[BUG] Claude Code on the web: declared plugins inactive on first session, require restart to fully load

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In a cloud session on Claude Code on the web, plugins declared via enabledPlugins in .claude/settings.json are not active in the first session. /reload-plugins is disabled in cloud sessions (/reload-plugins isn't available in this environment), so it cannot be used to apply them within the same session. /reload-skills does activate the plugin's skills, agents, and commands, but it does not activate hooks. Ending the session and opening a new one applies everything, including hooks.

The official documentation states for cloud sessions "Plugins declared in .claude/settings.json ... Installed at session start from the marketplace you declared", but in practice this only holds from the second session start onward — in the first session, the marketplace clone does not complete in time for session start.

What Should Happen?

As the documentation states, declared plugins should be fully active from the first session start. Specifically, either of the following:

• (Preferred) When the marketplace clone completes / Found N plugins fires on the engine side, automatically reload all plugin-attached components (skill / agent / command attachment and hook registration)
• Or, enable a /reload-plugins equivalent in cloud sessions so users can manually trigger it (this should also cover both skills / agents / commands and hooks)

Error Messages/Logs

Steps to Reproduce

1. Prepare a repo with the following .claude/settings.json:

``json
{
"enabledPlugins": {
"plugin-dev@claude-plugins-official": true,
"security-guidance@claude-plugins-official": true
}
}
``

• plugin-dev provides skills / agents / commands; security-guidance provides hooks (SessionStart / UserPromptSubmit / PostToolUse, etc.)

1. Open the repo in a fresh Cloud Environment (no CLAUDE_CODE_PLUGIN_SEED_DIR, empty setup script, Trusted network)
2. First session: Plugin-provided skills / agents / commands do not appear in the available list, and hooks do not fire either
3. Try /reload-plugins → rejected with /reload-plugins isn't available in this environment
4. Run /reload-skills → skills / agents / commands appear in the available list, but security-guidance's hooks (PostToolUse, etc.) still do not fire
5. End the session and open a new session → everything, including hooks, is now applied

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.153 (Claude Code)

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Other

Additional Information

The key entries observed in the engine log (/tmp/claude-code.log), in chronological order (first-session entries are all from the same PID, UTC):

# --- First session, at startup (marketplace not yet cloned) ---
Loaded 0 installed plugins from installed_plugins.json
Found 0 plugins                                       # declared plugins orphaned (marketplace not registered yet)
getSkills returning: 0 plugin skills, 14 bundled skills
Sending 13 skills via attachment (initial)            # GATE 1: fires only once; bundled skills only (plugin skills = 0)
Plugin hooks: skipping reload, plugin-affecting settings unchanged   # GATE 2: hook reload is skipped
Read hooks.json for plugin security-guidance (enabled=true)          # hooks.json is read but not registered

# --- First session, after the marketplace clone completes (~1.5s after the attachment event) ---
Added marketplace source: claude-plugins-official
Found 2 plugins (2 enabled, 0 disabled)               # detected within the same PID, but no re-attachment fires

# --- After the user runs `/reload-skills` (skills/agents/commands appear, but hooks remain unregistered) ---
Hooks: Found 0 total hooks in registry                # remains 0 — /reload-skills does not re-arm hooks

# --- After ending the first session and opening a new one (different worker, different PID) ---
Registered 6 hooks from 3 plugins                     # 0 → 6, hooks finally enter the registry

During verification, we recorded process identity (PID / ps -o lstart / session jsonl) at every turn and confirmed that no process restart occurred within the first session, while a new worker process started for the new session.