Superpowers from the remote marketplace installs its helper scripts without the executable bit (upstream 100755, OpenAI's copy 0644)

What version of Codex CLI is running?

codex-cli 0.154.0

What subscription do you have?

ChatGPT $100/month plan

Which model were you using?

gpt-5.6-sol. The failure happens when a helper runs, independent of the model.

What platform is your computer?

Linux 6.6.114.1-microsoft-standard-WSL2 x86_64 x86_64 (Ubuntu 24.04.4 LTS on WSL2)

What terminal emulator and version are you using (if applicable)?

Not applicable: observed in non-interactive codex exec.

Codex doctor report

No response

What issue are you seeing?

Superpowers 6.3.0 installed from openai-curated-remote has all seven shebang helpers under skills/ at 0644, so running them fails: task-brief: line 24: …/sdd-workspace: Permission denied (rc 126).

• Upstream git (obra/superpowers) records them as 100755.
• The same seven files installed through Claude Code's marketplace are byte-identical and at 0755.
• Installing from upstream's own git marketplace (codex plugin marketplace add obra/superpowers) also gives 0755.
• OpenAI's copy in openai/plugins is 0644 too: openai/plugins#388 changed start-server.sh, stop-server.sh, find-polluter.sh and render-graphs.js from 100755 to 100644, and added the three SDD helpers (task-brief, sdd-workspace, review-package) at 100644. Other plugins in that repo keep 100755.

What steps can reproduce the bug?

1. Install Superpowers from the remote plugin marketplace.
2. stat -c '%a %n' ~/.codex/plugins/cache/openai-curated-remote/superpowers/*/skills/subagent-driven-development/scripts/* → 644 for task-brief, sdd-workspace and review-package.
3. In a git repo containing a plan file with a ### Task 1 heading: …/scripts/task-brief plan.md 1 → Permission denied (rc 126).

What is the expected behavior?

The helper scripts keep the mode recorded in the plugin's source (0755), as they do when installed from upstream's git marketplace.

Additional information

The client side looks mode-preserving:

• codex-rs/core-plugins/src/plugin_bundle_archive.rs unpacks with tar 0.4.45 Entry::unpack, which by default applies mode & 0o777 with a zero mask. extraction_preserves_executable_permissions in codex-rs/core-plugins/src/remote_bundle.rs asserts this.
• Install then only rewrites JSON manifests (remote_bundle.rs) and copies with fs::copy (codex-rs/core-plugins/src/store.rs).

So the served bundle most likely already carries 0644. We could not fetch it to confirm, and we have not seen the artifact upstream uploaded. An earlier 0644 report on 6.2.0 (obra/superpowers#2040, 2026-07-25) predates #388, so a distribution or install path from before that sync also produced 0644; which stage failed is unknown.

Upstream context: obra/superpowers#2040, #2134.

Drafted by Claude Opus 5 (Claude Code 2.1.270), reviewed by Codex gpt-5.6-sol; read and posted by me.

Start with codex-rs/core-plugins/src/plugin_bundle_archive.rs and the extraction_preserves_executable_permissions test in codex-rs/core-plugins/src/remote_bundle.rs, then inspect remote_bundle.rs and store.rs. Reproduce the remote Superpowers install and compare the served bundle's modes with the installed files. Done means the seven helper scripts retain executable permissions and task-brief runs without rc 126.