[BUG] `autoUpdate: true` on git-sourced marketplace does not `git pull` the clone — silent across quit/relaunch (2.1.139)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A marketplace registered with "autoUpdate": true does not fast-forward its
local clone against the remote, even across full quit/relaunch cycles. The
lastUpdated timestamp in ~/.claude/plugins/known_marketplaces.json is touched
on launch, but no git fetch && git pull runs against the clone, so plugin
version bumps published to the remote are invisible until the user runs
claude plugin marketplace update <name> by hand.

This is the inverse of #17361 (where the marketplace clone was pulled but the
cache stayed stale) and overlaps with the architectural cluster diagnosed in
#56740 / #52218: writes related to marketplace+plugin state are scattered across
entry points, and the autoUpdate path skips the fetch step entirely. The
canonical earlier issue #36938 was closed stale and locked without a fix.

What Should Happen?

What Should Happen?

When autoUpdate: true is set on a git-sourced marketplace, every launch (or at
least a documented periodic schedule) should perform
git fetch && git pull --ff-only against the clone before reading
marketplace.json, and should only bump lastUpdated when a fetch actually
occurred.

Observed

• known_marketplaces.json lastUpdated is bumped to the launch time.
• Clone HEAD is still on the pre-push commit; git status reports

Your branch is behind 'origin/main' by 1 commit, and can be fast-forwarded.

• installed_plugins.json still records the old version, installPath, and

gitCommitSha.

• The /plugin UI does not surface that an update exists.

Error Messages/Logs

Steps to Reproduce

1. Register a git-sourced marketplace with autoUpdate: true:

``json
"ro-marketplace": {
"source": { "source": "git", "url": "https://github.com/roipatents/ro-marketplace.git" },
"installLocation": "/Users/<me>/.claude/plugins/marketplaces/ro-marketplace",
"autoUpdate": true
}
``

1. Install a plugin from it; note gitCommitSha and the marketplace clone HEAD.
2. Push a new commit to the marketplace remote that bumps a plugin version

(e.g., data-handling 0.1.0 → 0.1.2 in its .claude-plugin/plugin.json).

1. Fully quit Claude Code and relaunch. Do not run

/plugin marketplace update.

1. Inspect the local clone:

``
git -C ~/.claude/plugins/marketplaces/ro-marketplace fetch
git -C ~/.claude/plugins/marketplaces/ro-marketplace status
``

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.139

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Workaround

claude plugin marketplace update <marketplace> performs the missing
fast-forward and, on the same invocation, reinstalls the plugin into a new
versioned cache directory and bumps version / installPath / lastUpdated in
installed_plugins.json. It does not, however, refresh gitCommitSha — see
the companion comment on #56740.

Environment

• Claude Code: 2.1.139
• Platform: macOS, Darwin 25.5.0
• Marketplace source type: git (HTTPS to public GitHub repo)
• Reproducible 100% across multiple quit/relaunch cycles.

Additional Information

Cluster: #56740 (architectural diagnosis), #52218, #17361, #43763.
Earlier closed canonical: #36938.