Keep unknown binaries in Git Bash (fixes "jq: command not found") — v0.1.2 (#1)

* Keep unknown binaries in Git Bash instead of routing them to PowerShell

A binary missing from POSIX_SAFE_BINS pulled the entire command chain out of
the Git Bash pass-through path and into PowerShell. PowerShell only resolves
the Windows PATH, not the MSYS /usr/bin tree, so an installed and working tool
reported as "command not found" — `jq` being the common case. The effect
cascaded across the chain: in `cat x.json | jq …` the `cat` segment also ended
up in PowerShell, where it is an alias for Get-Content and pipes objects rather
than bytes.

An allowlist can never be complete, so the default is inverted: an unknown
binary is assumed to be an ordinary executable and passes through to Git Bash.
Only PowerShell-shaped names are still routed to PowerShell — Verb-Noun cmdlets
and *.ps1 scripts, via the new looksLikePowerShell(). This matches what the
README already documented for the passthrough class.

POSIX_SAFE_BINS additionally gains the tools that show up in everyday chains
(jq, yq, rg, fd, tar, openssl, ssh, make, sqlite3, aws, az, terraform, …) so the
fast path stays explicit and self-documenting.

The deny-list and WIN32_TRANSPILE_FORCE_PS keep precedence over the new default;
both are covered by tests. 40 -> 47 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Add CI and release workflows

The repository had no automation: tests only ever ran on a maintainer's machine,
and a release was a manual build-tag-publish sequence with no guard against
shipping a tag whose version disagreed with package.json.

- ci.yml runs the suite on Node 20/22/24 across ubuntu-latest and
  windows-latest. Windows is the platform this plugin exists for, so it is part
  of the matrix rather than an afterthought. A second job checks that
  package.json, plugin.json and marketplace.json carry the same version, which
  is exactly the drift scripts/sync-version.js exists to prevent.
- release.yml triggers on a v*.*.* tag: builds and tests on both platforms,
  refuses a tag that does not match package.json, creates the GitHub release
  with generated notes, and publishes to npm with provenance. The npm step is
  skipped rather than failed when no NPM_TOKEN secret is present, so a tag push
  still produces a GitHub release on a repo without registry credentials.
- dependabot.yml keeps the pinned action SHAs and the dev dependencies current.

Third-party actions are pinned to commit SHAs with a version comment, workflow
permissions default to contents: read and are widened only in the publishing
job, and every multi-line script runs under set -euo pipefail. actionlint is
clean.

The test script changes from a `dist/test/*.test.js` glob to the `dist/test/`
directory: cmd.exe does not expand globs, so the glob form is unreliable on the
Windows runners the new matrix adds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Resolve test files explicitly instead of relying on shell or Node globbing

The CI matrix exposed that neither form of the test invocation is portable:
`node --test dist/test/*.test.js` relies on the shell expanding the glob, which
cmd.exe does not do, and `node --test dist/test` is accepted by Node 20 but not
by 22 or 24, which try to load the directory as a module and fail with
MODULE_NOT_FOUND.

scripts/run-tests.js lists dist/test/*.test.js via readdir and passes the files
to `node --test` directly, which behaves the same on every supported version and
on both platforms.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: hmennen90

.claude-plugin/marketplace.json

@@ -30,7 +30,7 @@
       "name": "claude-code-win32",
       "source": "./",
       "description": "Makes Claude's Bash tool calls work cleanly on Windows: POSIX pass-through via Git Bash, PowerShell rewrites for common Unix idioms, MSYS drive-path translation, and deny-with-hint for Unix-only commands.",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "author": {
         "name": "Hendrik Mennen"
       },

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-win32",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Hybrid bash→PowerShell transpiler for Claude Code on Windows. Passes POSIX-safe commands through to Git Bash, rewrites Unix idioms to PowerShell equivalents, translates MSYS drive paths, and denies Unix-only commands with per-command hints.",
   "author": {
     "name": "Hendrik Mennen",

