[hotungchang]

Problem

Every command in hooks/hooks.json passes an unquoted plugin root to node:

"command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/security-guard.js"

When the plugin is installed under a path with spaces (common on Windows, where the home folder is often C:\Users\First Last\), the shell splits the path and Node receives only the first fragment:

Error: Cannot find module 'C:\Users\First'
  code: 'MODULE_NOT_FOUND'

All five hooks (security-guard, session-start, skill-forced-eval, stop-summary, session-summary) fail on every event. Users get a hook error on each Bash/Write/Edit call and each prompt, and features such as forced skill evaluation silently never run.

Change

Wrap the path in double quotes in all five commands:

"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/security-guard.js\""

This is the form the Claude Code plugin docs recommend for shell-form hook commands, and claude plugin validate warns about the unquoted form. No other files change. Paths without spaces behave exactly as before.

Testing

On Windows 11 with Node v24 and a home folder containing spaces:

• Before: SessionEnd hook [...] failed: Error: Cannot find module 'C:\Users\...'.
• After: all hooks load. security-guard.js returns {"continue":true} for a Bash payload, and skill-forced-eval.js emits the skill list on prompt submit, which I confirmed in a live session.
• The patched file is byte-identical to this branch's hooks/hooks.json (git blob 62d2430). The original matches main (d1c932f).

Note: several skill docs (skills/hook-development, skills/command-development, skills/plugin-structure) show the same unquoted pattern in examples. I left them alone to keep this PR to the runtime fix.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YYpHr4VNP2fCe3H1Bq1Ffw