[BUG] Marketplace installLocation validated by string prefix, not realpath — symlinked CLAUDE_CONFIG_DIR plugins dir flagged as corrupted

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

claude plugins marketplace update <name> validates each marketplace's recorded installLocation by string-prefix comparison against the current CLAUDE_CONFIG_DIR, without resolving symlinks (realpath). When the plugins directory is shared between config dirs via a symlink, the check false-positives and reports a healthy marketplace as corrupted.

Setup where this bites:

~/.claude-v/plugins  ->  ~/.claude/plugins   (symlink; two profiles share one plugins dir)
~/.claude-sp/plugins ->  ~/.claude/plugins

known_marketplaces.json records installLocation as whichever path form was live when the marketplace was added. An entry recorded as /Users/ved/.claude/plugins/marketplaces/claude-plugins-official then fails validation when the CLI runs with CLAUDE_CONFIG_DIR=~/.claude-v:

corrupted installLocation (/Users/ved/.claude/plugins/marketplaces/claude-plugins-official) — expected a path inside /Users/ved/.claude-v/plugins/marketplaces

Both paths resolve to the same directory on disk. Nothing is corrupted.

Because a shared registry can only match one prefix, marketplaces added from one profile always fail validation in the other — there is no valid state for a multi-profile setup with a shared plugins dir.

What Should Happen?

Resolve both sides with realpath() before comparing (or compare device+inode). A recorded installLocation whose resolved path lies inside the resolved <CLAUDE_CONFIG_DIR>/plugins/marketplaces should validate.

Error Messages/Logs

$ CLAUDE_CONFIG_DIR=~/.claude-v claude plugins marketplace update claude-plugins-official
corrupted installLocation (/Users/ved/.claude/plugins/marketplaces/claude-plugins-official) — expected a path inside /Users/ved/.claude-v/plugins/marketplaces

Steps to Reproduce

1. ln -s ~/.claude/plugins ~/.claude-v/plugins (shared plugins dir across profiles)
2. Add a marketplace with CLAUDE_CONFIG_DIR=~/.claude (entry records the ~/.claude/... path)
3. Run CLAUDE_CONFIG_DIR=~/.claude-v claude plugins marketplace update <name>
4. Validation fails with "corrupted installLocation" despite the path resolving to the expected directory

Impact (aggravating factor)

The error's suggested remediation — marketplace remove + re-add — silently deletes every installed plugin of that marketplace from installed_plugins.json and strips their enabledPlugins entries from settings.json, with no warning and no restore on re-add. In my case that wiped 19 plugins (recovered only because I backed up both files first). Happy to file that as a separate report if useful.

Related: #36575 (closed) covered non-portable installLocation formats; this is the same field but a distinct validation bug.

Environment

• Claude Code v2.1.220
• macOS (Darwin 25.5.0)