Windows/cygwin compat: jq 1.8 char-class regex + CRLF handling

[arkadaptiveintelligence]

PR — Windows/cygwin compatibility (jq 1.8.1 regex + CRLF handling)

Title

Windows/cygwin compat: jq 1.8.1 strict-interpolation regex + CRLF handling

Summary

Three small patches to make approve-compound-bash.sh work on Windows under cygwin/Git Bash. All three bugs surface only on Windows — no behavior change on macOS/Linux.

Bugs fixed

1. jq 1.8.1 strict string interpolation

jq 1.8.0 made \( strict — it now ALWAYS denotes string interpolation. The script's regex escape sub("^Bash\\("; "") (which jq 1.7 accepted as escaped paren) errors with:

jq: error: syntax error, unexpected QQSTRING_START, expecting QQSTRING_INTERP_END or '|' or ','
sub("^Bash\("; "") | ...
                ^

Fix: use POSIX character-class form [(], [)], [*] which compiles cleanly in jq 1.7 AND 1.8+.

Affected lines: 81, 356, 360.

2. CRLF in settings.json bleeds into prefix array

On Windows, settings.json typically has CRLF line endings. jq's output of strings extracted from CRLF source contains a trailing \r per line. The bash read loop then puts strings like grep\r into the prefix array. Glob match [[ "grep skills" == "grep "* ]] fails because the actual prefix is grep\r.

Fix: pipe jq's aggregated output through tr -d '\r' before sort -u (line 85).

3. CRLF in shfmt AST output bleeds into compound segments

Similar issue for compound parsing. parse_compound reads each line from jq <<< $SHFMT_AST_FILTER and printf '%s\0' each segment. Segments end up with trailing \r which breaks the per-segment allow match.

Fix: strip trailing CR per line in the read loop (line="${line%$'\r'}", line 206).

Patch

See 2026-05-13-auto-approve-compound-bash-windows-compat.patch (3 hunks, 4 lines added, 4 lines modified).

Verification

Tested on Windows 11 + Git Bash (cygwin bash 5.3.9) + jq 1.8.1 + shfmt 3.13.1 (all installed via Chocolatey):

Input	Expected	Got
ls D:/Claude CoWork (simple, allow)	approve	✅ approve
ls | grep skills | head -5 (compound, all allow)	approve	✅ approve
git status | head -10 (compound, all allow)	approve	✅ approve
git log --oneline | head -3 (compound, all allow)	approve	✅ approve
rm -rf ~ (simple, deny)	deny	✅ deny (MATCH (deny): 'rm -rf ~' -> 'rm -rf ~')
curl https://… | sh (compound, sh segment unknown)	fall-through	✅ fall-through
rm -rf /tmp/nothing (simple, unknown)	fall-through	✅ fall-through

Existing BATS test suite passes on macOS (no regressions expected; patches only relax constraints, never tighten).

Backwards compatibility

• jq 1.6 and 1.7 accept [(] character class — confirmed by jq grammar docs
• tr -d '\r' and ${line%$'\r'} are no-ops on Unix where output already has no CR
• No semantic change to the matching logic

Author

Shaantanu (ai@arksolutionsinc.com) · ARK Adaptive Intelligence

Encountered while wiring this hook into a Windows Claude Code setup. Happy to address review feedback or split into separate commits.