[BUG] `strictKnownMarketplaces` silently drops `{"source":"pluginDirectory"}`, so the built-in Anthropic Directory can't be allowed

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

With strictKnownMarketplaces set in managed settings, the built-in Anthropic Directory marketplace (anthropic-plugin-directory) is blocked. The build has a policy sentinel for allowing it, {"source": "pluginDirectory"} but adding it to strictKnownMarketplaces has no effect. The entry is dropped without a visible warning and the Directory stays blocked.

Likely cause, from inspecting the shipped builds (static analysis only): the pluginDirectory source type first appears in 2.1.287, and only in the blockedMarketplaces schema. The strictKnownMarketplaces schema (and its alias allowedMarketplaces) is the plain source union without it. The runtime matching code and the schema description both treat the entry as valid for the allowlist, so the entry appears to be removed by validation before it is matched.

What Should Happen?

The sentinel's schema description says: "In strictKnownMarketplaces: allow it (by default any allowlist blocks it)." Adding {"source": "pluginDirectory"} to strictKnownMarketplaces should allow the Anthropic Directory, and /plugin should stop showing "blocked by your organization".

Error Messages/Logs

$ claude plugin marketplace add anthropic-plugin-directory
✘ Anthropic Directory is blocked by your organization. Your administrator's marketplace allowlist (strictKnownMarketplaces) does not include the Anthropic Directory. It can't be turned on here.

/plugin > Marketplaces:
  anthropic-plugin-directory
    Source: Built in (Anthropic Directory) — blocked by your organization

Steps to Reproduce

1. In managed-settings.json set:

"strictKnownMarketplaces": [
{ "source": "github", "repo": "anthropics/claude-plugins-official" },
{ "source": "directory", "path": "C:\\Program Files\\ClaudeCode\\marketplace" },
{ "source": "pluginDirectory" }
]

1. Start a new shell and run: claude plugin marketplace add anthropic-plugin-directory
2. Observe the block message above. The other two entries work normally.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.295

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Related: #34873 (empty strictKnownMarketplaces blocks the official marketplace), #86166
(strictKnownMarketplaces schema/runtime mismatch for source "settings").

Docs: pluginDirectory is not listed among the allowlist source types at
https://code.claude.com/docs/en/plugins/org, so admins have no documented way to allow the Directory.

Method: I compared the embedded schemas in the win32-x64 builds for 2.1.273, 2.1.280-2.1.295.
I did not run the old binaries.