Fix Windows hook migration dedupe

Normalize hook command separators before matching Impeccable-owned entries so updates replace legacy Windows guards instead of duplicating them.\n\nAI assistance: Codex implemented and validated this change under maintainer authorization.

cli/bin/commands/skills.mjs

@@ -1534,7 +1534,8 @@ function hookInstalledForProvider(root, provider) {
 
 function valueHasImpeccableHookMarker(value) {
   if (typeof value === 'string') {
-    return IMPECCABLE_HOOK_COMMAND_MARKERS.some(marker => value.includes(marker));
+    const normalized = value.replace(/\\/g, '/');
+    return IMPECCABLE_HOOK_COMMAND_MARKERS.some(marker => normalized.includes(marker));
   }
   if (Array.isArray(value)) return value.some(valueHasImpeccableHookMarker);
   if (value && typeof value === 'object') {

scripts/smoke-provider-hooks.mjs

@@ -12,8 +12,6 @@ import { homedir, tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { parseArgs } from './lib/cli-args.mjs';
-
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const prRoot = resolve(__dirname, '..');
 const defaultBundle = join(prRoot, 'dist', 'universal.zip');
@@ -34,60 +32,31 @@ if (args.help || args.h || !args.repo) {
   process.exit(1);
 }
 
-const targetRepo = resolve(legacySmokeArg(args.repo));
-const bundlePath = resolve(legacySmokeArg(args.bundle) || defaultBundle);
-const selectedProviders = (legacySmokeArg(args.providers) || defaultProviders.join(','))
+const targetRepo = resolve(args.repo);
+const bundlePath = resolve(args.bundle || defaultBundle);
+const selectedProviders = (args.providers || defaultProviders.join(','))
   .split(',')
   .map((provider) => provider.trim().toLowerCase())
   .filter(Boolean);
 const smokeDir = join(targetRepo, '.impeccable', 'provider-smoke');
 const summaryPath = join(smokeDir, 'summary.json');
-const directSmokeFile = 'src/__impeccable_provider_smoke_direct.html';
-const providerSmoke = {
-  claude: {
-    fixture: 'src/__impeccable_provider_smoke_claude.html',
-    confirmedFixture: 'src/__impeccable_provider_smoke_confirmed_claude.html',
-    agentChoiceFixture: 'src/__impeccable_provider_smoke_font_choice_claude.html',
-    admin: '.claude/skills/impeccable/scripts/hook-admin.mjs',
-    hook: '.claude/skills/impeccable/scripts/hook.mjs',
-    event: (file) => postToolUseEvent('confirmed-claude', file, 'Edit'),
-  },
-  codex: {
-    fixture: 'src/__impeccable_provider_smoke_codex.html',
-    confirmedFixture: 'src/__impeccable_provider_smoke_confirmed_codex.html',
-    agentChoiceFixture: 'src/__impeccable_provider_smoke_font_choice_codex.html',
-    admin: '.agents/skills/impeccable/scripts/hook-admin.mjs',
-    hook: '.agents/skills/impeccable/scripts/hook.mjs',
-    event: (file) => postToolUseEvent('confirmed-codex', file, 'apply_patch'),
-  },
-  cursor: {
-    fixture: 'src/__impeccable_provider_smoke_cursor.html',
-    confirmedFixture: 'src/__impeccable_provider_smoke_confirmed_cursor.html',
-    agentChoiceFixture: 'src/__impeccable_provider_smoke_font_choice_cursor.html',
-    admin: '.cursor/skills/impeccable/scripts/hook-admin.mjs',
-    hook: '.cursor/skills/impeccable/scripts/hook-before-edit.mjs',
-    event: (file) => ({
-      hook_event_name: 'preToolUse',
-      cwd: targetRepo,
-      tool_name: 'Write',
-      tool_input: {
-        file_path: file,
-        content: readFileSync(file, 'utf8'),
-      },
-    }),
-  },
+const smokeFiles = {
+  direct: 'src/__impeccable_provider_smoke_direct.html',
+  claude: 'src/__impeccable_provider_smoke_claude.html',
+  codex: 'src/__impeccable_provider_smoke_codex.html',
+  cursor: 'src/__impeccable_provider_smoke_cursor.html',
+  confirmedClaude: 'src/__impeccable_provider_smoke_confirmed_claude.html',
+  confirmedCodex: 'src/__impeccable_provider_smoke_confirmed_codex.html',
+  confirmedCursor: 'src/__impeccable_provider_smoke_confirmed_cursor.html',
+  agentChoiceClaude: 'src/__impeccable_provider_smoke_font_choice_claude.html',
+  agentChoiceCodex: 'src/__impeccable_provider_smoke_font_choice_codex.html',
+  agentChoiceCursor: 'src/__impeccable_provider_smoke_font_choice_cursor.html',
 };
 
