Plugins: enabled-in-settings but never installed loads nothing silently; marketplace autoUpdate never updates existing installs

Summary

Committing enabledPlugins + extraKnownMarketplaces to a project's .claude/settings.json does not make the plugin load in that project: if installed_plugins.json has no install record for that project path, the plugin's skills and hooks are silently absent — no warning, no auto-install. Relatedly, marketplace autoUpdate: true refreshes the marketplace clone but never updates existing installs, so per-project installs stay pinned to their install-time version indefinitely with no lag signal.

Environment

• Claude Code 2.1.212, macOS (darwin 25.6.0)
• Private GitHub marketplace (extraKnownMarketplaces → github source), plugin installed per-project scope

Bug 1 — plugin enabled in project settings but never provisioned: silently absent

We share a process plugin across team repos by committing this to each repo's .claude/settings.json (the docs' team-sharing pattern):

{
  "enabledPlugins": { "lanoticia-process@lanoticia": true },
  "extraKnownMarketplaces": {
    "lanoticia": { "source": { "source": "github", "repo": "lanoticia/claude-plugin" } }
  }
}

On a new repo (.../excelenteawards), sessions started with none of the plugin's skills or hooks available — invoking its slash commands got "unknown skill", with no indication why. The cause: ~/.claude/plugins/installed_plugins.json carried install records for three sibling repos but none for this project path. The enable flag assumes an install record that nothing had created. Running /plugin install lanoticia-process@lanoticia + /reload-plugins fixed it (our installed_plugins.json shows the record appearing at that moment: installedAt: 2026-07-31T19:09:15Z), but the failure mode cost ~20 minutes of diagnosis, and every new machine/teammate cloning the repo will hit it again.

Expected: either (a) settings are declarative — an enabled plugin whose marketplace is declared right there in the same file gets installed on session start (possibly behind a consent prompt), or (b) at minimum a visible session-start warning: "plugin X@Y is enabled in .claude/settings.json but not installed for this project — run /plugin install X@Y".

Actual: the plugin is silently absent.

Bug 2 — marketplace autoUpdate refreshes the clone but never the installs

The marketplace entry has autoUpdate: true. The marketplace clone under ~/.claude/plugins/marketplaces/<name> does get refreshed (its lastUpdated advances). But existing per-project installs keep their install-time version forever:

marketplace clone lastUpdated: 2026-07-30 (carrying plugin v0.1.13)

installed_plugins.json, same day:
  /repo-a  version 0.1.11  (installedAt 07-21)
  /repo-b  version 0.1.11  (installedAt 07-24)
  /repo-c  version 0.1.13  (fresh install 07-30 — new installs DO get the latest)

The two older repos ran 0.1.11 for over a week while the clone carried 0.1.13 — hook fixes and new skills silently missing, nothing surfaced the lag. (Their records' lastUpdated even advanced on 07-28 without the version changing.)

Expected: autoUpdate: true updates installs (that's what the flag reads as), or, if it intentionally only refreshes the marketplace clone, some signal that installs lag the marketplace (session-start notice, /plugin badge).

Actual: installs pin to install-time version with no signal; the only way to notice is to diff installed_plugins.json against the clone by hand. We've shipped a SessionStart hook in the plugin itself that does this diff as a stopgap, but it inherently can't cover Bug 1 — in the enabled-but-never-installed state, no plugin hooks load at all, which is why this needs a fix in Claude Code.

Steps to reproduce (Bug 1)

1. In repo A: /plugin marketplace add <marketplace> then /plugin install some-plugin@<marketplace> (project scope). Commit the resulting enabledPlugins + extraKnownMarketplaces settings.
2. Clone repo A to a fresh path (or a second machine), or copy the same settings block into repo B.
3. Start a session there: the plugin's skills/hooks don't load; nothing reports why.

Steps to reproduce (Bug 2)

1. Install a marketplace plugin at version N in a project; set the marketplace autoUpdate: true.
2. Publish version N+1 to the marketplace repo; wait for (or trigger) a marketplace refresh — the clone now carries N+1.
3. Sessions in the project keep running version N indefinitely; installed_plugins.json keeps version: N; no lag signal anywhere.