Plugin loader ignores installed_plugins.json cache, re-clones GitHub-sourced plugins on every startup

Bug Description

The plugin loader re-resolves plugin versions from source on every startup, ignoring locally cached version data in installed_plugins.json. For plugins sourced from GitHub repos (marketplace source: "github"), this triggers a git clone via SSH on every cold start. After system suspend/resume (or any network disruption), these clones hang indefinitely with no timeout, making Claude Code completely non-responsive at startup.

Reproduction Steps

1. Install a plugin from a marketplace that uses {"source":"github","repo":"..."} per plugin (e.g., pleaseai marketplace)
2. Verify the plugin is cached in ~/.claude/plugins/cache/ and recorded in ~/.claude/plugins/installed_plugins.json with version and SHA
3. Suspend the system and resume (or disable network)
4. Launch Claude Code
5. Startup hangs indefinitely — no timeout, no error, no way to proceed

Expected Behavior

The loader should:

1. Check installed_plugins.json for a cached version
2. Verify the cached path exists on disk
3. Use the cached plugin — skip the clone
4. Only clone when cache is missing, corrupted, or an explicit update is requested

Actual Behavior

The loader logs:

No version found for code-review@pleaseai, using 'unknown'
Caching plugin from source: {"source":"github","repo":"pleaseai/code-review-plugin"} to temporary path ...

It ignores the fact that installed_plugins.json already has version: "0.1.0" and a valid cached path. It performs a fresh git clone git@github.com:... via SSH every startup.

Evidence from Debug Logs

Working session (pre-suspend): Plugin clone takes ~1.6s, total startup ~2.9s
Post-suspend session: Plugin clone takes ~44.5s, total startup ~48s
Subsequent attempts: Clone never completes, startup hangs (debug log ends mid-clone, no [STARTUP] Commands and agents loaded line)

The installed_plugins.json has full cache data for the affected plugins:

"code-review@pleaseai": [{
    "installPath": "~/.claude/plugins/cache/pleaseai/code-review/0.1.0",
    "version": "0.1.0",
    "gitCommitSha": "d21d8f6233310ec81183ed09b469561454fba299"
}]

The cache directory exists with complete plugin artifacts. The loader simply doesn't consult it.

Impact

• Severity: High — Claude Code becomes completely unusable after suspend/resume until the user manually identifies and disables the offending plugins
• Affected plugins: Any plugin from a marketplace using {"source":"github"} without version pinning in the marketplace manifest
• Not affected: Official marketplace plugins (bundled in marketplace repo, use local paths), superpowers-marketplace plugins (use {"source":"url"} with version in manifest)

Workaround

Disable affected plugins in settings.json:

"code-review@pleaseai": false,
"gemini-cli-security@pleaseai": false

Suggested Fix

Two issues should be addressed:

1. Use the cache: Before attempting any network fetch, check installed_plugins.json for a valid cached version and path. Only clone if the cache entry is missing or the cached directory doesn't exist.

1. Add a timeout to git clone: Even when a clone is necessary, it should have a timeout (e.g., 10s). A startup path should never be able to hang indefinitely on a network operation.

Environment

• Claude Code CLI (latest as of 2026-02-12)
• Linux 6.8.0-87-generic (Ubuntu)
• Plugins from pleaseai marketplace (code-review@pleaseai, gemini-cli-security@pleaseai)