 const results = [];
 const hookConfigFiles = ['.impeccable/config.json', '.impeccable/config.local.json'];
 const originalHookConfigFiles = new Map();
 
-function legacySmokeArg(value) {
-  // The retired local parser represented a bare flag as the string "true".
-  // Preserve that CLI/error behavior while sharing the repository parser.
-  return value === true ? 'true' : value;
-}
-
 main().catch((error) => {
   restoreHookConfigFiles();
   if (!results.some((result) => !result.pass)) {
@@ -140,6 +109,21 @@ async function checked(name, classification, fn) {
   }
 }
 
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith('--')) continue;
+    const eq = arg.indexOf('=');
+    if (eq !== -1) {
+      out[arg.slice(2, eq)] = arg.slice(eq + 1);
+    } else {
+      out[arg.slice(2)] = argv[i + 1] && !argv[i + 1].startsWith('--') ? argv[++i] : 'true';
+    }
+  }
+  return out;
+}
+
 function assertPath(path, label) {
   if (!existsSync(path)) throw new Error(`${label} does not exist: ${path}`);
 }
@@ -482,7 +466,7 @@ function assertNoPluginInstall() {
 
 function runDirectContractChecks() {
   clearRuntimeState();
-  const file = writeBadFixture(directSmokeFile);
+  const file = writeBadFixture(smokeFiles.direct);
   const env = { IMPECCABLE_HOOK_LOG: join(smokeDir, 'direct.ndjson') };
   const claude = run('node', ['.claude/skills/impeccable/scripts/hook.mjs'], {
     cwd: targetRepo,
@@ -511,7 +495,7 @@ function runDirectContractChecks() {
       cwd: targetRepo,
       tool_name: 'Write',
       tool_input: {
-        file_path: join(targetRepo, directSmokeFile),
+        file_path: join(targetRepo, smokeFiles.direct),
         content: badFixtureContent(),
       },
     }),
@@ -531,7 +515,7 @@ function runConfirmedExceptionPersistenceChecks() {
 
 function runConfirmedExceptionForProvider(provider) {
   clearRuntimeState();
-  const rel = providerSmoke[provider].confirmedFixture;
+  const rel = confirmedSmokeFile(provider);
   const file = writeConfirmedFixture(rel);
   const beforeLog = `${provider}-confirmed-before.ndjson`;
   const afterLog = `${provider}-confirmed-after.ndjson`;
@@ -544,7 +528,7 @@ function runConfirmedExceptionForProvider(provider) {
   assertNoSpecificFontIgnoreConfig(provider);
 
   run('node', [
-    providerSmoke[provider].admin,
+    providerAdminScript(provider),
     'ignore-value',
     'overused-font',
     'Roboto',
@@ -596,7 +580,7 @@ function runAgentChosenFontExceptionChecks() {
 
 function runAgentChosenFontExceptionForProvider(provider) {
   clearRuntimeState();
-  const rel = providerSmoke[provider].agentChoiceFixture;
+  const rel = agentChoiceSmokeFile(provider);
   const file = writeConfirmedFixture(rel);
   const beforeLog = `${provider}-agent-choice-before.ndjson`;
   const afterLog = `${provider}-agent-choice-after.ndjson`;
@@ -628,40 +612,27 @@ function runAgentChosenFontExceptionForProvider(provider) {
 }
 
