gh-cli: hooks fail in Codex on Windows because PowerShell evaluates Bash parameter expansion

The repository's Codex installation instructions work for installing the marketplace, but gh-cli hook commands fail when Codex executes them through PowerShell on Windows.

Environment

• Windows, native Codex CLI 0.163.0
• gh-cli plugin 1.6.3, installed from this marketplace
• Codex executes hook commands through PowerShell 7 (pwsh.exe -NoProfile -Command ...), confirmed by inspecting the child process command line
• Git for Windows Bash is installed, resolves through PATH, and successfully runs bash -c 'echo OK'

Reproduction

1. Install using the documented Codex workflow:

   codex plugin marketplace add trailofbits/skills
   codex plugin add gh-cli@trailofbits

2. Review and trust the plugin hooks in /hooks, then trigger a hook in a native Windows Codex session using PowerShell.

3. Codex reports:

   Hook failed
     hook exited with code 1

The failure can also be reproduced directly in PowerShell, using the actual installed plugin directory:

$env:CLAUDE_PLUGIN_ROOT = 'C:/path/to/installed/gh-cli'
Test-Path "$env:CLAUDE_PLUGIN_ROOT/hooks/intercept-github-curl.sh" # True
'{}' | bash "${CLAUDE_PLUGIN_ROOT:-.}/hooks/intercept-github-curl.sh"
$LASTEXITCODE

Bash reports:

/usr/bin/bash: /hooks/intercept-github-curl.sh: No such file or directory

In a comparison test, the same configured hook command with the same environment and {} stdin returned exit code 1 through pwsh -NoProfile -Command, but 0 through bash -c.

Cause

All five commands in hooks/hooks.json use Bash parameter expansion in the outer command string:

bash "${CLAUDE_PLUGIN_ROOT:-.}/hooks/<script>.sh"

PowerShell interprets ${CLAUDE_PLUGIN_ROOT:-.} before starting Bash. It is not PowerShell environment-variable syntax, so the plugin-root prefix disappears. Having Git Bash on PATH does not fix that parsing issue.

Expected behavior / possible fix

The documented Codex installation should launch the hooks successfully on Windows, or document this limitation explicitly.

Consider providing Windows-specific hook commands using PowerShell-compatible environment expansion, while preserving the existing Bash commands for other platforms. For example, a commandWindows override could invoke Bash with "${env:CLAUDE_PLUGIN_ROOT}/hooks/<script>.sh" instead. The scripts themselves need not change to address this command-launch failure.

Editing the installed plugin cache is only a temporary workaround because plugin updates can overwrite it.