Plugin cache ignores marketplace SHA — installs stale version despite correct marketplace.json

Bug Description

When installing a plugin from a private marketplace (source: "directory"), claude plugin install does not check out the correct git commit specified by the sha field in marketplace.json. Instead, it clones the plugin repo and uses a stale ref, resulting in an older version being cached and installed.

Version

Claude Code 2.1.89

Steps to Reproduce

1. Set up a local marketplace with a plugin

# Create a plugin repo
mkdir my-plugin && cd my-plugin
git init
mkdir -p .claude-plugin skills/hello
echo '{"name": "my-plugin", "version": "1.0.0"}' > .claude-plugin/plugin.json
echo -e "---\nname: hello\ndescription: test\n---\n# Hello" > skills/hello/SKILL.md
git add -A && git commit -m "v1.0.0"
COMMIT_V1=$(git rev-parse HEAD)

# Push to a remote (e.g., GitHub private repo)
# gh repo create my-org/my-plugin --private
# git remote add origin git@github.com:my-org/my-plugin.git && git push -u origin main

2. Create a marketplace directory pointing to the plugin

mkdir my-marketplace && cd my-marketplace
git init
cat > marketplace.json << 'EOF'
{
  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
  "name": "my-marketplace",
  "plugins": [{
    "name": "my-plugin",
    "description": "Test plugin",
    "author": {"name": "test"},
    "category": "productivity",
    "source": {
      "source": "url",
      "url": "git@github.com:my-org/my-plugin.git",
      "sha": "<COMMIT_V1>"
    }
  }]
}
EOF
git add -A && git commit -m "init"

3. Add marketplace and install

claude plugin marketplace add /path/to/my-marketplace
claude plugin install my-plugin
# Installs correctly as v1.0.0

4. Update the plugin to v2.0.0

cd my-plugin
echo '{"name": "my-plugin", "version": "2.0.0"}' > .claude-plugin/plugin.json
echo -e "---\nname: hello\ndescription: updated test\n---\n# Hello v2" > skills/hello/SKILL.md
git add -A && git commit -m "v2.0.0"
git push origin main
COMMIT_V2=$(git rev-parse HEAD)

5. Update marketplace SHA

cd my-marketplace
# Update marketplace.json with new SHA
sed -i '' "s/$COMMIT_V1/$COMMIT_V2/" marketplace.json
git add -A && git commit -m "bump to v2.0.0"
# If using local directory source, just save the file

6. Reinstall the plugin

# Clear cache
rm -rf ~/.claude/plugins/cache/my-marketplace/my-plugin/
# Reinstall
claude plugin install my-plugin

Expected Behavior

• Plugin installs at v2.0.0
• ~/.claude/plugins/cache/my-marketplace/my-plugin/2.0.0/.claude-plugin/plugin.json contains "version": "2.0.0"
• /plugin shows "my-plugin is already at the latest version (2.0.0)"

Actual Behavior

• Plugin installs but cache contains v1.0.0 content despite the directory being named with the correct version
• ~/.claude/plugins/cache/my-marketplace/my-plugin/2.0.0/.claude-plugin/plugin.json contains "version": "1.0.0" (old content)
• /plugin shows "my-plugin is already at the latest version (1.0.0)"
• The installed_plugins.json records the correct new SHA but the wrong version string
• Even after rm -rf of the cache directory + claude plugin remove + claude plugin install, the same stale content is installed

Observations

• installed_plugins.json shows the correct gitCommitSha from marketplace.json, but the cached files are from an older commit
• The git clone performed during install does not appear to git checkout the specific SHA — it uses whatever ref resolves by default (HEAD/main)
• This persists across cache deletions, plugin remove/reinstall cycles, and marketplace remove/re-add
• The only workaround is manually copying the correct files into the cache directory

Environment

• macOS Darwin 24.6.0
• Marketplace source type: directory (local path)
• Plugin source type: url (SSH git URL)
• Plugin repo is private (SSH auth via gh CLI)