[Bug] ZCode Windows: Plugin Shell Hooks (.sh) Open Visible Git Bash Window on Every Prompt/Tool Call

Bug Description

On Windows 11, any ZCode plugin that registers shell-script hooks (.sh files) causes a visible Git Bash / mintty terminal window to pop up on the desktop each time its hooks execute. This affects every user prompt and tool call when plugins like crowdstrike-falcon-foundry are enabled, which register multiple hook types (SessionStart, UserPromptSubmit, PreToolUse).

Impact Severity: HIGH — Usability Breaking

• Visible console windows flash repeatedly during normal usage
• With active plugins: window appears on every prompt + every tool call
• Makes ZCode unusable in fullscreen apps, presentations, or screen sharing
• Looks like suspicious behavior (flashing terminals = malware-like appearance)
• Hooks may fail to execute due to terminal allocation error

---

Detailed Report

Environment

Component	Version/Value
OS	Windows 11 (build 26200, x64)
ZCode	0.16.5 (desktop)
Git for Windows	2.54.0.windows.1 (Git Bash at C:\Program Files\Git)
Plugin (Primary)	crowdstrike-falcon-foundry@claude-plugins-official v1.4.0
Plugin (Secondary)	claude-security@claude-plugins-official v0.10.0 (also reproduced)

---

Reproduction Steps

1. On Windows 11 with Git for Windows installed
2. Enable a plugin that ships .sh hooks (e.g., crowdstrike-falcon-foundry from claude-plugins-official)
3. Restart ZCode (or start a new session)
4. Send any message or invoke any skill
5. Observe: A Git Bash terminal window flashes open on each hook execution

Actual Result

A visible console window opens for EVERY hook execution.

Window Title:
/usr/bin/bash --login -i C:\Users\home.zcode\cli\plugins\cache\claude-plugins-official\crowdstrike-falcon-foundry\1.4.0\hooks...

Window Content Shows Error:
Error: Could not fork child process: There are no available terminals (-1)
(This is a mintty error — script launched through Git Bash's 
terminal emulator instead of being executed headlessly)

Expected Result

• Plugin hooks should execute hidden in the background (same behavior as macOS/Linux)
• No window should appear on desktop
• Hook scripts should actually run successfully
• Execution should use headless bash spawn, not interactive terminal

---

Root Cause Analysis

Likely Cause (from Window Title Observation)

The hook command (a .sh file path) appears to be launched via:

Git Bash's: bash --login -i → mintty (terminal emulator)
Instead of headless: bash -c (direct execution without TTY)

Technical Explanation:

Current (Broken) Behavior:

// ZCode spawns .sh hooks using:
cp.spawn('bash', ['--login', '-i', hookScriptPath], {
  // Missing: windowsHide: true
  // Missing: detached: true
  // Missing: stdio: 'pipe' (instead of 'inherit')
});
// Result: Windows creates visible conhost.exe + mintty window

Expected (Fixed) Behavior:

// Should spawn .sh hooks using:
cp.spawn('bash', ['-c', hookScriptPath], {
  windowsHide: true,      // ← KEY: Prevents window creation
  detached: false,
  stdio: ['pipe', 'pipe', 'pipe'],  // Don't inherit terminal
  shell: false  // Don't wrap in another shell
});
// Result: Headless execution, no visible window

Why Mintty Error Occurs:

The error "Could not fork child process: There are no available terminals (-1)" indicates:

1. Script tries to allocate a pseudo-terminal (PTY) via mintty
2. Windows has limited PTY availability or mintty can't allocate in this context
3. Hook fails because it requires interactive terminal that doesn't exist
4. Root issue: Hooks should NOT require PTY — they're automated scripts

---

Affected Plugins & Hook Frequency

Primary Affected Plugin: crowdstrike-falcon-foundry

This plugin registers hooks that fire on:

Hook Type	When It Fires	Window Flashes
SessionStart	Every new session	✅ Yes
UserPromptSubmit	Every user message	✅ Yes
PreToolUse	Every tool call (all tools + Bash + Skill)	✅ Yes

Total Window Flashes Per Interaction:

• Single message: ~3-5 windows (SessionStart + UserPromptSubmit + multiple PreToolUse)
• Complex task with many tool calls: Dozens of window flashes

Secondary Confirmed: claude-security@v0.10.0

Same issue reproduced — confirms this is not plugin-specific but a ZCode Windows hook execution problem.

