Windows: Plugin hook ${CLAUDE_PLUGIN_ROOT} expansion strips backslashes, breaking all plugin hooks

Bug Description

On Windows (MSYS/Git Bash), all plugin hooks that use ${CLAUDE_PLUGIN_ROOT} fail because backslashes in the Windows path are stripped during variable expansion before being passed to /bin/bash.

Environment

• OS: Windows 10 (MSYS_NT-10.0-26200)
• Claude Code: 2.1.x
• Shell: Git Bash (MSYS2)

Steps to Reproduce

1. Install any plugin that registers hooks using ${CLAUDE_PLUGIN_ROOT} (e.g., superpowers, security-guidance)
2. Start a new Claude Code session on Windows
3. Observe "SessionStart:startup hook error" in the UI and debug logs

Expected Behavior

${CLAUDE_PLUGIN_ROOT} should be expanded to a valid path that bash can resolve, e.g.:

C:/Users/username/.claude/plugins/cache/claude-plugins-official/superpowers/4.3.0/hooks/session-start.sh

Actual Behavior

Backslashes are stripped entirely, producing an invalid path:

C:Usersksnow.claudepluginscacheclaude-plugins-officialsuperpowers4.3.0/hooks/session-start.sh

Debug Log Evidence

2026-02-12T23:13:13.135Z [DEBUG] Getting matching hook commands for SessionStart with query: startup
2026-02-12T23:13:13.135Z [DEBUG] Found 1 hook matchers in settings
2026-02-12T23:13:13.135Z [DEBUG] Matched 1 unique hooks for query "startup" (1 before deduplication)
...
2026-02-12T23:13:18.633Z [DEBUG] Hook output does not start with {, treating as plain text
2026-02-12T23:13:18.634Z [DEBUG] Hook SessionStart:startup (SessionStart) error:
/bin/bash: C:Usersksnow.claudepluginscacheclaude-plugins-officialsuperpowers4.3.0/hooks/session-start.sh: No such file or directory

The same issue affects PreToolUse hooks from security-guidance:

2026-02-12T23:14:21.220Z [DEBUG] Hook PreToolUse:Edit (PreToolUse) error:
Python

Root Cause

When Claude Code expands ${CLAUDE_PLUGIN_ROOT} in the hook command string, it stores the value with Windows backslashes (C:\Users\...). When this string is then passed to /bin/bash, bash interprets \U, \k, \., etc. as escape sequences and strips the backslashes.

Suggested Fix

Before passing the expanded command string to bash, either:

1. Convert backslashes to forward slashes in ${CLAUDE_PLUGIN_ROOT} on Windows, or
2. Properly escape/quote the path when constructing the command string

Impact

• All plugin hooks using ${CLAUDE_PLUGIN_ROOT} are broken on Windows
• Affected plugins: superpowers (SessionStart), security-guidance (PreToolUse), and any other plugin using path variables in hooks
• Functional impact is limited since plugins/skills load independently, but hook-based context injection and security checks are silently skipped