 function runProviderAgentFontException(provider, rel) {
-  runProviderAgent(provider, fontExceptionPrompt(provider, rel), {
-    logName: `${provider}-agent-choice.log`,
-    claudeDebugLog: 'claude-agent-choice-debug.log',
-  });
-}
-
-function runProviderAgent(provider, prompt, {
-  logName,
-  env = {},
-  claudeDebugLog,
-  claudeTools = 'Read,Bash',
-  claudeAllowedTools = 'Read Bash',
-  cursorReady = false,
-} = {}) {
+  const prompt = fontExceptionPrompt(provider, rel);
   if (provider === 'claude') {
-    return run('claude', [
+    run('claude', [
       '-p',
       '--setting-sources', 'project',
       '--permission-mode', 'acceptEdits',
-      '--tools', claudeTools,
-      '--allowedTools', claudeAllowedTools,
+      '--tools', 'Read,Bash',
+      '--allowedTools', 'Read Bash',
       '--debug', 'hooks',
-      '--debug-file', join(smokeDir, claudeDebugLog),
+      '--debug-file', join(smokeDir, 'claude-agent-choice-debug.log'),
       prompt,
     ], {
       cwd: targetRepo,
-      env,
-      logName,
+      logName: 'claude-agent-choice.log',
       timeoutMs: 10 * 60 * 1000,
     });
+    return;
   }
 
   if (provider === 'codex') {
-    return run('codex', [
+    run('codex', [
       'exec',
       '-C', targetRepo,
       '--dangerously-bypass-hook-trust',
@@ -670,14 +641,14 @@ function runProviderAgent(provider, prompt, {
       prompt,
     ], {
       cwd: targetRepo,
-      env,
-      logName,
+      logName: 'codex-agent-choice.log',
       timeoutMs: 10 * 60 * 1000,
     });
+    return;
   }
 
   if (provider === 'cursor') {
-    if (!cursorReady) ensureCursorAgent();
+    ensureCursorAgent();
     const res = run('agent', [
       '-p',
       '--force',
@@ -687,8 +658,7 @@ function runProviderAgent(provider, prompt, {
       prompt,
     ], {
       cwd: targetRepo,
-      env,
-      logName,
+      logName: 'cursor-agent-choice.log',
       timeoutMs: 10 * 60 * 1000,
       allowFailure: true,
     });
@@ -701,10 +671,10 @@ function runProviderAgent(provider, prompt, {
       }
       throw new Error(res.error ? `agent failed: ${res.error.message}` : `agent exited ${res.status}`);
     }
-    return res;
+    return;
   }
 
-  throw new Error(`Unsupported provider agent: ${provider}`);
+  throw new Error(`Unsupported agent-choice provider: ${provider}`);
 }
 
 function assertSpecificFontIgnoreConfig(provider, config) {
@@ -743,29 +713,84 @@ function readSharedHookConfig() {
 }
 
