[BUG] `marketplace add` silently overwrites existing marketplace when two repos declare the same marketplace name

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When two repos from the same organization declare the same "name" in their .claude-plugin/marketplace.json, running claude plugin marketplace add for the second repo silently overwrites the first repo's registration in known_marketplaces.json. No warning is shown. The first repo's plugins silently break.

This is the natural and expected setup for organizations publishing multiple plugins under one brand -- both repos declare the same marketplace name because they belong to the same organization. There is nothing in the docs or CLI output warning that this will destroy the first registration.

Real-world impact: We publish two plugins under one organization:

• session-logger in repo DazzleML/claude-session-logger
• claude-session-backup in repo DazzleML/Claude-Session-Backup

Both declared "name": "dazzle-claude-plugins" in their marketplace.json. Adding the second repo silently overwrote the first. The session-logger plugin was broken for a week before we noticed. It only surfaced when we ran claude plugin list and saw Status: failed to load.

What Should Happen?

At minimum: marketplace add should warn the user when it's about to overwrite an existing marketplace registration from a different source.

Ideally: multiple repos should be able to contribute plugins to the same marketplace namespace. When an organization has repos org/plugin-a and org/plugin-b, both declaring "name": "org-plugins", a user should be able to add both and install plugin-a@org-plugins and plugin-b@org-plugins without collision.

Error Messages/Logs

No error is shown during the overwrite. The damage only appears later:


$ claude plugin list

  > session-logger@dazzle-claude-plugins
    Version: 0.1.5
    Status: X failed to load
    Error: Plugin session-logger not found in marketplace dazzle-claude-plugins


The marketplace name still exists, but it now points to the second repo which doesn't contain the first plugin.

Steps to Reproduce

1. Create two repos, each with .claude-plugin/marketplace.json declaring the same "name":

Repo A (org/plugin-a):
``json
{ "name": "org-plugins", "plugins": [{ "name": "plugin-a", "source": "./" }] }
``

Repo B (org/plugin-b):
``json
{ "name": "org-plugins", "plugins": [{ "name": "plugin-b", "source": "./" }] }
``

1. Add repo A and install plugin-a:

``bash
claude plugin marketplace add "org/plugin-a"
claude plugin install plugin-a@org-plugins # Works
``

1. Add repo B:

``bash
claude plugin marketplace add "org/plugin-b" # No warning -- silently overwrites
``

1. Check plugin status:

``bash
claude plugin list
# plugin-a@org-plugins: FAILED TO LOAD
# plugin-b@org-plugins: enabled
``

1. Observe: No warning was shown at step 3. The user had no way to know that adding repo B would break plugin-a.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.92 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Cause and Source of Bug

addMarketplaceSource() in utils/plugins/marketplaceManager.ts (~line 1859-1911) handles name collisions by silently overwriting the existing entry when the source differs. No confirmation prompt, no warning, no error.

known_marketplaces.json is a strict one-name-to-one-source map. The second marketplace add simply replaces the path for that key.

Suggested Fix (Minimum Viable)

Add a confirmation prompt in addMarketplaceSource() when a marketplace name already exists with a different source:

Warning: Marketplace "org-plugins" is already registered from org/plugin-a.
Adding this source will replace it. Plugins from the previous source will no longer be available.
Continue? [y/N]

This would be a small change (likely under 20 lines) and would prevent the silent data loss.

Longer-term: Multi-source Marketplace Namespaces

The deeper issue is that organizations naturally expect multiple repos to contribute to one marketplace namespace (like npm scoped packages or apt sources). Supporting this would require changing known_marketplaces.json from one-name-to-one-source to one-name-to-many-sources, and merging plugin lists during resolution. This is a larger change but would make the plugin system work as users intuitively expect.

Workaround

Give each repo a unique marketplace name (e.g., org-plugin-a, org-plugin-b). This avoids the collision but produces verbose install commands:

claude plugin install plugin-a@org-plugin-a

Related Issues

• #20593 -- Same plugin name in different marketplaces causes wrong-marketplace resolution (related namespace confusion in the plugin system)
• #33568 -- Support marketplace references inside marketplace.json (related to multi-source federation)
• #43927 -- Bulk install all plugins from a marketplace (related to multi-plugin marketplace UX)