When someone opens an issue titled “Windows support,” the tempting response is “use WSL.” LucaNitti’s issue made the case that the hooks should work natively. PowerShell can parse JSON without jq. It handles paths with spaces. It does not need a compatibility layer.

So v0.9.0 ships four native PowerShell hooks: file-guard, git-safe, branch-guard, and session-log. Each is a .ps1 file that uses ConvertFrom-Json/ConvertTo-Json (built into PowerShell, no external dependencies). Configure with "command": "pwsh -File /path/to/hook.ps1" in settings.json.

This matters more than it seems. The bash hooks break when the Windows username contains a space. Claude Code’s hook runner passes expanded paths to bash -c without quoting, so “Lea Chan” becomes two arguments. #40084 documents this. The PowerShell hooks sidestep the problem entirely.

48 documented platform limitations

The enforce-hooks README now catalogs 48 known limitations in Claude Code’s hook system. Each entry describes the bug, links to the upstream issue, explains the impact, and suggests a workaround where one exists.

Some highlights from the 26 new entries since v0.8.0:

Plugin hooks install silently. The /plugin install flow does not distinguish between inert skills and plugins that ship hooks. A plugin can add a SessionStart hook that runs arbitrary commands on every future session with no disclosure and no consent prompt. Combined with auto-update, a previously-safe plugin could gain hooks in a later version. #40036.

Path deny rules do not apply to Bash. The settings.json path deny feature only restricts Claude Code’s built-in file tools. The Bash tool executes commands as the user’s OS process with no path checking. cat, grep, and head on denied directories work fine via shell. #39987.

Project settings can spoof company announcements. The companyAnnouncements field in project-level .claude/settings.json displays messages that look identical to legitimate enterprise announcements. A malicious repository can impersonate the organization. #39998.

Plugin hooks lose execute permissions when cached. The marketplace caching layer strips the execute bit from .sh hook files. Same root cause as the marketplace update and sync stripping issues, but triggered by a different code path. Stop hooks are particularly affected because the permission loss goes unnoticed until session end. #40086.

The full catalog is in the enforce-hooks README.

Why catalog these at all

Each limitation is a place where hooks alone cannot protect you. Knowing where the gaps are is more useful than pretending they do not exist. The catalog is also a map for anyone building their own hooks: here is where the ground is solid, and here is where it is not.

The safety-check tool now detects 20+ of these conditions automatically and warns. Spaces in HOME, non-executable hooks, disabled plugins still firing, companyAnnouncements in project settings, path deny without bash coverage.

Numbers

• 195 Rust tests, ~1550 hook tests
• 48 documented platform limitations (was 22 in v0.8.0)
• 4 PowerShell hooks (new)
• 13 stars, 3 external contributors, 2 forks

v0.9.0 on GitHub