[BUG] Plugin system should validate system dependencies at install time, not silently fail at runtime

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When Claude Code plugins are installed that require external system tools (e.g. node, semgrep), there is no validation at install time. The missing tools are only discovered when hooks fail at session start, showing cryptic SessionStart: startup hook error messages with no explanation of what's missing or how to fix it.

What Should Happen?

Expected behavior

At plugin install time, Claude Code should:

• Declare system requirements in plugin metadata (e.g. requires: ["node>=18", "semgrep"])
• Check those requirements during installation
• Either block install with a clear message ("This plugin requires Node.js — install it with brew install node") or at minimum warn the user

Actual behavior

Plugins install silently. Hooks fail at every session start with generic errors. Users have no way to diagnose which plugin is failing or why without manual investigation.

Error Messages/Logs

The following errors appeared 5 times at session start (one per failing hook):                                                                  
                  
  SessionStart: startup hook error                                                                                                                
                  
  No stack trace, hook name, plugin name, or missing dependency information was surfaced in the UI.                                               
                                                                                                                                                  
  **Hooks that were failing and why:**                                                                                                            
                                                                                                                                                  
  | Hook | Plugin | Root Cause |                                                                                                                  
  |------|--------|------------|
  | `node hooks/session-start-seen-skills.mjs` | `vercel@claude-plugins-official` | `node` not installed |                                        
  | `node hooks/session-start-profiler.mjs` | `vercel@claude-plugins-official` | `node` not installed |                                           
  | `node hooks/inject-claude-md.mjs` | `vercel@claude-plugins-official` | `node` not installed |                                                 
  | `semgrep mcp -k inject-secure-defaults` | `semgrep@claude-plugins-official` | `semgrep` not installed |                                       
  | `scripts/check_version.sh` | `semgrep@claude-plugins-official` | `semgrep` not installed (exits 1) |

Steps to Reproduce

1. Install the Vercel plugin (vercel@claude-plugins-official) on a machine without Node.js installed
2. Install the Semgrep plugin (semgrep@claude-plugins-official) on a machine without the Semgrep CLI installed
3. Start a new Claude Code session
4. Observe multiple SessionStart: startup hook error messages with no actionable information

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.77 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

### Additional Context

The Vercel plugin was updated on 2026-03-16 from version 1.0.0 (no hooks) to a new version that introduced three SessionStart hooks
requiring Node.js. The Semgrep plugin was newly installed on the same date. Neither flagged missing dependencies during or after installation.

Workaround: Manually install the missing tools (brew install node, brew install semgrep) after diagnosing the failures.