[BUG] Desktop (Windows): marketplace plugin skills never appear — "Skipping manifest write for out-of-bounds installPath" for ~/.claude/plugins/cache

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

On Claude Desktop (Windows), a marketplace plugin installs successfully and shows up as enabled under Customize → Plugins, but its detail page reports "This plugin has no skills or agents." The exact same plugin and version works correctly in the Claude Code CLI.

The log shows the desktop app installs the plugin into the shared CLI cache (~/.claude/plugins/cache/...) and then refuses to write the skill manifest for that path, treating it as "out-of-bounds":

[CCDMarketplacePluginManagerCLI] Plugin installed: devops@cmi-claude-infrastructure
[CCDMarketplacePluginManagerCLI] Skipping manifest write for unresolvable or out-of-bounds
  installPath: C:\Users\<USER>\.claude\plugins\cache\cmi-claude-infrastructure\devops\1.1.0

Because the desktop UI never gets a skill manifest, every marketplace plugin shows zero skills — even though the SKILL.md files are physically present in the cache and load fine in the CLI.

This is not the 10-minute org-plugin sync race (#64548) — waiting does not help, because the manifest write is skipped outright, not merely delayed.

It affects all marketplace plugins, not just one. The warning appears 47 times in a single session, for both a custom GitHub org marketplace (cmi-claude-infrastructure) and the official marketplace (claude-plugins-official): playwright, pr-review-toolkit, csharp-lsp, typescript-lsp, superpowers, commit-commands, github, context7, code-simplifier, ralph-loop.

What Should Happen?

The desktop app should write the skill manifest for plugins installed into the standard ~/.claude/plugins/cache/... location (the same path the CLI uses), so plugin skills appear under Customize → Plugins and are invokable from the desktop Code tab. The ~/.claude/plugins/cache path should not be classified as "out-of-bounds".

Error Messages/Logs

From %APPDATA%\Claude\logs\main.log (timeline, paths/IDs redacted):

15:59:30 [info] [CCDMarketplacePluginManagerCLI] Marketplace added: cmi-claude-infrastructure
15:59:33 [info] [CustomPlugins] installPlugin: skipping remote API path for plugin
                 devops@cmi-claude-infrastructure (reason=not-cowork-not-remote)
15:59:33 [info] [CustomPlugins] installPlugin: attempting CLI install for plugin
                 devops@cmi-claude-infrastructure (scope=default)
15:59:33 [info] [CCDMarketplacePluginManagerCLI] Installing plugin: devops@cmi-claude-infrastructure
15:59:34 [info] [HostCLIRunner] Command completed with exit code 0
15:59:34 [info] [CCDMarketplacePluginManagerCLI] Plugin installed: devops@cmi-claude-infrastructure
15:59:34 [warn] [CCDMarketplacePluginManagerCLI] Skipping manifest write for unresolvable or
                 out-of-bounds installPath:
                 C:\Users\<USER>\.claude\plugins\cache\cmi-claude-infrastructure\devops\1.1.0

The same Skipping manifest write ... out-of-bounds installPath warning is logged for every other installed plugin (47 occurrences in one session).

On disk the plugin is complete and valid:

~/.claude/plugins/cache/cmi-claude-infrastructure/devops/1.1.0/
├── .claude-plugin/plugin.json
├── .mcp.json
└── skills/cmi-commit/SKILL.md   (valid frontmatter: name, description, allowed-tools)

Steps to Reproduce

1. On Windows, add a GitHub-hosted plugin marketplace in Claude Desktop (Customize → Plugins → add owner/repo).
2. Install/enable a plugin from it that ships a skills/<name>/SKILL.md.
3. Open the plugin's detail page under Customize → Plugins.
4. Observed: "This plugin has no skills or agents." The same plugin/version exposes its skills normally in the Claude Code CLI.
5. Check %APPDATA%\Claude\logs\main.log → Skipping manifest write for unresolvable or out-of-bounds installPath: C:\Users\<USER>\.claude\plugins\cache\....

Claude Model

N/A (plugin/skill discovery, not model behavior)

Is this a regression?

I don't know

Claude Code Version

Claude Desktop 1.9659.4 (Windows); embedded Claude Code (CCD) 2.1.160; Node 24.15.0

Platform

Windows

Operating System

Windows

Additional Information

Possibly related but likely a separate bug: when the desktop app first tried to add the same marketplace via the claude.ai directory URL (instead of the GitHub URL), it failed for a data-residency-gated org:

× Failed to add marketplace: ... https://claude.ai/directory/plugins/<plugin>%40<marketplace>
  is Anthropic-operated. Use firstPartyApi from src/services/http/firstParty —
  it enforces the 3P data-residency gate.
[error] Sentry caught: { type: 'Error', value: 'MARKETPLACE_ERROR:UNKNOWN', ... }

Adding the marketplace via the GitHub URL succeeded; the manifest-write bug above then occurred regardless. Happy to provide full logs.