[BUG] claude plugin marketplace remove / plugin uninstall corrupts project-scope

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Running claude plugin uninstall <plugin>@<marketplace> and/or claude plugin marketplace remove <marketplace> silently rewrites a project's .claude/settings.json (repo-scoped, checked into git), emptying its extraKnownMarketplaces and enabledPlugins keys to {} — even though both commands explicitly report scope: user and never mention touching any project-scope file.

What Should Happen?

Only the user-scope registration should be modified. The project's committed .claude/settings.json — which declares its own extraKnownMarketplaces/enabledPlugins entry under the same marketplace name — should be left untouched, since both commands' output claims scope: user.

Error Messages/Logs

Running with --debug-file, these lines appear around the removal flow:

[DEBUG] Skipping orphaned enabledPlugins entry terraform-tools@company-infra-marketplace: marketplace not registered
[DEBUG] Syncing installed_plugins.json with enabledPlugins from all settings.json files

This suggests the removal triggers a step that "syncs installed_plugins.json with enabledPlugins from all settings.json files," and that sync treats any enabledPlugins/extraKnownMarketplaces entry under the just-removed marketplace name as "orphaned" across every settings.json file it scans — including project-scope files the command never reported modifying — rewriting them to empty, instead of restricting the removal to the scope it claims to operate on (or, at minimum, leaving alone declarations in files it doesn't own at that scope).

Steps to Reproduce

1. A project has a committed .claude/settings.json declaring:

{
"extraKnownMarketplaces": {
"company-infra-marketplace": {
"source": { "source": "git", "url": "git@bitbucket.org:org/repo.git" }
}
},
"enabledPlugins": { "terraform-tools@company-infra-marketplace": true },
"env": { "AWS_REGION": "us-east-1" }
}

1. Separately, at user scope (~/.claude.json or ~/.claude/settings.json), a marketplace with the same name (company-infra-marketplace) is already registered — e.g. pointing at a local development directory (claude plugin marketplace add /local/path) — with the plugin already installed from it.
2. From inside the project directory, run:

claude plugin uninstall terraform-tools@company-infra-marketplace
claude plugin marketplace remove company-infra-marketplace

1. Both complete successfully and report (scope: user).
2. Inspect the project's .claude/settings.json again.

Expected

Only the user-scope registration should be modified. The project's committed .claude/settings.json — which declares its own extraKnownMarketplaces/enabledPlugins entry under the same marketplace name — should be left untouched, since both commands' output claims scope: user.

Actual

The project's .claude/settings.json gets rewritten: extraKnownMarketplaces and enabledPlugins are emptied to {}, with no warning, diff, or mention in the CLI output. Reproduced deterministically twice in the same session (same steps, same result both times).

Actual diff observed:
{

• "extraKnownMarketplaces": {
• "company-infra-marketplace": {
• "source": {
• "source": "git",
• "url": "git@bitbucket.org:org/repo.git"
• }
• }
• },
• "enabledPlugins": {
• "terraform-tools@company-infra-marketplace": true
• },

"env": {
"AWS_REGION": "us-east-1"

• }
• },
• "enabledPlugins": {},
• "extraKnownMarketplaces": {}

}

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.210

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_