[BUG]Third-party plugins silently disabled when settings.json is rewritten

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Third-party plugins installed via claude plugin install and enabled via claude plugin enable get silently disabled
after settings.json is rewritten by Claude Code. Only plugins from claude-plugins-official (e.g., superpowers)
survive rewrites; all other plugins lose their enabledPlugins entry.

No warning or notification is shown when plugins are silently disabled. Users must manually re-enable dropped plugins
(claude plugin enable X@Y) after every settings rewrite, which makes the third-party plugin ecosystem unreliable.

What Should Happen?

When rewriting settings.json, Claude Code should merge with the existing file rather than reconstructing from
scratch:

1. Read existing enabledPlugins before any rewrite
2. Preserve all existing plugin entries (not just known/default ones)
3. Only add/remove entries when the user explicitly enables/disables a plugin

Error Messages/Logs

No error messages or logs — plugins are silently disabled. Evidence from settings.json backup analysis:

  Examined 16 `.bak` backup files spanning June 13 – July 9, 2026:

  | Date | enabledPlugins contents |
  |------|------------------------|
  | 2026-06-14 | superpowers + webnovel-writer + claude-hud |
  | 2026-06-18 | superpowers only (webnovel-writer and claude-hud dropped) |
  | 2026-06-24 | superpowers + claude-hud (webnovel-writer still gone) |
  | 2026-07-02 | superpowers + claude-hud |
  | 2026-07-09 (after manual re-enable) | superpowers + oh-my-claudecode + chrome-devtools-mcp |

  `superpowers@claude-plugins-official` is present in every single backup — never dropped.
  All third-party plugins were dropped at least once.

  Note: `installed_plugins.json` (v2 format) does NOT track enabled state — it only records installation metadata. So
  even though plugins remain "installed", their enabled state lives exclusively in `settings.json` `enabledPlugins`,
  which is not resilient to rewrites.

Steps to Reproduce

1. Install a third-party plugin:

claude plugin install oh-my-claudecode@omc

1. Enable it:

claude plugin enable oh-my-claudecode@omc

1. Verify it's enabled in ~/.claude/settings.json:

"enabledPlugins": {
"superpowers@claude-plugins-official": true,
"oh-my-claudecode@omc": true
}

1. Trigger a settings modification (e.g., run /config, change any setting, or let Claude Code perform an internal

update that rewrites settings.json).

1. Check ~/.claude/settings.json again.

Expected: Both plugins remain in enabledPlugins with true.
Actual: Third-party plugin entry is removed; only superpowers remains.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

latest

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

## Root Cause Analysis

When Claude Code rewrites settings.json (frequent — triggered by /config, settings changes, internal updates), it
appears to reconstruct the enabledPlugins object from a known/default list rather than merging with the existing
file. Plugins not in this default set are silently dropped.

The backup frequency (16 backups in ~25 days, some days with 2+ backups) confirms that settings.json rewrites are a
normal, frequent operation.

## Affected Plugins

Verified with: oh-my-claudecode@omc, claude-hud@claude-hud, webnovel-writer@webnovel-writer-marketplace — all dropped
at least once. Only superpowers@claude-plugins-official (from claude-plugins-official marketplace) is always
preserved.

## Workaround

After any settings change, manually re-enable:
claude plugin enable oh-my-claudecode@omc