 function runInstalledProviderHook(provider, file, logName) {
-  const smoke = providerSmoke[provider];
   const env = { IMPECCABLE_HOOK_LOG: join(smokeDir, logName) };
-  return run('node', [smoke.hook], {
-    cwd: targetRepo,
-    env,
-    logName: `direct-${provider}-confirmed-${logName.replace(/\.ndjson$/, '.log')}`,
-    input: JSON.stringify(smoke.event(file)),
-  });
+  if (provider === 'claude') {
+    return run('node', ['.claude/skills/impeccable/scripts/hook.mjs'], {
+      cwd: targetRepo,
+      env,
+      logName: `direct-${provider}-confirmed-${logName.replace(/\.ndjson$/, '.log')}`,
+      input: JSON.stringify(postToolUseEvent(`confirmed-${provider}`, file, 'Edit')),
+    });
+  }
+  if (provider === 'codex') {
+    return run('node', ['.agents/skills/impeccable/scripts/hook.mjs'], {
+      cwd: targetRepo,
+      env,
+      logName: `direct-${provider}-confirmed-${logName.replace(/\.ndjson$/, '.log')}`,
+      input: JSON.stringify(postToolUseEvent(`confirmed-${provider}`, file, 'apply_patch')),
+    });
+  }
+  if (provider === 'cursor') {
+    return run('node', ['.cursor/skills/impeccable/scripts/hook-before-edit.mjs'], {
+      cwd: targetRepo,
+      env,
+      logName: `direct-${provider}-confirmed-${logName.replace(/\.ndjson$/, '.log')}`,
+      input: JSON.stringify({
+        hook_event_name: 'preToolUse',
+        cwd: targetRepo,
+        tool_name: 'Write',
+        tool_input: {
+          file_path: file,
+          content: readFileSync(file, 'utf8'),
+        },
+      }),
+    });
+  }
+  throw new Error(`Unsupported confirmed exception provider: ${provider}`);
+}
+
+function confirmedSmokeFile(provider) {
+  if (provider === 'claude') return smokeFiles.confirmedClaude;
+  if (provider === 'codex') return smokeFiles.confirmedCodex;
+  if (provider === 'cursor') return smokeFiles.confirmedCursor;
+  throw new Error(`Unsupported confirmed exception provider: ${provider}`);
+}
+
+function agentChoiceSmokeFile(provider) {
+  if (provider === 'claude') return smokeFiles.agentChoiceClaude;
+  if (provider === 'codex') return smokeFiles.agentChoiceCodex;
+  if (provider === 'cursor') return smokeFiles.agentChoiceCursor;
+  throw new Error(`Unsupported agent-choice provider: ${provider}`);
+}
+
+function providerAdminScript(provider) {
+  if (provider === 'claude') return '.claude/skills/impeccable/scripts/hook-admin.mjs';
+  if (provider === 'codex') return '.agents/skills/impeccable/scripts/hook-admin.mjs';
+  if (provider === 'cursor') return '.cursor/skills/impeccable/scripts/hook-admin.mjs';
+  throw new Error(`Unsupported admin provider: ${provider}`);
 }
 
