fix: normalize platform keys and repository prefix in hook config

[John-David Dalton (jdalton)]

Use win- instead of win32- for Windows platform keys. Add github: prefix to repository fields.

---

Note

Low Risk
Low risk config/compatibility change that only affects how the hook resolves download URLs and platform lookups for Windows binaries.

Overview
Normalizes the hook’s external tool metadata to use github:-prefixed repository values and changes Windows platform keys from win32-x64 to win-x64 in external-tools.json.

Updates the setup script (index.mts) to compute platformKey as win-<arch> on Windows so Zizmor and Socket Firewall downloads resolve the correct assets/checksums.

^{Reviewed by Cursor Bugbot for commit b239a7b. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Repository github: prefix breaks all download URLs
  • Added stripRepoPrefix() helper to both index.mts and update.mts that strips the 'github:' prefix from repository values before they are interpolated into GitHub URLs and API calls.

Or push these changes by commenting:

@cursor push 92f82ebc0e

Preview (92f82ebc0e)

diff --git a/.claude/hooks/setup-security-tools/index.mts b/.claude/hooks/setup-security-tools/index.mts
--- a/.claude/hooks/setup-security-tools/index.mts
+++ b/.claude/hooks/setup-security-tools/index.mts
@@ -53,6 +53,10 @@
 
 // ── Shared helpers ──
 
+function stripRepoPrefix(repo: string): string {
+  return repo.replace(/^github:/, '')
+}
+
 function findApiKey(): string | undefined {
   const envKey = process.env['SOCKET_API_KEY']
   if (envKey) return envKey
@@ -126,7 +130,7 @@
   if (!asset) throw new Error(`Unsupported platform: ${platformKey}`)
   const expectedSha = ZIZMOR.checksums?.[asset]
   if (!expectedSha) throw new Error(`No checksum for: ${asset}`)
-  const url = `https://github.com/${ZIZMOR.repository}/releases/download/v${ZIZMOR.version}/${asset}`
+  const url = `https://github.com/${stripRepoPrefix(ZIZMOR.repository!)}/releases/download/v${ZIZMOR.version}/${asset}`
 
   logger.log(`Downloading zizmor v${ZIZMOR.version} (${asset})...`)
   const { binaryPath: archivePath, downloaded } = await downloadBinary({
@@ -184,7 +188,7 @@
   const prefix = isEnterprise ? 'sfw' : 'sfw-free'
   const suffix = sfwPlatform.startsWith('windows') ? '.exe' : ''
   const asset = `${prefix}-${sfwPlatform}${suffix}`
-  const url = `https://github.com/${sfwConfig.repository}/releases/download/${sfwConfig.version}/${asset}`
+  const url = `https://github.com/${stripRepoPrefix(sfwConfig.repository!)}/releases/download/${sfwConfig.version}/${asset}`
   const binaryName = isEnterprise ? 'sfw' : 'sfw-free'
 
   // Download (with cache + checksum).

diff --git a/.claude/hooks/setup-security-tools/update.mts b/.claude/hooks/setup-security-tools/update.mts
--- a/.claude/hooks/setup-security-tools/update.mts
+++ b/.claude/hooks/setup-security-tools/update.mts
@@ -82,6 +82,10 @@
   return Date.now() - published >= COOLDOWN_MS
 }
 
+function stripRepoPrefix(repo: string): string {
+  return repo.replace(/^github:/, '')
+}
+
 function versionFromTag(tag: string): string {
   return tag.replace(/^v/, '')
 }
@@ -146,7 +150,7 @@
     return { tool, skipped: true, updated: false, reason: 'not in config' }
   }
 
-  const repo = toolConfig.repository ?? 'zizmorcore/zizmor'
+  const repo = stripRepoPrefix(toolConfig.repository ?? 'zizmorcore/zizmor')
 
   let release: GhRelease
   try {
@@ -265,10 +269,11 @@
     return { tool: toolName, skipped: true, updated: false, reason: 'not in config' }
   }
 
-  const repo = toolConfig.repository
-  if (!repo) {
+  const rawRepo = toolConfig.repository
+  if (!rawRepo) {
     return { tool: toolName, skipped: true, updated: false, reason: 'no repository' }
   }
+  const repo = stripRepoPrefix(rawRepo)
 
   let release: GhRelease
   try {

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b239a7b. Configure here.}

[cursor]

Repository github: prefix breaks all download URLs

High Severity

The repository values in external-tools.json now include a github: prefix (e.g. "github:zizmorcore/zizmor"), but the URL construction in index.mts directly interpolates ZIZMOR.repository and sfwConfig.repository into https://github.com/${...}/releases/.... This produces broken URLs like https://github.com/github:zizmorcore/zizmor/releases/..., causing all binary downloads to fail. The same issue exists in update.mts where repository is passed to ghApiLatestRelease() and used in fallback URL construction.

Additional Locations (1)

• .claude/hooks/setup-security-tools/index.mts#L186-L187

 

^{Reviewed by Cursor Bugbot for commit b239a7b. Configure here.}