[BUG] claude plugin install: an auto-installed dependency resolves only its first declared dependency

Summary

When claude plugin install X pulls in a dependency Y automatically, only Y's first declared dependency is resolved — the rest are silently dropped. Installing Y explicitly resolves all of its deps, so this is specific to the recursive step into auto-installed dependencies. The docs state resolution is fully transitive, so this looks like a bug.

Version

2.1.177 (Claude Code) — also reproduced on 2.1.143.

Minimal repro (self-contained directory marketplace)

S=$(mktemp -d); MKT=$(mktemp -d)
mkdir -p "$MKT/.claude-plugin"; for p in a b c d; do mkdir -p "$MKT/plugins/$p/.claude-plugin"; done
cat > "$MKT/.claude-plugin/marketplace.json" <<'JSON'
{ "name":"repro","owner":{"name":"x"},"plugins":[
 {"name":"a","source":"./plugins/a"},{"name":"b","source":"./plugins/b"},
 {"name":"c","source":"./plugins/c"},{"name":"d","source":"./plugins/d"}]}
JSON
printf '{"name":"a","version":"0.0.1","description":"a","dependencies":["b"]}\n'     > "$MKT/plugins/a/.claude-plugin/plugin.json"
printf '{"name":"b","version":"0.0.1","description":"b","dependencies":["c","d"]}\n' > "$MKT/plugins/b/.claude-plugin/plugin.json"
printf '{"name":"c","version":"0.0.1","description":"c"}\n'                           > "$MKT/plugins/c/.claude-plugin/plugin.json"
printf '{"name":"d","version":"0.0.1","description":"d"}\n'                           > "$MKT/plugins/d/.claude-plugin/plugin.json"

HOME="$S" claude plugin marketplace add "$MKT"
HOME="$S" claude plugin install a@repro     # "✔ installed a@repro (+ 1 dependency: b)"
HOME="$S" claude plugin list                # a, b, c  — d is MISSING

Expected

a, b, c, d all installed (a → b → {c, d}).

Actual

a, b, c installed; d missing. b was auto-installed (as a's dep), and only its first dependency c was resolved.

Confirming it's the recursion, not b's manifest: HOME="$S" claude plugin install b@repro then resolves the remainder (+ 1 dependency: d).

Docs say transitive

Plugin dependencies: "If a dependency has its own dependencies, Claude Code enables those too." Possibly related: #68416 (enable writes all transitive deps to enabledPlugins, so the full set is known).

Real-world impact

A collection plugin pulled in as a dependency loses all but its first dep. We hit this with base-stack → base → [andrej-karpathy-skills, hard-rules, commit, rclone]: only the first (andrej-karpathy-skills) installed; rclone (and its session hooks) silently never installed.

Also (minor)

The install summary undercounts — install a@repro reports + 1 dependency: b even though c is also installed.