Skip to content

fix(plugin): invoke hook via bash to avoid +x permission requirement#245

Merged
darrenhinde merged 8 commits intomainfrom
fix/plugin-hook-escaping
Feb 23, 2026
Merged

fix(plugin): invoke hook via bash to avoid +x permission requirement#245
darrenhinde merged 8 commits intomainfrom
fix/plugin-hook-escaping

Conversation

@darrenhinde
Copy link
Owner

Summary

  • Root cause: When Claude Code installs a plugin from the marketplace it copies files with 644 permissions (no execute bit). The previous hooks.json tried to exec run-hook.cmd directly, which requires +x. This fails silently — the hook never fires.
  • Fix: Use bash "${CLAUDE_PLUGIN_ROOT}/hooks/session-start.sh" in the command. bash reads the file as a script — it doesn't need +x, only read permission (644). This is the correct pattern for plugin hooks per the Claude Code docs.
  • Cleanup: Remove run-hook.cmd and the extensionless session-start copy — both were part of the now-unnecessary Windows wrapper approach. session-start.sh is now tracked as 100644 (read-only) in git, which is exactly what gets installed.
  • Version bump: 1.0.01.0.1 so the marketplace detects the update and re-installs for existing users.
  • Description update: Rebranded to OpenAgentsControl — prefix so the plugin is clearly identified as part of this repo in the marketplace listing.

Type of Change

  • New feature (agent, command, tool)
  • Bug fix
  • Documentation
  • Refactoring
  • CI/CD

Checklist

  • Tests pass locally
  • Documentation updated (if needed)
  • Follows CONTRIBUTING.md

Testing

  • Confirmed git ls-files --stage shows session-start.sh as 100644
  • Confirmed bash "${CLAUDE_PLUGIN_ROOT}/hooks/session-start.sh" runs correctly without +x
  • Confirmed JSON output is valid and hookSpecificOutput.additionalContext is present

- Update .context-manifest.json to include profile and detailed source information.
- Revise context-scout.md to clarify context root discovery and navigation.
- Modify commands to replace deprecated skills with updated ones (brainstorming → approach, systematic-debugging → debugger).
- Streamline install-context.md for clarity and remove interactive profile selection.
- Improve oac-status.md to provide a more comprehensive status report.
- Add OAC system paths to session-start.sh for better context management.
- Remove obsolete skills and improve documentation for existing commands.
- Fix double-escaped skill catalogue: use $'\n' real newlines instead of
  literal \n strings so escape_for_json encodes them correctly as \n in JSON
- Fix OAC_SYSTEM_PATHS embedded raw into JSON string: build with real newlines
  and pass through escape_for_json before interpolation
- Remove SessionStart matcher so hook fires on every session start
  unconditionally (startup, resume, clear, compact and any future types)
- Remove redundant async:false field; add explicit timeout:30
…dled context

- Add run-hook.cmd polyglot wrapper for Windows compatibility — routes
  session-start through bash on Windows (Git Bash, MSYS2, Cygwin) and
  falls back silently if no bash found so plugin still loads
- Fix warning manifest check to look in correct locations: project-local
  .claude/.context-manifest.json and global ~/.claude/.context-manifest.json
  instead of the plugin root (which is never writable for marketplace users)
- Update warning message skill name: install-context -> context-setup
- Restore SessionStart matcher (startup|resume|clear|compact) for explicit
  session type filtering
- Remove bundled scripts/context/ tree (250+ files) — context is downloaded
  at runtime via /install-context, not shipped with the plugin
Plugin files installed from marketplace are copied with 644 permissions
(no execute bit). Invoking session-start.sh directly requires +x, which
fails silently. Using 'bash "${CLAUDE_PLUGIN_ROOT}/hooks/session-start.sh"'
bypasses the execute bit entirely — bash reads the file, not executes it.

- hooks.json: replace run-hook.cmd indirection with direct bash invocation
- hooks.json: add explicit timeout:30, remove async:false (default)
- Remove run-hook.cmd and extensionless session-start (no longer needed)
- Ensure session-start.sh tracked as 100644 (read-only) in git
- plugin.json: bump version 1.0.0 -> 1.0.1 so marketplace picks up changes
- plugin.json: update description to OpenAgentsControl branding
…n, remove run-hook.cmd and session-start duplicates
@darrenhinde darrenhinde merged commit 1f9f2c0 into main Feb 23, 2026
5 checks passed
@darrenhinde darrenhinde deleted the fix/plugin-hook-escaping branch February 23, 2026 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant