[DOCS] Plugin install consent docs do not explain project-settings-only plugins no longer re-prompt consent on every loader (v2.1.195)

Documentation Type

Unclear/confusing documentation

Documentation Location

https://code.claude.com/docs/en/discover-plugins

Section/Topic

The "Configure team marketplaces" section under "Install plugins", specifically the "Installation respects trust boundaries and requires explicit consent" sentence inside the extraKnownMarketplaces description. The docs do not address the v2.1.195 fix where external plugins enabled only by a project's .claude/settings.json no longer require explicit install consent on every loader path.

Current Documentation

The settings reference describes the project-scope install flow as:

When a repository includes extraKnownMarketplaces: 1. Team members are prompted to install the marketplace when they trust the folder 2. Team members are then prompted to install plugins from that marketplace 3. Users can skip unwanted marketplaces or plugins (stored in user settings) 4. Installation respects trust boundaries and requires explicit consent

The plugin marketplaces guide repeats the same flow:

Team admins can set up automatic marketplace installation for projects by adding marketplace configuration to .claude/settings.json. When team members trust the repository folder, Claude Code prompts them to install these marketplaces and plugins.

Neither page distinguishes between marketplace-installed plugins and externally-sourced plugins declared with source: 'settings' in enabledPlugins. Both treat "consent prompt" as the default state for any project-declared plugin.

What's Wrong or Missing?

Claude Code v2.1.195 fixed an issue where external plugins enabled only by a project's .claude/settings.json were incorrectly prompting for explicit install consent on every loader path (skill load, command load, hook load, MCP server load). Before the fix, the loader re-prompted consent each time the plugin was reached through a different surface, which made source: 'settings' plugins declared in .claude/settings.json unusable in practice.

After the fix, consent is granted once for the project scope and respected on every subsequent loader path, but the docs still describe the install flow as if consent is required on every surface. Users reading the docs cannot tell whether the v2.1.195 fix has changed the consent behavior, and the docs do not call out the distinction between marketplace-declared plugins (which still go through the trust-folder prompt) and source: 'settings' plugins declared inline.

Suggested Improvement

Extend the settings reference's enabledPlugins section with a short paragraph that documents the new behavior:

External plugins enabled only by a project's .claude/settings.json (via source: 'settings' entries in enabledPlugins) require explicit consent once per project scope. Claude Code v2.1.195 fixes the loader so the consent prompt no longer reappears on each loader path (skill load, command load, hook load, MCP server load). Earlier versions re-prompted on every loader path. Marketplace-declared plugins declared through extraKnownMarketplaces still go through the trust-folder consent flow described above.

Update the "Configure team marketplaces" intro paragraph to mention the v2.1.195 fix when describing the consent step.

Impact

Medium - Makes feature difficult to understand

Additional Context

The enabledPlugins table at the top of the settings reference already says "Project settings take precedence over user settings" and "Plugins force-enabled by managed settings cannot be disabled this way". The fix is orthogonal to that — it concerns the install consent flow, not the precedence rules. The plugin-marketplaces guide should reference the same paragraph.

Affected Pages:
| Page | Context |
|------|---------|
| https://code.claude.com/docs/en/settings | enabledPlugins and extraKnownMarketplaces sections |
| https://code.claude.com/docs/en/discover-plugins | "Configure team marketplaces" consent flow |
| https://code.claude.com/docs/en/plugin-marketplaces | enabledPlugins example under project-scope install |

Total scope: 3 pages affected