[BUG] Version-less marketplace plugins re-materialized and reported "updated" on every refresh, even when repo SHA is unchanged

What's Wrong?

Plugins installed from claude-plugins-official that have no version field — neither in their marketplace.json entry nor their own .claude-plugin/plugin.json (e.g. frontend-design, playwright, skill-creator) — are recorded as version: "unknown" and get re-materialized + lastUpdated re-stamped on every marketplace refresh, surfacing as "updated" over and over even though their content is unchanged.

Observed on my machine (from ~/.claude/plugins/installed_plugins.json and known_marketplaces.json):

• Two marketplace refreshes ~20 min apart (2026-07-06T23:01:16Z, 2026-07-06T23:21:15Z) each re-stamped exactly the three version-less plugins; versioned plugins were untouched.
• The recorded gitCommitSha for frontend-design and playwright stayed 3dc50d51835dc85f7a3f77d593dd9a565a87276b across both re-stamps — identical content, so the "update" was a no-op.
• skill-creator has no gitCommitSha recorded at all, so no-op detection is impossible for it.
• These plugins only actually change upstream ~quarterly (last real commits touching them: frontend-design 2026-06-15, skill-creator 2026-04-23, playwright 2025-12-02) — so effectively all of these per-refresh "updates" are no-ops.

| plugin | version source | resolved | behavior on refresh |
|---|---|---|---|
| superpowers | own plugin.json (6.1.1) | 6.1.1 | stable |
| typescript-lsp | marketplace.json (1.0.0) | 1.0.0 | stable |
| frontend-design | none | unknown | re-stamped every refresh |
| playwright | none | unknown | re-stamped every refresh |
| skill-creator | none | unknown | re-stamped every refresh, no gitCommitSha recorded |

Beyond the noise, the constant "updated" churn masks genuine updates and does redundant fetch/write work each refresh.

What Should Happen?

• The reconciler should skip re-materializing a path-sourced plugin when the marketplace repo SHA is unchanged (the gitCommitSha it already records makes this comparison possible), and only report "updated" when content actually changed.
• All installs should record gitCommitSha (the skill-creator install is missing it), so no-op detection works uniformly.

Steps to Reproduce

1. claude plugin install frontend-design@claude-plugins-official (any official plugin without a version field)
2. Trigger two marketplace refreshes (e.g. start two sessions)
3. Check ~/.claude/plugins/installed_plugins.json: lastUpdated is re-stamped both times and the plugin surfaces as updated, while gitCommitSha (and actual content) is unchanged. Plugins with a version field (e.g. typescript-lsp 1.0.0) are not re-stamped.

Environment

• Claude Code: 2.1.202 (latest at time of filing)
• OS: macOS (darwin 25.5.0)
• Marketplace: claude-plugins-official (github anthropics/claude-plugins-official)

Note

The alternative fix — adding version fields to those entries in the claude-plugins-official manifest (as security-guidance and the LSP plugins have) — would stop the churn but effectively pins path-sourced plugins until someone remembers to bump the version. No-op detection in the reconciler seems like the right layer, hence filing here.