[BUG] Failing asyncRewake Stop hook causes unbounded model re-wake loop (high token burn)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What happened

A Stop hook declared with asyncRewake: true that fails to execute re-wakes the model indefinitely. Each rewake produces a turn, which fires Stop again, which fails again. ~30 forced round-trips in one session, each re-sending full conversation context. No user input in between. Only noticed via usage.

Why it loops

asyncRewake treats a nonzero exit as "blocking error → wake the model." It does not distinguish the hook ran and found something from the hook could not start. A hook broken at the launch level satisfies the rewake condition on every single invocation, forever.

Expected

A hook that fails to execute should not trigger a rewake. Failing that, rewakes need a per-hook failure counter that disables the hook after N consecutive launch failures, and the loop needs a cap regardless of cause.

Reproducer

Any plugin hook with asyncRewake: true whose command is non-executable. Exact case below.

The triggering case

security-guidance plugin (Security Guidance, marketplace knowledge-work-plugins), on Windows 11. Its hooks/sg-python.sh resolves python3.12, which on this machine exists only as the Microsoft Store app-execution alias:

%LOCALAPPDATA%\Microsoft\WindowsApps\python3.12.exe
-> Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_...

Store Python runs in an AppContainer that cannot read %APPDATA%\Roaming\Claude\..., where the plugin is installed. It reports the denial as:

can't open file '...\hooks\security_reminder_hook.py': [Errno 2] No such file or directory

The file exists (116 KB, executable, verified). The error names a missing file but is actually a sandbox permission failure — misleading, and it sent me down the wrong diagnostic path initially.

A real non-Store Python 3.12 is installed at %LOCALAPPDATA%\Programs\Python\Python312\, but provides no python3.12 name, so the launcher falls through to the Store stub every time.

Two secondary issues

sg-python.sh should reject the WindowsApps alias explicitly, or fall back to py -3.12 / a real interpreter, rather than failing opaquely.
Setting enabledPlugins: {"security-guidance@knowledge-work-plugins": false} in user settings did not disable the plugin. It's a claude.ai-synced plugin, and knowledge-work-plugins isn't in local known_marketplaces.json, so there appears to be no local off switch short of syncClaudeAiPlugins: false — which is all-or-nothing across every synced plugin. (Caveat: I'm not certain a restart occurred between setting this and re-testing, so treat as probable, not confirmed.)

What Should Happen?

sdfg

Error Messages/Logs

sdfg

Steps to Reproduce

sdfg

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

sdfg

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_