Semgrep plugin: hook.sh runs Windows binary on WSL instead of native Linux binary

Bug Report

Plugin: semgrep@claude-plugins-official (v2.0.1)
Platform: WSL2 on Windows (tested on aarch64)

Problem

The Semgrep Guardian plugin's hook.sh script checks for WSL_DISTRO_NAME first and unconditionally executes hook-windows-amd64.exe on WSL:

if [[ -n "$WSL_DISTRO_NAME" ]]; then
  exec "$DIR/hook-windows-amd64.exe" "$@"
fi

When running Claude Code on WSL, this causes the Windows AMD64 binary to run instead of the native Linux binary. The Windows binary uses Windows file locking APIs to write credentials to Claude Code's settings.json, which is on the Linux filesystem — causing the lock to fail with:

could not lock the settings, try again

This makes every MCP tool call fail with:

Not logged into Semgrep Guardian. Ask the guardian mcp to login.

And the login tool itself always fails, making the plugin completely unusable on WSL.

Additionally, the PreToolUse/PostToolUse hooks (which also go through hook.sh) block all Write, Edit, and Bash tool calls, so the broken login creates a full deadlock — Claude Code cannot edit files to fix the problem either.

Root Cause

The WSL_DISTRO_NAME check should be removed (or moved after the native OS checks). On WSL, $OSTYPE is linux-gnu and $HOSTTYPE is x86_64 or aarch64, so the existing linux* case already handles WSL correctly with the native binary.

Fix

Remove the WSL early-exit block from hook.sh:

#!/bin/bash
DIR="$(cd "$(dirname "$0")" && pwd)"

case "$OSTYPE" in
  darwin*)
    case "$HOSTTYPE" in
      arm64) exec "$DIR/hook-darwin-arm64" "$@" ;;
      *)     exec "$DIR/hook-darwin-amd64" "$@" ;;
    esac ;;
  linux*)
    case "$HOSTTYPE" in
      aarch64) exec "$DIR/hook-linux-arm64" "$@" ;;
      *)       exec "$DIR/hook-linux-amd64" "$@" ;;
    esac ;;
  msys*|cygwin*)
    exec "$DIR/hook-windows-amd64.exe" "$@" ;;
  *)
    echo "unsupported platform: OSTYPE=$OSTYPE" >&2
    exit 2 ;;
esac

Steps to Reproduce

1. Use Claude Code on WSL2 (any distro)
2. Enable the semgrep@claude-plugins-official plugin
3. Any tool use (Write/Edit/Bash) is blocked, and login always fails with "could not lock the settings"

Workaround

Manually patch ~/.claude/plugins/cache/claude-plugins-official/semgrep/2.0.1/scripts/hook.sh to remove the WSL_DISTRO_NAME block (patch is overwritten on plugin update).