[BUG] Official marketplace plugins fail validation — 'category' and 'source' keys leak into cached plugin.json

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Several plugins from claude-plugins-official fail to load with manifest validation errors:

✘ superpowers@claude-plugins-official
   Plugin superpowers has an invalid manifest file at
   ~/.claude/plugins/cache/claude-plugins-official/superpowers/4.3.0/.claude-plugin/plugin.json.

   Validation errors: : Unrecognized keys: "category", "source"

✘ figma@claude-plugins-official
   Plugin figma has an invalid manifest file at
   ~/.claude/plugins/cache/claude-plugins-official/figma/1.1.0/.claude-plugin/plugin.json.

   Validation errors: : Unrecognized keys: "category", "source"

Root cause: The marketplace.json in claude-plugins-official defines "category" and "source" on every plugin entry. When Claude Code fetches URL-sourced external plugins (e.g., superpowers, figma, atlassian, Notion, sentry, vercel, etc.), these marketplace-level metadata fields get written into the cached per-plugin plugin.json. The plugin.json schema validator then rejects them as unrecognized keys.

This affects all URL-sourced plugins (those with "source": {"source": "url", "url": "..."} in marketplace.json), including: superpowers, figma, atlassian, Notion, sentry, vercel, posthog, pinecone, huggingface-skills, coderabbit, circleback, firecrawl, and sonatype-guide.

Plugins with local source paths (e.g., "source": "./plugins/commit-commands") are unaffected, presumably because their plugin.json is read directly from the repo checkout rather than being synthesized from marketplace metadata.

What Should Happen?

Either:

1. The fetch/cache logic should strip marketplace-only fields (category, source) before writing plugin.json, or
2. The plugin.json validator should accept (and ignore) these fields, or
3. The marketplace.json should not embed these fields into individual plugin manifests

Error Messages/Logs

Validation errors: : Unrecognized keys: "category", "source"

Steps to Reproduce

1. Install any URL-sourced plugin from the official marketplace:

``
claude plugin install superpowers@claude-plugins-official
``

1. Restart Claude Code
2. Observe the validation error on startup

Claude Model

Opus

Is this a regression?

I don't know

Claude Code Version

2.1.45

Platform

Other

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

Platform: Claude Code CLI (Anthropic API)

Workaround: Manually edit the cached plugin.json files to remove the "category" and "source" keys. For example, for superpowers:

~/.claude/plugins/cache/claude-plugins-official/superpowers/4.3.0/.claude-plugin/plugin.json

Remove the "category" and "source" entries from the JSON. This holds until the next claude plugin update re-fetches them from the marketplace.

There is no way to install URL-sourced plugins outside of a marketplace, so the only alternative is to not use the affected plugins until this is fixed.