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Tests (node ${{ matrix.node }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        # Windows is the platform this plugin targets, so it is not optional here.
+        os: [ubuntu-latest, windows-latest]
+        node: ['20', '22', '24']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install
+        run: npm ci
+
+      - name: Build and test
+        run: npm test
+
+  versions-in-sync:
+    name: Version sync
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: package.json, plugin.json and marketplace.json agree
+        shell: bash
+        run: |
+          set -euo pipefail
+          PKG=$(node -p "require('./package.json').version")
+          PLUGIN=$(node -p "require('./.claude-plugin/plugin.json').version")
+          MARKET=$(node -p "require('./.claude-plugin/marketplace.json').plugins.map(p => p.version).join(',')")
+          echo "package.json=$PKG plugin.json=$PLUGIN marketplace.json=$MARKET"
+          if [ "$PKG" != "$PLUGIN" ] || [ "$MARKET" != "$PKG" ]; then
+            echo "::error::Version mismatch — run 'node scripts/sync-version.js'"
+            exit 1
+          fi

.github/workflows/release.yml

@@ -0,0 +1,111 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Build and verify
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install
+        run: npm ci
+
+      - name: Build and test
+        run: npm test
+
+      - name: Tag matches package.json version
+        shell: bash
+        env:
+          TAG_REF: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          PKG=$(node -p "require('./package.json').version")
+          if [ "$TAG_REF" != "v${PKG}" ]; then
+            echo "::error::Tag $TAG_REF does not match package.json version $PKG"
+            exit 1
+          fi
+
+  publish:
+    name: Publish
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write   # create the GitHub release
+      id-token: write   # npm provenance
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0   # release notes are generated from the commit history
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: package-lock.json
+          registry-url: https://registry.npmjs.org
+
+      - name: Install
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: GitHub release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_REF: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          gh release create "$TAG_REF" --title "$TAG_REF" --generate-notes --verify-tag
+
+      # Publishing is skipped rather than failed when no npm token is configured,
+      # so a tag push still produces a GitHub release on its own.
+      - name: npm publish
+        if: env.NPM_TOKEN != ''
+        shell: bash
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          npm publish --provenance --access public
+
+      - name: Note skipped npm publish
+        if: env.NPM_TOKEN == ''
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "### npm publish skipped"
+            echo ""
+            echo "No \`NPM_TOKEN\` secret configured — the GitHub release was created, the npm package was not published."
+          } >> "$GITHUB_STEP_SUMMARY"

README.md

@@ -10,7 +10,7 @@ On macOS and Linux the hook checks `process.platform` first and no-ops immediate
 ## What You Get
 
