Plugin installed via git URL shows commit SHA as version instead of semantic version from plugin.json

Description

When installing a plugin from a git URL marketplace (source type "git"), the version field in ~/.claude/plugins/installed_plugins.json is set to the first 12 characters of the git commit SHA rather than reading the version field from the plugin's .claude-plugin/plugin.json.

This means the /plugin Installed tab displays a cryptic hash (e.g., 2907815231f5) instead of the human-readable semantic version (e.g., 1.2.0).

Steps to Reproduce

1. Add a marketplace via git URL:

• /plugin → Marketplaces tab → Add marketplace → Git URL
• Enter: https://github.com/ChintanTurakhia/cost-analysis.git

1. Install the cost-analysis plugin from the Installed or Discover tab
2. Inspect ~/.claude/plugins/installed_plugins.json

Expected Behavior

The version field should contain the semantic version from the plugin's plugin.json:

{
  "version": "1.2.0",
  "gitCommitSha": "2907815231f505899dfb2de9fc8c1255fb25ddb5"
}

Actual Behavior

The version field contains the commit SHA prefix instead:

{
  "version": "2907815231f5",
  "gitCommitSha": "2907815231f505899dfb2de9fc8c1255fb25ddb5"
}

The install path also uses this SHA prefix: ~/.claude/plugins/cache/cost-analysis/cost-analysis/2907815231f5/

Evidence

installed_plugins.json:

{
  "version": 2,
  "plugins": {
    "cost-analysis@cost-analysis": [
      {
        "scope": "user",
        "installPath": "/Users/.../.claude/plugins/cache/cost-analysis/cost-analysis/2907815231f5",
        "version": "2907815231f5",
        "installedAt": "2026-03-25T17:29:41.762Z",
        "lastUpdated": "2026-03-25T17:29:41.762Z",
        "gitCommitSha": "2907815231f505899dfb2de9fc8c1255fb25ddb5"
      }
    ]
  }
}

The plugin's .claude-plugin/plugin.json clearly defines a semantic version:

{
  "name": "cost-analysis",
  "version": "1.2.0",
  "description": "Analyze Claude Code token usage and costs..."
}

known_marketplaces.json shows the git source type:

{
  "cost-analysis": {
    "source": {
      "source": "git",
      "url": "https://github.com/ChintanTurakhia/cost-analysis.git"
    }
  }
}

Suggested Fix

After cloning the git repository during plugin installation, read the version field from .claude-plugin/plugin.json and store that as the version in installed_plugins.json. Continue using gitCommitSha separately for update detection purposes.

Pseudocode:

const pluginJson = JSON.parse(fs.readFileSync(path.join(pluginDir, '.claude-plugin', 'plugin.json'), 'utf8'));
const version = pluginJson.version || commitShaPrefix; // fallback to SHA if no version specified

Related Issues

• #17032 — Plugin re-installation sets version to 'unknown'
• #31462 — Plugin update detection and upgrade workflow

Environment

• Claude Code version: latest (as of 2026-03-25)
• OS: macOS (Darwin 22.5.0)
• Plugin installed via: HTTPS git URL (not SSH, not GitHub marketplace)