commit
+else
+  echo "[install_pkgs] pre-commit already installed, skipping."
+fi
+
+# --- gitleaks 8.24.0 (pinned to .pre-commit-config.yaml) ---
+GITLEAKS_VERSION="8.24.0"
+if ! has gitleaks; then
+  echo "[install_pkgs] Installing gitleaks ${GITLEAKS_VERSION}..."
+  tmpdir=$(mktemp -d)
+  curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C "${tmpdir}" gitleaks
+  mv "${tmpdir}/gitleaks" "${INSTALL_DIR}/gitleaks"
+  chmod +x "${INSTALL_DIR}/gitleaks"
+  rm -rf "${tmpdir}"
+else
+  echo "[install_pkgs] gitleaks already installed, skipping."
+fi
+
+# --- just 1.40.0 ---
+JUST_VERSION="1.40.0"
+if ! has just; then
+  echo "[install_pkgs] Installing just ${JUST_VERSION}..."
+  tmpdir=$(mktemp -d)
+  curl -fsSL "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz" | tar xz -C "${tmpdir}" just
+  mv "${tmpdir}/just" "${INSTALL_DIR}/just"
+  chmod +x "${INSTALL_DIR}/just"
+  rm -rf "${tmpdir}"
+else
+  echo "[install_pkgs] just already installed, skipping."
+fi
+
+# --- Summary ---
+echo "[install_pkgs] Done. Available tools:"
+for cmd in pre-commit gitleaks just ; do
+  if has "$cmd"; then
+    echo "  $cmd: $(command -v "$cmd")"
+  else
+    echo "  $cmd: NOT FOUND (install failed)"
+  fi
+done