 - **No more "bash: command not found" on Windows** — Claude's `Bash` calls just work.
-- **Zero-overhead fast path** — POSIX-safe commands (`git`, `npm`, `grep`, `sed`, …) stay in Git Bash; PowerShell startup is only paid when needed.
+- **Zero-overhead fast path** — POSIX-safe commands (`git`, `npm`, `grep`, `sed`, `jq`, …) stay in Git Bash; PowerShell startup is only paid when needed. Unknown binaries stay there too — Git Bash sees more `PATH` than PowerShell does.
 - **Targeted PS rewrites** — `xdg-open`, `pbcopy`, `uname`, `df`, `free`, and friends map to clean PowerShell equivalents.
 - **MSYS drive-path translation** — `/c/Users/foo` → `C:/Users/foo` when the segment is routed to PS. URL-safe, packed-flag-aware (`-I/c/include` works), quote-aware.
 - **Smart denial with hints** — `sudo`, `systemctl`, `apt`, `chmod`, etc. don't silently fail; Claude is told what to use instead (`Start-Process -Verb RunAs`, `Get-Service`, `winget`, `icacls`, …).
@@ -55,13 +55,13 @@ Registers a `PreToolUse` hook on the `Bash` tool. For each command:
 2. **Shell detection** — probes for `pwsh` (PS 7+), falls back to `powershell.exe` (5.1). Cached 24h under `~/.claude/plugins/claude-code-win32.state.json`.
 3. **Chain parse** — quote- and paren-aware split at `|`, `&&`, `||`, `;`, `&`. Redirect tokens (`2>&1`, `1>&2`, `&>file`, `&>>file`) are recognised and **not** misclassified as chain operators.
 4. **Per-segment classification**:
-   - **passthrough** — external `.exe` / POSIX allowlist (git, node, npm, docker, grep, sed, awk, …)
+   - **passthrough** — external `.exe` / POSIX allowlist (git, node, npm, docker, grep, sed, awk, jq, rg, …). **An unknown binary also passes through**: the allowlist can never be complete, and Git Bash resolves both the Windows `PATH` and the MSYS `/usr/bin` tree, while PowerShell only sees the former. Only PowerShell-shaped names (`Verb-Noun` cmdlets, `*.ps1`) are routed to PS.
    - **rewrite** — known Unix idiom with a clean PowerShell equivalent (`xdg-open`, `pbcopy`, `whoami`, `uname`, `df`, `free`, …)
    - **deny** — Unix-only with no Windows equivalent (package managers, `systemctl`, `sudo`, `chmod`, `dmesg`, `iptables`, …)
 5. **Deny gates**:
    - Any segment is Unix-only → deny with a per-command hint pointing Claude at the Windows-native alternative.
    - `&&` / `||` present AND detected shell is PS 5.1 → deny with `https://aka.ms/powershell` install link.
-6. **Pass fast-path** — all segments Git-Bash-safe, no rewrite needed, `preferPowerShell=false` → allow unchanged (avoids PS 100–500 ms startup).
+6. **Pass fast-path** — all segments Git-Bash-safe (allowlisted or unknown), no rewrite needed, `preferPowerShell=false` → allow unchanged (avoids PS 100–500 ms startup).
 7. **MSYS path translation** — for segments routed to PowerShell, leading `/c/`, `/d/`, … prefixes are rewritten to `C:/`, `D:/`, …. Boundary-aware: URLs (`https://…`), UNC paths (`//server/share`), `file:///c/…`, and single-quoted literals are left intact. Packed compiler flags like `-I/c/include`, `-Wl,/c/lib`, `-isystem/c/sys` are recognised and translated.
 8. **Strategy A rewrite** — rebuild the chain in PowerShell syntax (`&&`/`||` native on PS 7; trailing `&` → `Start-Job`), prepend `$ProgressPreference='SilentlyContinue';` to suppress CLIXML progress noise on PS 5.1, wrap in `<exe>.exe -NoProfile -NonInteractive -EncodedCommand <base64>`.
 
