[BUG] Hooks from non-enabled marketplace plugins still fire during SessionStart

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Marketplace plugins that are installed but not enabled in settings.json still have their hooks loaded and executed. This causes SessionStart:startup hook error messages for plugins the user never enabled.

Specifically, explanatory-output-style and learning-output-style exist in ~/.claude/plugins/marketplaces/claude-plugins-official/plugins/ (installed by the marketplace sync), but are NOT listed in settings.json enabledPlugins. Despite this, their SessionStart hooks fire on every session start.

This compounds with the known executable bit issue (#39582, #39378) — even if the permission problem were fixed, hooks from non-enabled plugins should not execute at all.

What Should Happen?

The hook runner should only execute hooks from plugins listed in enabledPlugins in settings.json. Hooks from installed-but-not-enabled marketplace plugins should be ignored.

Error Messages/Logs

● Ran SessionStart hooks
  ⎿  SessionStart:startup hook error
  ⎿  SessionStart:startup hook error

These two errors correspond to the two non-enabled plugins' session-start.sh hooks.

Steps to Reproduce

1. Install Claude Code with marketplace plugin sync enabled
2. Ensure explanatory-output-style and learning-output-style are NOT in enabledPlugins
3. Start a new Claude Code session
4. Observe two SessionStart:startup hook error messages from the non-enabled plugins

Evidence

settings.json enabledPlugins section (note: neither output-style plugin is listed):

{
  "enabledPlugins": {
    "frontend-design@claude-plugins-official": true,
    "superpowers@claude-plugins-official": true,
    "code-review@claude-plugins-official": true,
    "ralph-loop@claude-plugins-official": true,
    "security-guidance@claude-plugins-official": true
    // ... other enabled plugins — no explanatory-output-style or learning-output-style
  }
}

Plugins with SessionStart hooks that fire despite not being enabled:

~/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks/hooks.json
~/.claude/plugins/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks/hooks.json

Related Issues

• #39582 — Consolidated executable bit report (OPEN)
• #39378 — Hook runner permission denied (CLOSED)
• #38686, #38901, #39158, #39203, #39286, #39333, #39571, #39578 — Community reports

Claude Model

Claude Opus 4.6 (1M context)

Is this a regression?

Not sure / don't know

Claude Code Version

Latest (2026-03-27)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux (devcontainer)

Terminal/Shell

zsh

Additional Information

This was discovered while investigating persistent SessionStart:startup hook error messages in the f5xc-salesdemos/devcontainer project, tracked in f5xc-salesdemos/devcontainer#648.

<small>_Drafted with the help of Claude._</small>