fix: freeze/guard/investigate deny every edit on Windows (drive-letter paths fail the absoluteness test)

[kevingrasso32]

The bug

On Windows, Claude Code hands Edit/Write a drive-letter absolute path. freeze/bin/check-freeze.sh tests absoluteness with:

case "$FILE_PATH" in
  /*) ;; # already absolute

C:\dev\proj\src\x.py does not match /*, so the hook treats it as relative and joins it onto pwd. Nothing normalises \ before the prefix comparison either, so the boundary check runs against a mangled path:

[freeze] Blocked: /c/dev/proj/C:\dev\proj\src\x.py is outside the freeze boundary

Because freeze is fail-closed by design, there is no softer failure mode than a hard deny — on every edit, including files inside the frozen directory. /guard and /investigate register the same hook, so all three skills are unusable on Windows; the session that hit this had to fall back to editing through Bash to make any progress.

The fix

Add gstack_hook_normalize_path to the shared careful/bin/hook-extract.sh, and run both sides of the boundary comparison through it:

C:\dev\x       -> /c/dev/x     (drive letter lowercased, \ -> /)
c:/dev/x       -> /c/dev/x     (mixed separators, either drive case)
\srv\sh\x     -> //srv/sh/x   (UNC host prefix preserved)
/cygdrive/c/x  -> /c/x         (Cygwin mount prefix names the same drive)

Normalising one side was never enough: the state file may legitimately hold either dialect, since /freeze writes it with pwd, which answers /c/dev/... under Git Bash.

Two constraints shaped the implementation:

Builtins only, no subshell. careful sources this file on every Bash tool call, and process creation under Windows bash measured ~0.7-1.5s on the reporting machine. The function returns its result in GSTACK_HOOK_PATH rather than on stdout — which is the hook's decision channel — and a $(...) call site would itself cost a fork. Kept bash 3.2 compatible (no ${v,,}) for macOS system bash.

Windows detection is lexical where it can be. The drive-letter and UNC shapes are recognised by shape, not by OS, so the rewrite behaves identically everywhere and the regression tests are meaningful on POSIX CI. Separator rewriting for a path with no Windows shape is gated on OSTYPE, because \ is a legal POSIX filename character: rewriting it there would turn an in-boundary file named b\..\..\etc\x into the out-of-boundary path /etc/x and flip a decision the hook is supposed to make on the literal name.

/careful shares hook-extract.sh but has no equivalent defect: the shared extractor is field-agnostic, and careful reads command and never resolves a path. check-freeze.sh is the only consumer of file_path in the repo.

Verification, and an honest limit on it

The 7 new cases in test/hook-scripts.test.ts cover the reported repro, a native-form boundary, mixed separators and drive case, src vs src-old, UNC host isolation, and a POSIX-only backslash-safety case. Four fail against the pre-fix hook; the deny-side ones guard against over-permissive normalisation.

I could not get a meaningful signal from that file on Windows, and I want to be straight about it rather than quote a green number. Measured on this branch's merge base (v1.87.0.0), unmodified:

	tests	pass	fail
upstream v1.87.0.0, unmodified	116	11	105
this branch	123	12	110

check-freeze.sh cases specifically: 0 of 15 pass on unmodified upstream, 0 of 19 with this change. The whole file is non-functional on Windows — which is expected and already known to this repo: scripts/test-free-shards.ts:124 excludes files containing a raw /tmp/ path from the Windows-safe subset, commented "they would fail on windows-latest no matter how the runner shards them." That exclusion is also why this defect reached users, and it is why the new tests are written to catch it on POSIX CI. POSIX CI is the right judge of these tests; my local Windows run is not.

So I verified the behaviour directly instead, driving the real hook with real payloads, both directions, against the installed v1.87.0.0 + this change:

input	result
in-boundary, native C:\dev\proj\validation_ui\ref_picker.py	allowed ({})
out-of-boundary, native C:\dev\proj\kg\loader.py	denied, path correctly normalised in the message
in-boundary, mixed separator c:/dev/proj/validation_ui/x.py	allowed
sibling-prefix trap validation_ui-old/x.py	denied

The last one matters: it shows the normalisation is not simply permissive.

One note for whoever reviews: building the test payload by hand is easy to get wrong, because a single backslash inside the JSON string is an invalid escape and the hook then fails closed with a parse error that looks exactly like a boundary denial. Generate the payload with a JSON serialiser.

Composition with v1.87.0.0

This is cherry-picked onto current main, not the v1.68.2.0 it was written against. It composes with the newer gstack_hook_state_root work in the same file: normalisation runs at check-freeze.sh:125, ahead of the absoluteness test at :129, and the state-root resolver is untouched.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here