[BUG] Marketplace plugin updates not detected for npm sourced plugins

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What's Wrong?

When using npm-sourced plugins from a private registry, claude plugin update does not detect new versions even when:

• The marketplace.json has been updated with the new plugin version
• The npm package has been published to the registry at the new version
• The marketplace cache is up to date

The command reports "already at the latest version" with the old version number, even though a newer version is available.

Workaround

Manually run npm update in the npm-cache directory:

cd ~/.claude/plugins/npm-cache
npm update @org/test-plugin --registry=https://registry.example.com/

After this, claude plugin update will correctly detect and report version 1.1.0.

Related Issues

This appears to be a variant of #14061 (plugin cache not invalidated on update), but specific to npm-sourced plugins rather than git-sourced plugins. The issue there focuses on git-based marketplaces where the marketplace repo is cloned locally. For npm sources, the plugin comes from an npm registry, and Claude Code needs to run npm commands to check for and install updates (theoretically?).

What Should Happen?

claude plugin update <plugin>@<marketplace> should:

1. Read the plugin version from the cached marketplace.json
2. Compare with the installed version in ~/.claude/plugins/npm-cache/node_modules/
3. When marketplace shows a newer version, run npm update or npm install <package>@<version> to fetch the new version
4. Update the installed plugin to use the new version

Error Messages/Logs

$ claude plugin marketplace update my-marketplace
Updating marketplace: my-marketplace...
Downloading marketplace from https://registry.example.com/marketplace.json
Validating marketplace data
Saving marketplace to cache
✔ Successfully updated marketplace: my-marketplace

$ claude plugin update my-plugin@my-marketplace
Checking for updates for plugin "my-plugin@my-marketplace" at user scope…
✔ my-plugin is already at the latest version (1.2.1).


**Evidence of version mismatch:**

1. Cached marketplace shows 1.4.0:

$ cat ~/.claude/plugins/marketplaces/my-marketplace | jq '.plugins[] | select(.name=="my-plugin") | .version'
"1.4.0"


2. npm registry has 1.4.0:

$ npm view @example/my-plugin@1.4.0 version --registry=https://registry.example.com/
1.4.0


3. npm-cache still has 1.2.1:

$ cat ~/.claude/plugins/npm-cache/node_modules/@example/my-plugin/.claude-plugin/plugin.json | jq -r '.version'
1.2.1

$ cat ~/.claude/plugins/npm-cache/package.json | jq '.dependencies'
{
  "@example/my-plugin": "^1.2.1"
}

Steps to Reproduce

1. Set up a private npm registry (e.g., Nexus, Verdaccio, Artifactory)

1. Create a marketplace.json with an npm-sourced plugin:

{
  "name": "test-marketplace",
  "plugins": [
    {
      "name": "test-plugin",
      "source": {
        "source": "npm",
        "package": "@org/test-plugin",
        "version": "1.0.0",
        "registry": "https://registry.example.com/"
      }
    }
  ]
}

1. Add the marketplace and install the plugin:

/plugin marketplace add https://registry.example.com/marketplace.json
/plugin install test-plugin@test-marketplace

1. Publish a new version (e.g., 1.1.0) of the plugin to your npm registry

1. Update marketplace.json to reference the new version:

{
  "source": {
    "source": "npm",
    "package": "@org/test-plugin",
    "version": "1.1.0",
    "registry": "https://registry.example.com/"
  }
}

1. Run marketplace update:

claude plugin marketplace update test-marketplace

1. Try to update the plugin:

claude plugin update test-plugin@test-marketplace

Expected: Plugin updates to 1.1.0
Actual: Reports "already at the latest version (1.0.0)"

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.72 (Claude Code)

Platform

AWS Bedrock

Operating System

Other Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

The plugin version can be specified both in the source.version field (for npm) and at the top level of the plugin entry. In our case, both show the new version in marketplace.json, but claude plugin update still reports the old version as latest, suggesting it's checking the npm-cache without running npm commands to detect updates.