[BUG] Settings schema: `strictKnownMarketplaces` rejects `source: "settings"`, which the runtime accepts and enforces

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A settings-sourced marketplace declared in extraKnownMarketplaces cannot be allowlisted in strictKnownMarketplaces without a schema error.

The runtime validates both fields against the same marketplace source union, which includes the settings and skills-dir variants. The published schema at https://json.schemastore.org/claude-code-settings.json includes settings under extraKnownMarketplaces and omits both variants from strictKnownMarketplaces and blockedMarketplaces. Since every branch sets additionalProperties: false, an entry that matches no branch is reported against plugins as an unknown key.

The managed settings editor at claude.ai/admin-settings/claude-code shows "Errors detected in schema. Settings may not work as expected." on the strictKnownMarketplaces entry while accepting the identical object under extraKnownMarketplaces. Saving requires "Update with errors", and the banner returns on every later edit, so a genuine schema error in the same file is no longer distinguishable.

Omitting the entry is not a workaround. The allowlist check runs on settings-sourced marketplaces like any other, so once strictKnownMarketplaces is set, a settings-sourced marketplace missing from it is blocked and its plugins stop loading with marketplace-blocked-by-policy. Listing it is required, and listing it is what the schema rejects.

The policy itself behaves correctly. Claude Code registers the marketplace, enforces the allowlist against it, and installs the plugin.

<img width="1007" height="407" alt="Image" src="https://github.com/user-attachments/assets/ca09d29c-aa2c-4a72-ad3c-e55e2051f819" />

What Should Happen?

The published schema should accept the same variants the runtime accepts. Both strictKnownMarketplaces and blockedMarketplaces need the settings variant (source, name, plugins) and the skills-dir variant. skills-dir is documented in the runtime as meaningful only in those two lists, so today it validates nowhere.

The docs list github, url, hostPattern and pathPattern as the strictKnownMarketplaces source types, so they need the same two additions.

Error Messages/Logs

Errors detected in schema. Settings may not work as expected.


Reported against the `plugins` key of the `strictKnownMarketplaces` entry.

Steps to Reproduce

1. Open managed settings at claude.ai/admin-settings/claude-code, or open managed-settings.json in an editor that validates against https://json.schemastore.org/claude-code-settings.json.

1. Declare a settings-sourced marketplace and allowlist it:

{
  "extraKnownMarketplaces": {
    "acme-plugins": {
      "source": {
        "source": "settings",
        "name": "acme-plugins",
        "plugins": [
          {
            "name": "acme-tools",
            "source": { "source": "github", "repo": "acme-corp/acme-tools" }
          }
        ]
      }
    }
  },
  "strictKnownMarketplaces": [
    {
      "source": "settings",
      "name": "acme-plugins",
      "plugins": [
        {
          "name": "acme-tools",
          "source": { "source": "github", "repo": "acme-corp/acme-tools" }
        }
      ]
    }
  ]
}

1. The extraKnownMarketplaces block validates. The strictKnownMarketplaces entry is flagged on plugins.

1. Compare the two source unions in the published schema:

$ curl -sL https://json.schemastore.org/claude-code-settings.json \
  | jq -c '[.properties.strictKnownMarketplaces.items.anyOf[].properties.source.const]'
["hostPattern","github","git","url","npm","file","directory","pathPattern"]

$ curl -sL https://json.schemastore.org/claude-code-settings.json \
  | jq -c '[.properties.extraKnownMarketplaces.additionalProperties.properties.source.anyOf[].properties.source.const]'
["url","hostPattern","github","git","npm","file","directory","settings"]

1. Save with "Update with errors" and start Claude Code. The marketplace registers, the plugin installs, and marketplaces outside the allowlist are blocked.

Claude Model

Other

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.228

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

#77315 reports the same class of drift between the published schema and runtime validation, on a different field and constraint.