Plugin marketplace hooks: .sh files missing execute permission on macOS Sequoia

Description

Shell scripts (.sh) installed via the claude-plugins-official marketplace lack execute permissions on macOS Sequoia (Darwin 25.4.0, Apple Silicon). This causes "Permission denied" errors when Claude Code tries to execute plugin hooks.

Steps to Reproduce

1. Install the ralph-loop plugin from the official marketplace
2. Start or stop a Claude Code session
3. The stop hook fails with:

Stop hook error: Failed with non-blocking status code: /bin/sh:
/Users/<user>/.claude/plugins/marketplaces/claude-plugins-official/plugins/ralph-loop/hooks/stop-hook.sh: Permission denied

Root Cause

All .sh files in claude-plugins-official are installed with -rw-r--r-- (644) instead of -rwxr-xr-x (755). The same plugins in the older claude-code-plugins marketplace have correct permissions.

Additionally, macOS Sequoia applies the com.apple.provenance extended attribute to downloaded files, which persists even after chmod +x and cannot be removed with xattr -d or xattr -cr. This attribute may further block execution.

Affected files (all .sh in claude-plugins-official):

• ralph-loop/hooks/stop-hook.sh
• ralph-loop/scripts/setup-ralph-loop.sh
• learning-output-style/hooks-handlers/session-start.sh
• explanatory-output-style/hooks-handlers/session-start.sh
• plugin-dev/ (multiple scripts)
• math-olympiad/ (multiple scripts)

Workaround

Run chmod +x on all .sh files in the marketplace directory:

find ~/.claude/plugins/marketplaces/claude-plugins-official -name "*.sh" -exec chmod +x {} \;

Note: this needs to be re-applied after marketplace updates.

Suggested Fix

Two possible approaches:

1. Preserve execute permissions when installing/cloning plugin repositories (ensure git clone respects filemode)
2. Invoke scripts via bash $script instead of direct execution in hooks — this bypasses both the missing +x permission and com.apple.provenance restrictions

Environment

• macOS Sequoia (Darwin 25.4.0)
• Apple Silicon (M4)
• Claude Code CLI (latest)