 function runClaudeProviderSmoke() {
   clearRuntimeState();
   const env = { IMPECCABLE_HOOK_LOG: join(smokeDir, 'claude.ndjson') };
-  const prompt = providerPrompt(providerSmoke.claude.fixture);
-  const res = runProviderAgent('claude', prompt, {
+  const prompt = providerPrompt(smokeFiles.claude);
+  const res = run('claude', [
+    '-p',
+    '--setting-sources', 'project',
+    '--permission-mode', 'acceptEdits',
+    '--tools', 'Read,Write,Edit',
+    '--allowedTools', 'Read Write Edit',
+    '--debug', 'hooks',
+    '--debug-file', join(smokeDir, 'claude-debug.log'),
+    prompt,
+  ], {
+    cwd: targetRepo,
     env,
     logName: 'claude-provider.log',
-    claudeDebugLog: 'claude-debug.log',
-    claudeTools: 'Read,Write,Edit',
-    claudeAllowedTools: 'Read Write Edit',
+    timeoutMs: 10 * 60 * 1000,
   });
   const evidence = `${res.stdout}\n${res.stderr}\n${readMaybe(join(smokeDir, 'claude.ndjson'))}\n${readMaybe(join(smokeDir, 'claude-debug.log'))}`;
-  requireFile(providerSmoke.claude.fixture, 'Claude provider fixture');
+  requireFile(smokeFiles.claude, 'Claude provider fixture');
   requireFinding('Claude provider hook', evidence);
   if (!/PostToolUse|hook/i.test(evidence)) throw new Error('Claude provider evidence lacks hook/PostToolUse marker');
   record('claude provider', true, 'Claude edit triggered PostToolUse hook and side-tab detection');
@@ -774,14 +799,23 @@ function runClaudeProviderSmoke() {
 function runCodexProviderSmoke() {
   clearRuntimeState();
   const env = { IMPECCABLE_HOOK_LOG: join(smokeDir, 'codex.ndjson') };
-  const prompt = `Use apply_patch to ${providerPrompt(providerSmoke.codex.fixture)}`;
-  const res = runProviderAgent('codex', prompt, {
+  const prompt = `Use apply_patch to ${providerPrompt(smokeFiles.codex)}`;
+  const res = run('codex', [
+    'exec',
+    '-C', targetRepo,
+    '--dangerously-bypass-hook-trust',
+    '--dangerously-bypass-approvals-and-sandbox',
+    '--json',
+    prompt,
+  ], {
+    cwd: targetRepo,
     env,
     logName: 'codex-provider.log',
+    timeoutMs: 10 * 60 * 1000,
   });
   const evidence = `${res.stdout}\n${res.stderr}\n${readMaybe(join(smokeDir, 'codex.ndjson'))}`;
   const cacheEvidence = `${readMaybe(join(targetRepo, '.impeccable', 'hook.cache.json'))}\n${readMaybe(join(targetRepo, '.impeccable', 'hook.pending.json'))}`;
-  requireFile(providerSmoke.codex.fixture, 'Codex provider fixture');
+  requireFile(smokeFiles.codex, 'Codex provider fixture');
   requireFinding('Codex provider hook', `${evidence}\n${cacheEvidence}`);
   record('codex provider', true, 'Codex apply_patch triggered project hook and side-tab detection');
 }
@@ -790,19 +824,37 @@ function runCursorProviderSmoke() {
   ensureCursorAgent();
   clearRuntimeState();
   const env = { IMPECCABLE_HOOK_LOG: join(smokeDir, 'cursor.ndjson') };
-  const prompt = providerPrompt(providerSmoke.cursor.fixture);
-  const res = runProviderAgent('cursor', prompt, {
+  const prompt = providerPrompt(smokeFiles.cursor);
+  const res = run('agent', [
+    '-p',
+    '--force',
+    '--trust',
+    '--workspace', targetRepo,
+    '--output-format', 'stream-json',
+    prompt,
+  ], {
+    cwd: targetRepo,
     env,
     logName: 'cursor-provider.log',
-    cursorReady: true,
+    timeoutMs: 10 * 60 * 1000,
+    allowFailure: true,
   });
+  if (res.error || res.status !== 0) {
+    const output = `${res.stdout}\n${res.stderr}\n${res.error?.message || ''}`;
+    if (/Authentication required|agent login|CURSOR_API_KEY/i.test(output)) {
+      const err = new Error('Cursor CLI authentication required. Run `agent login` or set CURSOR_API_KEY, then rerun `bun run smoke:hooks -- --providers=cursor`.');
+      err.classification = 'cursor auth required';
+      throw err;
+    }
+    throw new Error(res.error ? `agent failed: ${res.error.message}` : `agent exited ${res.status}`);
+  }
   const evidence = `${res.stdout}\n${res.stderr}\n${readMaybe(join(smokeDir, 'cursor.ndjson'))}\n${readMaybe(join(targetRepo, '.impeccable', 'hook.pending.json'))}\n${readMaybe(join(targetRepo, '.impeccable', 'hook.cache.json'))}`;
   requireFinding('Cursor provider hook', evidence);
   const auditEvents = readAuditEvents(join(smokeDir, 'cursor.ndjson'));
   if (!auditEvents.some((event) => event.event === 'preToolUse' && event.blocked === true)) {
     throw new Error('Cursor provider evidence lacks a preToolUse audit entry with blocked=true');
   }
-  const fixturePath = join(targetRepo, providerSmoke.cursor.fixture);
+  const fixturePath = join(targetRepo, smokeFiles.cursor);
   const intentionalIgnore = auditEvents.some((event) =>
     event.event === 'preToolUse'
     && event.file === fixturePath
@@ -965,15 +1017,7 @@ function cleanSmokeArtifacts() {
 }
 
 function cleanSmokeFiles() {
-  const files = [
-    directSmokeFile,
-    ...Object.values(providerSmoke).flatMap(({ fixture, confirmedFixture, agentChoiceFixture }) => [
-      fixture,
-      confirmedFixture,
-      agentChoiceFixture,
-    ]),
-  ];
-  for (const rel of files) {
+  for (const rel of Object.values(smokeFiles)) {
     rmSync(join(targetRepo, rel), { force: true });
   }
 }

tests/cli-args.test.mjs

@@ -6,16 +6,9 @@
 
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
 
 import { boolFlag, parseArgs, positiveIntFlag, resolveEnum, toCamel } from '../scripts/lib/cli-args.mjs';
 
