fix(doctor): install GUARD-001 memory-sink hooks on Windows + fix agy abs-path check

[mlorentedev]

Why

Two Windows-side gaps (audit C20 + the GUARD-001 Windows gap):

• GUARD-001 never installs on Windows. setup-windows.ps1 had zero git-hooks deploy / core.hooksPath wiring. AGENTS.md advertises a machine-wide pre-commit guard that rejects MEMORY.md/memory/ outside the vault — on Windows it simply did not exist, so an agent could commit memory artifacts into any repo. install-git-hooks.sh itself noted "a Windows setup twin is a tracked follow-up." On a real box dotf doctor reported [FAIL] dispatcher not found at C:\Users\<u>\.dotfiles\git-hooks with core.hooksPath unset.
• C20 — doctor false-FAIL. checks_deploy.go gated AGY_APP_DATA with strings.HasPrefix(agyData, "/"); an absolute Windows path is not /-rooted, so dotf doctor reported "AGY_APP_DATA is relative or unset" whenever agy was on PATH.

What

• scripts/install-git-hooks.ps1 — the PowerShell twin of install-git-hooks.sh:
  • Deploy-GitHooks: clean-mirror the dispatcher tree (remove-then-copy, so a hook removed upstream never lingers) with the same safety guards (refuse a non-*\git-hooks dest, refuse $HOME\git-hooks / a drive root, no-op on self-mirror).
  • Set-GlobalHooksPath: wire global core.hooksPath only when unset; preserve+warn an unrelated value; no-op when already correct.
  • Install-GitHooks: deploy + wire.
• setup-windows.ps1 sources it and calls Install-GitHooks -DotfilesDir $DotfilesDest (non-fatal). The wired path equals the Go filepath.Join(cfg.DotfilesDir, "git-hooks") the doctor compares — the backslash path round-trips byte-for-byte through git config (verified), so dotf doctor then PASSES on Windows.
• C20 fix: strings.HasPrefix(agyData, "/") -> filepath.IsAbs(agyData).

Verification

• Pester tests/install-git-hooks.Tests.ps1: 8/8 (mirror/prune/refuse-unsafe; wire/no-op/preserve, isolated via a throwaway GIT_CONFIG_GLOBAL).
• Go TestCheckAntigravity_AbsolutePathAccepted (OS-aware): green under filepath.IsAbs, proven red under the reverted HasPrefix.
• End-to-end on a Windows box: Install-GitHooks deployed + wired a temp ~/.dotfiles\git-hooks, and dotf doctor then reported [GUARD memory-sink hooks] (1 checks, all ok).
• go build/vet/test ./... clean; PSScriptAnalyzer clean on changed .ps1; ASCII-only.

Notes

• install-git-hooks.ps1 is not in CI's hardcoded PSScriptAnalyzer file list (CI: hardening — PSScriptAnalyzer coverage, SHA-pinned actions, Go config-input coverage #692); linted locally. PSUseSingularNouns is suppressed with justification (GitHooks is inherently plural, mirrors the .sh).
• Sibling fresh-machine bugs: BUG: session-start injectors.enabled flags are dead config (never read) #690, BUG: bash shell parity — aliases never load, PATH hard-reset, no nvm #688. Spec: specs/BUG-032-windows-guard-001/.

Closes #691.

[coderabbitai]

Warning

Review limit reached

@mlorentedev, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 393eac56-c8bb-4da4-9227-289cef66c212

📥 Commits

Reviewing files that changed from the base of the PR and between 63c8db2 and d0b178c.

📒 Files selected for processing (8)

• cli/internal/doctor/checks_antigravity_test.go
• cli/internal/doctor/checks_deploy.go
• scripts/install-git-hooks.ps1
• setup-windows.ps1
• specs/BUG-032-windows-guard-001/proposal.md
• specs/BUG-032-windows-guard-001/tasks.md
• specs/BUG-032-windows-guard-001/verification.md
• tests/install-git-hooks.Tests.ps1

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/windows-guard-001-memory-sink

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}