[BUG] Failure to refresh plugin on restart with managed settings

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Bug report: org-managed plugin pin cannot be advanced by an admin (frozen at initial commit)
Summary — An organization-managed Claude Code plugin (distributed via claude.ai Organization settings → Plugins) is permanently pinned to the git commit it was first provisioned at. As the org admin, no available action advances the pin — not marketplace Refresh, not delete-and-re-add of the plugin, not any local CLI command. The entire org is stuck on a ~4-week-old version with no upgrade path.
Environment
Claude Desktop (Cowork), macOS (Darwin 23.2); Desktop 1.18286.0, claude-code 2.1.197
Claude for Teams/Enterprise; managed plugins configured in claude.ai org settings
Distribution: claude.ai console only — confirmed no MDM and no local managed-settings.json at any standard path, so the managed scope is server-pushed
Plugin: rize-skills from marketplace rize-plugins (GitHub rizeedu/claude-plugins)
Expected — Refresh (or delete/re-add) advances the managed pin to the marketplace's current commit; users get the update on next launch.
Actual — Pin frozen at the initial-provisioning commit; never advances. installed_plugins.json unchanged across every attempt: gitCommitSha 0a3c8a4d85ea…, lastUpdated 2026-06-12. Target = current main ec05dcc604b18acc7198287bda9272671f25a06f.
Smoking gun — A marketplace Refresh built a correct new cache (cache/rize-plugins/rize-skills/254bbc3a056d/, all newer skills present) but the managed entry was never repointed to it. Marketplace-sync and managed-pin-update are decoupled — sync caches the new commit; the pin stays put; no admin control moves it.
Reproduction (all failed to advance the pin)
CLI plugin marketplace update → clone advanced, pin unchanged
CLI plugin install → "success", pin unchanged
CLI uninstall + install → re-injected identical managed entry (same commit + original installedAt) → re-applied from server
Console Refresh/sync + restart → new cache built, pin unchanged
Console delete + re-add + full ⌘Q relaunch → pin still 0a3c8a4d85ea, timestamp still June 12
Console exposes Refresh/sync but no control to set/advance the pinned commit.
Impact — Whole org frozen ~4 weeks back; can't receive 2 new skills (rubric-rewrites, update-system-map), a reworked rize-onboarding, and safe-sanity-changes updates. No admin self-service fix.

What Should Happen?

When the github is updated on the main branch, the entire org should see the updated skills when they restart their desktop app or terminal window

Error Messages/Logs

Steps to Reproduce

Merge code into the plugin's main branch, no change in even when the plugin says refreshed in the admin console.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.0.56 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_