[BUG] installed plugins silently disappear from settings.json enabledPlugins

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Installed plugins silently disappear from settings.json's enabledPlugins field after running concurrent Claude Code sessions. The user discovers the problem when previously working slash commands (e.g., /frontend-design, /skill-creator) stop being recognized — the system responds with "Unknown command" or the skill no longer appears in autocomplete. Running /plugins shows the plugin is no longer listed as enabled, and /reload-plugins reports 0 plugins.

Plugin data in installed_plugins.json and plugin cache remain intact, but the plugin is completely unavailable until the user manually re-adds its entry to enabledPlugins in settings.json.

Steps to Reproduce

1. Open two Claude Code sessions (A and B).
2. In session B, install a plugin via /plugins install (e.g., frontend-design).
3. Verify settings.json now has "frontend-design@claude-plugins-official": true in enabledPlugins.
4. In session A, run any command that triggers a settings.json write — even an unrelated operation like /model or /effort switch.
5. Session A's stale snapshot (captured before step 2) overwrites settings.json.
6. enabledPlugins no longer contains frontend-design@claude-plugins-official. The plugin is gone.
7. All sessions are affected — the plugin cannot be used until manually re-added.

Real-world triggers:

• Background sessions (e.g., Obsidian Git vault backup) running alongside interactive sessions
• IDE-integrated Claude Code sessions alongside CLI sessions
• Any session that performs a write operation like /model switch

Actual observed victims (multiple occurrences on the same machine):

• frontend-design@claude-plugins-official — disappeared twice
• skill-creator@claude-plugins-official — disappeared twice

Claude Model

Sonnet (default)

Is this a regression?

Yes

Last Working Version

N/A

Claude Code Version

2.1.218 (Claude Code)

Platform

Anthropic API (via proxy)

Operating System

Ubuntu 24.04.1 LTS

Terminal/Shell

xterm-ghostty

Additional Information

Observation:

The saveConfigWithLock mechanism reads settings.json into a memory snapshot at session start. When session B updates the file (installs a plugin) and session A later performs any write, session A's stale snapshot overwrites the newer on-disk state. The stale-write detection logs telemetry but does not prevent the overwrite.

File state after the bug:

settings.json — plugin entries missing from enabledPlugins:

-  "enabledPlugins": {
-    "claude-hud@claude-hud": true,
-    "claude-md-management@claude-plugins-official": true,
-    "context7@claude-plugins-official": true,
-    "document-skills@anthropic-agent-skills": true,
-    "iosp-service-integration@iosp-agent-skills": true,
-    "ralph-loop@claude-plugins-official": true,
-    "superpowers@claude-plugins-official": true,
-    "frontend-design@claude-plugins-official": true,
-    "skill-creator@claude-plugins-official": true
-  }
+  "enabledPlugins": {
+    "claude-hud@claude-hud": true,
+    "claude-md-management@claude-plugins-official": true,
+    "context7@claude-plugins-official": true,
+    "document-skills@anthropic-agent-skills": true,
+    "iosp-service-integration@iosp-agent-skills": true,
+    "ralph-loop@claude-plugins-official": true,
+    "superpowers@claude-plugins-official": true
+  }

installed_plugins.json at the same time — both plugins still listed, cache intact:

"frontend-design@claude-plugins-official": { installedAt: "...", lastUpdated: "..." }
"skill-creator@claude-plugins-official": { installedAt: "...", lastUpdated: "..." }