[BUG] Windows desktop (MSIX): plugin hook scripts invisible to externally-spawned interpreter — every hook ENOENTs and asyncRewake Stop hooks loop forever

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

On the Windows desktop app (MSIX build), plugin files for Code-tab / local-agent-mode sessions are materialized under %APPDATA%\Claude\local-agent-mode-sessions\<session>\<run>\rpm\plugin_* — but because the app is MSIX-packaged, that path only exists inside the package's virtualized view (physically backed by %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\...).

Plugin hooks, however, spawn an external interpreter. The security-guidance plugin's hooks run bash sg-python.sh <plugin>/hooks/security_reminder_hook.py, and the wrapper resolves a system Python installed outside the package container (here: python.org PyManager at %LOCALAPPDATA%\Python\pythoncore-3.14-64\python.exe). That process resolves the literal path against the real filesystem, where %APPDATA%\Claude does not exist:

C:\Users\<user>\AppData\Local\Python\pythoncore-3.14-64\python.exe: can't open file
'C:\Users\<user>\AppData\Roaming\Claude\local-agent-mode-sessions\<a>\<b>\rpm\plugin_01YBNfaNwQztYsnUydt8m47G\hooks\security_reminder_hook.py':
[Errno 2] No such file or directory

So every hook invocation fails — and because security-guidance registers its Stop/SubagentStop hooks with asyncRewake: true, each turn-end failure re-wakes the model with "Background security review found issues", the model responds, the turn ends, the hook fails again... an infinite rewake loop. In one real session this produced ~100 consecutive spurious rewake turns (each one a billed model turn) and flooded the transcript with acknowledgments. The UserPromptSubmit and PostToolUse (Edit/Write) registrations of the same script also error on every prompt and file edit.

Diagnosis is extra-confusing because the session's own Read/Glob tools run in-container and do see the file (the full 2,427-line script reads fine), while an in-session PowerShell reports Test-Path 'C:\Users\<user>\AppData\Roaming\Claude' -> False running as the real user.

Steps to Reproduce

1. Windows 11, Claude desktop app installed as MSIX (2.2553.1.0, PackageFamilyName Claude_pzs8sxrjxfjjc).
2. Python installed outside any package container (e.g. python.org PyManager) and resolvable by the hook wrapper.
3. security-guidance plugin enabled (v2.0.8).
4. Start a Code-tab (local agent mode) session; let any turn end, or make any file edit.
5. Observe the [Errno 2] hook error, and on Stop: the endless "Background security review found issues" rewake loop.

Expected Behavior

Hook subprocesses resolve the same plugin files the app materialized — either by materializing runtime plugin files to a non-virtualized location, by spawning hook processes inside the package context, or by expanding ${CLAUDE_PLUGIN_ROOT} to the physical LocalCache path when packaged. Independently: an asyncRewake hook that fails identically N times in a row should trip a circuit-breaker rather than looping forever.

Actual Behavior

Every hook invocation ENOENTs; asyncRewake Stop hooks loop indefinitely, burning turns and flooding the transcript.

Environment

• Windows 11 Pro 10.0.26200
• Claude desktop app 2.2553.1.0 (MSIX, Claude_pzs8sxrjxfjjc)
• Claude Code CLI 2.1.236
• Python 3.14.3 (python.org PyManager, %LOCALAPPDATA%\Python\pythoncore-3.14-64)
• Plugin: security-guidance v2.0.8

Workarounds found

1. Per-session: create a real-filesystem no-op stub at the exact expected path (sys.exit(0)) — hooks then succeed silently; the loop stops. Doesn't survive new sessions (path embeds session IDs).
2. Machine-wide: junction the real %APPDATA%\Claude -> %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude, after which external processes resolve the store and the plugin works as designed.
3. Disable the security-guidance plugin.

Related

• #94254 — same MSIX virtualization mechanism, opposite direction (session tool writes to %LOCALAPPDATA% invisible outside the container)
• #94412 — feature request to store configuration outside MSIX AppData

---
Filed on behalf of the user by a Claude Code session that diagnosed the loop live from inside it.