---

Evidence

Screenshot Description (Provided)

Shows:

1. Visible Git Bash window with full path to hook script in title bar
2. Mintty error message about unable to fork child process
3. Window appearing over other applications

Window Title Pattern:

/usr/bin/bash --login -i C:\Users\<user>\.zcode\cli\plugins\cache\claude-plugins-official\crowdstrike-falcon-foundry\1.4.0\hooks\<hook-name>.sh

Key observations from title:

• Uses --login -i flags (interactive login shell) — unnecessary for automation
• Points to real .sh file path in plugin cache
• Goes through /usr/bin/bash (Git Bash's bash, not WSL or native Windows bash)

---

Proposed Fix

Immediate Fix Required:

Option A: Add windowsHide to Spawn Call (Minimal Change)

  const hookProcess = spawn('bash', [
-   '--login', '-i',
+   '-c',
    hookScriptPath
  ], {
+   windowsHide: true,     // Hide console window on Windows
+   detached: false,
    stdio: ['pipe', 'pipe', 'pipe'],  // Don't inherit terminal
+   env: { ...process.env, TERM: 'dumb', CI: 'true' }  // Non-interactive mode
  });

Option B: Use git-bash.exe Directly (Alternative)

// Instead of relying on system bash which may resolve to Git Bash:
const gitBashPath = path.join(
  process.env['ProgramFiles'] || 'C:\Program Files',
  'Git', 'bin', 'bash.exe'
);

spawn(gitBashPath, ['-c', hookScriptPath], {
  windowsHide: true,
  stdio: 'pipe'
});

Option C: Platform-Specific Hook Runner

function executeHook(hookPath) {
  if (process.platform === 'win32') {
    // Windows: Use headless bash, no terminal
    return spawn('bash.exe', ['-c', hookPath], {
      windowsHide: true,
      stdio: 'pipe',
      env: { ...process.env, MSYSTEM: 'MINGW64', TERM: 'dumb' }
    });
  } else {
    // macOS/Linux: Normal execution (already works)
    return spawn('/bin/bash', [hookPath], { stdio: 'pipe' });
  }
}

---

Workarounds (For Users Until Fix)

Workaround 1: Disable Affected Plugins

• Remove crowdstrike-falcon-foundry and similar plugins with .sh hooks
• Loss: Plugin functionality unavailable

Workaround 2: Use WSL Instead of Git Bash

• If user has WSL installed, ZCode might use WSL's bash instead
• Uncertain: Depends on ZCode's bash detection logic

Workaround 3: Rename .sh Hooks to .bat/.cmd

• Convert hook scripts to Windows batch format
• Not practical: Requires modifying plugin internals

Workaround 4: Run ZCode in Linux VM/Container

• Use WSL2 or Docker for ZCode
• Extreme workaround: Should not be necessary

Assessment: No practical workaround exists — users must disable plugins or tolerate flashing windows.

---

Impact Assessment

Metric	Value
Platforms Affected	Windows only (macOS/Linux work correctly)
ZCode Versions Affected	0.16.5 (and likely earlier versions with plugin support)
Plugins Affected	Any plugin using .sh hook scripts
User Experience Impact	HIGH — flashing windows disrupt workflow
Presentation Impact	CRITICAL — unusable for screen sharing/demos
Security Perception	LOW — looks like malware behavior to unfamiliar users

---

Related Issues

This is related to (but distinct from) previously reported Agent Bash tool console flash issues:

• Previous issue: Agent shell commands showing conhost.exe windows
• This issue: Plugin hook execution showing mintty/Git Bash windows
• Both share root cause: missing windowsHide: true on Windows spawns
• Both need same fix pattern applied to different code paths

If previous fix was applied to Agent Bash tool but not to plugin hook runner, that explains why this persists.

---

Testing Recommendations

To validate fix, Z.ai team should test:

1. Enable crowdstrike-falcon-foundry on Windows 11 with Git for Windows
2. Send multiple messages and trigger various tool calls
3. Verify: No visible windows appear at any point
4. Verify: Hooks actually execute successfully (check plugin functionality works)
5. Test on: Windows 10, Windows 11, different Git for Windows versions
6. Regression test: Confirm macOS/Linux still work after fix

---

Additional Notes

Why This Matters Beyond Annoyance:

1. Enterprise Security Tools: crowdstrike-falcon-foundry is a security plugin — security teams need it working without UI disruption
2. Professional Use Cases: Developers presenting demos, screen-sharing with clients, recording tutorials cannot use ZCode with this bug
3. Accessibility: Flashing windows can trigger photosensitivity issues in some users
4. Performance: Each window creation/consumption takes ~100-500ms — measurable lag with many hooks

The Fix Is Trivial:

Adding windowsHide: true to the spawn options is a one-line change that immediately resolves this. The complexity is in finding all spawn calls in the plugin hook execution path, not in the fix itself.

---

Submitted by: Roman Galaxys10 (Roman) — Z.ai Volunteer Ambassador
Discord: bignavi_x
GitHub: romangalaxys10-spec
Source: Discord #✅│report-a-bug Channel — User: King_of_Dia
Thread: https://discord.com/channels/1346756824233148527/1543653341530423487

Locate the plugin hook runner and its child-process spawn calls, then reproduce the issue on Windows 11 with Git for Windows and a plugin containing .sh hooks. Done means hooks run without visible Git Bash or mintty windows, still execute successfully, and behavior remains correct on macOS and Linux.