Cowork remote plugins: no path to force-update stale marketplace cache (Windows)

Summary

Cowork's remote plugin system serves stale marketplace content with no user-accessible workaround. Unlike the CLI plugin system (where users can git pull the local marketplace clone per #29071), Cowork mounts remote plugins read-only from server-side infrastructure. When the server cache is stale, the user is stuck.

Environment

• Platform: Windows 11 Pro 10.0.26100
• Cowork: Latest as of 2026-03-20
• Marketplace: Private org marketplace (CEG-Solutions/ceg-cowork-plugins)

Steps to reproduce

1. Install a plugin from an org marketplace in Cowork (e.g., refinery v2.0.0)
2. Push fixes to the marketplace repo's main branch (confirmed via gh api)
3. Bump version in marketplace.json from 2.0.0 to 2.0.1
4. In Cowork, click "Check for updates" → reports "all skills up to date"
5. Close and reopen Cowork (twice) → still reports up to date
6. Uninstall and reinstall the plugin → reinstalls the old 2.0.0 content

What I tried (exhaustive)

| Attempt | Result |
|---------|--------|
| Close/reopen Cowork (X button, twice) | No change |
| Uninstall + reinstall plugin | Reinstalled stale v2.0.0 |
| Version bump in marketplace.json (2.0.0 → 2.0.1) | Cowork doesn't use this field |
| Ask Cowork Claude to git pull inside VM | No git clone exists — remote plugins aren't git repos in the VM |
| Ask Cowork Claude to overwrite plugin files | .remote-plugins/ is mounted read-only |
| Search ~/.claude/plugins/marketplaces/ on host | CEG marketplace not listed in known_marketplaces.json — only Anthropic official marketplaces are there |
| Search C:\Users\<user>\AppData\ on host | No CEG/cowork/marketplace references found anywhere |
| Search C:\ProgramData\Claude\ on host | Only contains cowork-service.log and coworkd.log |
| Mount local clone in Cowork, ask Claude to copy files | .remote-plugins/ is read-only, copy fails |

Key findings

1. Cowork tracks remote plugins by ID and timestamp, not by marketplace.json version field. Bumping the version does nothing.
2. Remote plugins are delivered as a read-only mount, not as a git checkout. There is no .git/ directory inside the VM's plugin path.
3. The marketplace cache does not live on the user's local filesystem. Unlike CLI marketplaces (stored at ~/.claude/plugins/marketplaces/), Cowork's org marketplace cache is entirely server-side. The user has no access to it.
4. known_marketplaces.json on the host only lists Anthropic official marketplaces, not org-managed ones. This confirms org marketplaces are managed through a different code path.
5. The "last updated" timestamp in Cowork shows today's date, but the actual file content is from before the fixes were pushed. The timestamp may reflect when Cowork last checked, not when content was actually refreshed.

Why this is worse than the CLI version of this bug

The CLI bug (#29071) has a manual workaround: cd ~/.claude/plugins/marketplaces/<name> && git pull. Cowork users have zero workaround:

• Can't access the server-side cache
• Can't write to the read-only mount
• Can't git pull because there's no git repo in the VM
• Can't install a local override (no ~/.claude/plugins/ override mechanism in Cowork)
• Uninstall/reinstall pulls from the same stale cache

For org-managed marketplaces, this means a team lead pushes a critical fix and no team member can receive it until Anthropic's server-side cache refreshes on its own (unknown cadence).

Related issues

• #29071 — plugin update runs git fetch but never git merge/pull (root cause for CLI)
• #28998 — "Check for Updates" falsely reports latest version on Windows
• #29074 — Plugin cache not cleared on uninstall/reinstall
• #14061 — /plugin update does not invalidate plugin cache
• #35752, #36317, #36380 — Recent duplicates confirming this is widespread

Suggested fixes

Agreeing with @sagarbaver's priority ordering from #29071, with an additional Cowork-specific item:

1. Must have: git pull before version/commit comparison (fixes CLI)
2. Must have (Cowork-specific): Server-side marketplace cache must refresh when checking for updates, not just compare against a stale local copy
3. Should have: Cache invalidation on uninstall/reinstall — a fresh install should always pull fresh content
4. Nice to have: TTL-based auto-refresh (e.g., daily) for org marketplaces