[BUG] Cowork (local-agent-mode) syncs and runs plugins disabled in enabledPlugins settings

Summary

Claude Desktop's local-agent-mode (cowork) syncs and registers hooks for plugins that are explicitly set to false in enabledPlugins in ~/.claude/settings.json. The plugin's hooks run in the session despite being disabled.

Environment

• Platform: macOS 25.4.0 (Darwin)
• Claude Desktop with local-agent-mode / cowork

Steps to reproduce

1. Set a plugin to false in ~/.claude/settings.json:

``json
"enabledPlugins": {
"sdlc-guardrails@buritica-ai": false
}
``

1. Start a Claude Desktop cowork session
2. Observe: the plugin is synced to the session directory under ~/Library/Application Support/Claude/local-agent-mode-sessions/<session-id>/rpm/plugin_<id>/
3. Observe: the plugin's PreToolUse hooks are registered and fire on every Bash tool call

Expected behavior

Plugins set to false in enabledPlugins should not be synced or have their hooks registered in cowork sessions.

Actual behavior

The disabled plugin is synced and its hooks run. In this case the plugin path (CLAUDE_PLUGIN_ROOT) resolves under ~/Library/Application Support/… which contains a space. Because the hook command had an unquoted ${CLAUDE_PLUGIN_ROOT}, the shell split the path and python3 tried to exec /Users/buritica/Library/Application — blocking every Bash call in the session.

The quoting bug was fixed separately (buritica/ai PR #32, sdlc-guardrails v1.2.2), but the root issue — the disabled plugin being loaded at all — remains.

Additional context

• The plugin is intentionally disabled because sdlc-guardrails must not run alongside the sdlc plugin (conflicting hooks)
• The session directory shows version 1.2.1 was synced even after the marketplace cache was updated to 1.2.2, suggesting cowork snapshots plugin state at session start and ignores subsequent marketplace updates
• Workaround used: placed a no-op Python stub at the path cowork was trying to exec (/Users/buritica/Library/Application) to prevent the hook from crashing Bash