`claude plugin validate` does not validate per-plugin `plugin.json` — invalid plugins pass validation, fail at install with opaque temp-cache error

Bug Description

claude plugin validate <path> only validates the marketplace.json schema at that path. It does not descend into the per-plugin plugin.json files referenced by the marketplace. Plugins whose manifests are invalid against the documented plugin.json schema pass validation cleanly, then fail at install with an opaque temp-cache path in the error.

The command name (claude plugin validate) implies plugin-manifest validation. The behavior is marketplace-manifest validation only. This is a false-confidence bug: a green check from validate does not mean the plugin will install.

Steps to Reproduce

1. Create a single-plugin marketplace:

.claude-plugin/marketplace.json:
``json
{
"name": "demo-marketplace",
"owner": { "name": "Demo", "email": "demo@example.com" },
"metadata": { "description": "demo" },
"plugins": [
{
"name": "demo-plugin",
"source": "./",
"description": "demo",
"version": "0.1.0"
}
]
}
``

.claude-plugin/plugin.json — intentionally invalid (author as string, schema requires object):
``json
{
"name": "demo-plugin",
"version": "0.1.0",
"description": "demo",
"author": "Demo Person <demo@example.com>"
}
``

1. Run the validator:

``bash
$ claude plugin validate .
Validating marketplace manifest: .../.claude-plugin/marketplace.json
✔ Validation passed
``

1. Add the marketplace and install the plugin:

``
/plugin marketplace add <path>
/plugin install demo-plugin@demo-marketplace
``

1. Install fails with:

``
Failed to install: Plugin temp_local_1779238867431_g7r0x2 has an invalid manifest file at
/Users/<you>/.claude/plugins/cache/temp_local_1779238867431_g7r0x2/.claude-plugin/plugin.json.
``

Expected Behavior

claude plugin validate <path> should descend into each plugin entry's source and validate the referenced plugin.json against the documented plugin-manifest schema. Invalid plugin.json files should be reported with file path, field, and reason — before install is ever attempted.

If the command is intentionally scoped to marketplace-manifest-only validation, that scope should be (a) reflected in the command name (e.g., claude marketplace validate) and (b) called out explicitly in --help output and docs.

Actual Behavior

• claude plugin validate <path> validates only marketplace.json's schema.
• Per-plugin plugin.json files are not opened, not parsed, not validated.
• Plugins with manifests that violate the documented schema pass validate and fail at install.
• The install-time error references the cache path (temp_local_<id>_<hash>), not the source plugin.json, making it hard to map the failure back to the file the author needs to fix.
• The validator gives no hint that per-plugin schema is out of scope.

Impact

Plugin authors run claude plugin validate ., see green, and ship. Users hit the install-time failure with an opaque temp-path error message. The first round-trip to identify the actual problem (here: author must be an object, not a string per plugin.json schema) requires the author to know the schema by heart, since the validator's silence implied conformance.

This compounds existing pain documented in #54280 (validator silently allows version-field conflict between marketplace.json and plugin.json) — both bugs are instances of the same root cause: the validator does not enforce the full schema surface it appears to.

Minimal Suggested Fix

Either:

1. Make claude plugin validate <path> actually validate per-plugin plugin.json files referenced by the marketplace (resolving local source paths and downloading remote sources as install does). Report each schema violation with the source file path.
2. Or rename to claude marketplace validate and add a separate claude plugin validate <plugin-dir> that validates a single plugin manifest at the given path.

Option 1 preserves the discoverable command name; option 2 preserves current behavior but stops misleading users.

Environment

• Claude Code version: 2.1.145
• OS: macOS 26.5 (Darwin 25.5.0)

Related Issues

• #54280 — plugin.json silently overrides marketplace.json version with no validator warning (same root cause: validator scope < documented schema surface)
• #42412 — claude plugin validate rejects $schema and description in marketplace.json (validator scope incorrectness, closed)
• #38480 — same as #42412 (closed)