Fix: Windows hook commands PowerShell could not parse (#859, #848) - #915

Grok runs a hook's command and Codex runs commandWindows in the session shell, which is PowerShell by default on Windows. We wrote the POSIX guard for Grok, cmd.exe if exist (...) for Codex, and a bare "<path>" hook from impeccable hooks on. PowerShell rejects all three, so the hook never ran. Every writer now emits cmd /c if exist "<path>\impeccable.cmd" "<path>\impeccable.cmd" hook, from one Rust builder shared by install and hooks on plus its twin in hooks.js. Unix output and Gemini's output are unchanged, and Grok gets no commandWindows key.

Fixes #859
Fixes #848

Nothing here ran on Windows locally. The new Windows-only test windows_form_runs_the_shim_in_each_harness_shell spawns the string the way each harness does (PowerShell 5.1 and 7 with -Command, Git Bash with MSYS path conversion off, cmd.exe behind Codex's raw /C fallback) against a stub shim that saves its stdin and exits 3. It passed on rust-windows at e0dd6f9, for a relative path and for an absolute path with a space: in each of those four shells the shim ran, received the piped event, and a missing shim exited 0.

Known limits:

• GROK_SHELL=cmd still does not run the hook, which differs from the expected behavior in [Bug] Grok Build on Windows ParserErrors the POSIX hook command #859. Grok passes the line as a plain argument, so the quotes reach cmd.exe as \" and the guard finds nothing and exits 0. The same CI run confirmed this, and the test pins it as a gap.
• PowerShell's -Command reports any native failure as exit 1, so the launcher's exact code survives only under cmd.exe and Git Bash.
• An absolute install path containing $, a backtick, or %VAR% is not handled.

@0xenzyme @saulwadeleon if you have a moment: CI covers the shells, but a run through the harness itself (not the string typed by hand, the quoting differs) would settle it. Useful cases are pwsh 7, Windows PowerShell 5.1, an install path with a space, a missing launcher, and whether the hook actually received the event (a finding shown, or the hook audit log written), not only exit 0.

.codex/hooks.json is staged because tests/hook-build.test.mjs deep-equals it against the builder (same as 14d2641). Existing installs pick up the new string from npx impeccable update once an engine release carries this.

Validation on macOS: cargo test --workspace --no-fail-fast (818 passed; the one failure, impeccable-comp-verbs artifact_cleanup_failure_blocks_the_gate, also fails on this machine on unmodified main), bun run build, and bun run test against this branch's release binary.

Prepared with AI assistance.

🤖 Generated with Claude Code