-const PROVIDER_SMOKE_SCRIPT = fileURLToPath(new URL('../scripts/smoke-provider-hooks.mjs', import.meta.url));
-
 describe('parseArgs', () => {
   it('reads space-separated values', () => {
     // The regression: without the argv[i+1] lookahead this yielded
@@ -132,44 +125,3 @@ describe('resolveEnum', () => {
     );
   });
 });
-
-describe('provider hook smoke CLI', () => {
-  it('prints help without requiring a target repository', () => {
-    const result = spawnSync(process.execPath, [PROVIDER_SMOKE_SCRIPT, '--help'], { encoding: 'utf8' });
-
-    assert.equal(result.status, 0);
-    assert.match(result.stdout, /^Usage: bun run smoke:hooks/);
-    assert.match(result.stdout, /target repo must be explicit/);
-    assert.equal(result.stderr, '');
-  });
-
-  it('fails with the same usage guidance when the target repository is omitted', () => {
-    const result = spawnSync(process.execPath, [PROVIDER_SMOKE_SCRIPT], { encoding: 'utf8' });
-
-    assert.equal(result.status, 1);
-    assert.equal(result.stdout, '');
-    assert.match(result.stderr, /^Usage: bun run smoke:hooks/);
-    assert.match(result.stderr, /target repo must be explicit/);
-  });
-
-  it('preserves the legacy string sentinel for value-less options', () => {
-    const cases = [
-      { args: ['--repo'], error: /target repo does not exist: .*\/true/ },
-      { args: ['--repo', '.', '--bundle'], error: /universal bundle does not exist: .*\/true/ },
-      { args: ['--repo', '.', '--bundle', './missing.zip', '--providers'], error: /universal bundle does not exist: .*\/missing\.zip/ },
-    ];
-
-    for (const { args, error } of cases) {
-      const cwd = mkdtempSync(join(tmpdir(), 'impeccable-provider-smoke-cli-'));
-      try {
-        const result = spawnSync(process.execPath, [PROVIDER_SMOKE_SCRIPT, ...args], { cwd, encoding: 'utf8' });
-
-        assert.equal(result.status, 1);
-        assert.doesNotMatch(result.stderr, /TypeError/);
-        assert.match(result.stderr, error);
-      } finally {
-        rmSync(cwd, { recursive: true, force: true });
-      }
-    }
-  });
-});

tests/skills-cli.test.js

@@ -1649,6 +1649,35 @@ describe('hook manifest merge helpers', () => {
       'node .cursor/skills/impeccable/scripts/hook-before-edit.mjs',
     ]);
   });
+
+  test('mergeHookManifests replaces legacy Windows-path Claude hooks (#604)', () => {
+    const legacyPath = 'C:\\Users\\alice\\.claude\\skills\\impeccable\\scripts\\hook.mjs';
+    const legacyCommand = `[ ! -f "${legacyPath}" ] || node "${legacyPath}"`;
+    const freshCommand = `node -e "guard" "${legacyPath}"`;
+    const merged = mergeHookManifests(
+      {
+        hooks: {
+          PostToolUse: [{ matcher: 'Edit|Write|MultiEdit', hooks: [
+            { type: 'command', command: legacyCommand },
+          ] }],
+          Stop: [{ hooks: [{ type: 'command', command: legacyCommand }] }],
+        },
+      },
+      {
+        hooks: {
+          PostToolUse: [{ matcher: 'Edit|Write|MultiEdit', hooks: [
+            { type: 'command', command: freshCommand },
+          ] }],
+          Stop: [{ hooks: [{ type: 'command', command: freshCommand }] }],
+        },
+      },
+    );
+
+    expect(merged.hooks.PostToolUse).toHaveLength(1);
+    expect(merged.hooks.Stop).toHaveLength(1);
+    expect(merged.hooks.PostToolUse[0].hooks[0].command).toBe(freshCommand);
+    expect(merged.hooks.Stop[0].hooks[0].command).toBe(freshCommand);
+  });
 });
 
 // ─── Hook command path resolution (issue #399, part 1) ───────────────────────