@@ -86,8 +86,32 @@ npm run build
 npm test
 ```
 
+CI runs the suite on Node 20/22/24 across ubuntu-latest **and** windows-latest, and
+checks that `package.json`, `.claude-plugin/plugin.json` and
+`.claude-plugin/marketplace.json` carry the same version.
+
+### Cutting a release
+
+```bash
+npm version <patch|minor|major>   # bumps package.json, syncs plugin/marketplace, tags, pushes
+```
+
+The `v*.*.*` tag triggers `.github/workflows/release.yml`: it builds and tests on
+Linux and Windows, verifies the tag matches `package.json`, creates the GitHub
+release with generated notes, and publishes to npm with provenance. The npm step is
+skipped (not failed) when no `NPM_TOKEN` secret is configured.
+
 ## Status
 
 **v0.1.0** — initial release. 40 unit tests, live verified on PS 5.1 (Windows 11).
 
 Known limitation: nested commands under `xargs foo` are classified on the outer binary only. `sudo` is on the deny-list, so the most common case is already covered.
+
+### Troubleshooting
+
+**`jq: command not found` (or any tool that works in Git Bash but not through the hook).**
+Fixed in v0.1.2. Before that, any binary missing from the POSIX allowlist pulled the
+*entire* chain into PowerShell — including the `grep`/`sed`/`cat` segments around it.
+PowerShell does not see the MSYS `/usr/bin` tree, so a perfectly installed `jq` reported
+as missing. Unknown binaries now stay in Git Bash. If a tool is genuinely not installed,
+install it on the Windows `PATH` (`winget install jqlang.jq`, `scoop install jq`).

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-win32",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Claude Code Plugin: hybrid bash→PowerShell transpiler for Windows. POSIX pass-through, targeted rewrites, MSYS path translation, per-command deny hints.",
   "type": "module",
   "main": "./dist/transpile.js",
@@ -26,7 +26,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "tsc && node --test dist/test/*.test.js",
+    "test": "tsc && node scripts/run-tests.js",
     "preversion": "npm run build && npm test",
     "version": "node scripts/sync-version.js && git add .claude-plugin/plugin.json .claude-plugin/marketplace.json",
     "postversion": "git push && git push --tags",

package.json

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+/**
+ * Runs the compiled test files under dist/test.
+ *
+ * Neither a shell glob (`dist/test/*.test.js`) nor a bare directory argument
+ * works everywhere: cmd.exe does not expand globs, so the glob form breaks on
+ * the Windows runners, and `node --test dist/test` is only accepted by Node 20 —
+ * 22 and 24 try to load the directory as a module. Listing the files here works
+ * on every supported version and platform.
+ */
+
+import { readdirSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const testDir = join(root, "dist", "test");
+
+const files = readdirSync(testDir)
+  .filter((f) => f.endsWith(".test.js"))
+  .sort()
+  .map((f) => join(testDir, f));
+
+if (files.length === 0) {
+  console.error(`No compiled tests found in ${testDir} — did 'tsc' run?`);
+  process.exit(1);
+}
+
+const result = spawnSync(process.execPath, ["--test", ...files], { stdio: "inherit" });
+process.exit(result.status ?? 1);

scripts/run-tests.js

@@ -70,8 +70,68 @@ export const POSIX_SAFE_BINS = new Set<string>([
   "source",
   ".",
   "whoami",
+  // JSON/text tooling Claude reaches for constantly — all ship .exe builds and
+  // resolve under Git Bash. Missing entries here used to drag the WHOLE chain
+  // into PowerShell, where the MSYS PATH (and therefore the tool) is gone.
+  "jq",
+  "yq",
+  "rg",
+  "fd",
+  "bat",
+  "delta",
+  "diff",
+  "patch",
+  "tar",
+  "gzip",
+  "gunzip",
+  "zip",
+  "unzip",
+  "base64",
+  "md5sum",
+  "sha1sum",
+  "sha256sum",
+  "openssl",
+  "ssh",
+  "scp",
+  "sftp",
+  "rsync",
+  "make",
+  "cmake",
+  "ninja",
+  "sqlite3",
+  "psql",
+  "mysql",
+  "redis-cli",
+  "aws",
+  "az",
+  "gcloud",
+  "terraform",
+  "helm",
+  "ruby",
+  "perl",
+  "pytest",
+  "date",
+  "sleep",
+  "seq",
+  "stat",
+  "ln",
+  "du",
+  "df",
+  "ps",
+  "kill",
+  "sh",
+  "bash",
 ]);
 
+/**
+ * A binary we don't know is assumed to be a normal executable and passed to
+ * Git Bash — an allowlist can never be complete, and forcing the unknown case
+ * into PowerShell silently changes PATH resolution. The exception is a name
+ * that is clearly PowerShell: a Verb-Noun cmdlet or a .ps1 script.
+ */
+export const looksLikePowerShell = (bin: string): boolean =>
+  /^[A-Z][A-Za-z0-9]*-[A-Z][A-Za-z0-9]*$/.test(bin) || /\.ps1$/i.test(bin);
+
 /**
  * Unix-only commands with no meaningful Windows equivalent — translating them
  * would produce wrong behavior (different package catalogs, different service