[BUG] Plugin without "version" in its manifest records the enclosing git repo HEAD (~/.claude) as its version

Summary

When a plugin's .claude-plugin/plugin.json declares no version, Claude Code appears to fall back to resolving a git SHA from the plugin's cache directory. That directory is not a git repository of its own, and it lives under ~/.claude. Users who keep ~/.claude under version control (a common setup for syncing skills and settings across machines) hit a surprising result: the plugin records the user's own config repo HEAD as its version.

This is self-sustaining. Every commit to ~/.claude changes the plugin's recorded version at the next refresh, which dirties plugins/installed_plugins.json, which invites another commit, and so on.

Evidence

frontend-design@claude-plugins-official ships no version field:

{
  "name": "frontend-design",
  "description": "Frontend design skill for UI/UX implementation",
  "author": { "name": "Anthropic", "email": "support@anthropic.com" }
}

figma and superpowers both declare one and behave normally (2.2.96, 6.3.0).

What Claude Code recorded for frontend-design in installed_plugins.json:

{
  "scope": "user",
  "installPath": ".../plugins/cache/claude-plugins-official/frontend-design/1cb99d11dc62",
  "version": "1cb99d11dc62",
  "installedAt": "2026-03-24T11:28:42.759Z",
  "lastUpdated": "2026-08-21T10:27:57.567Z",
  "gitCommitSha": "1cb99d11dc622ad4f2023ba13e0ead30366a0d61"
}

That SHA is a commit in my own ~/.claude repository, not anything belonging to the plugin:

$ git -C ~/.claude log -1 --format=%H 1cb99d1
1cb99d11dc622ad4f2023ba13e0ead30366a0d61

The previously recorded value, d78a057216f9253dc47913ddbf2c4c702e8533bd, is likewise the commit that immediately preceded it in the same repository.

The cache directory has no git repo of its own, so git walks up the tree:

$ ls -d ~/.claude/plugins/cache/claude-plugins-official/frontend-design/1cb99d11dc62/.git
ls: No such file or directory

$ git -C ~/.claude/plugins/cache/claude-plugins-official/frontend-design/1cb99d11dc62 rev-parse --show-toplevel
/Users/<me>/.claude

Reproduction

1. git init in ~/.claude and commit something (common when syncing skills and settings).
2. Have a plugin installed whose manifest declares no version, e.g. frontend-design@claude-plugins-official.
3. Let plugins refresh, then inspect ~/.claude/plugins/installed_plugins.json.
4. version and gitCommitSha for that plugin equal ~/.claude's HEAD.
5. Commit again in ~/.claude, refresh again: both values follow the new HEAD.

Expected

A plugin with no declared version should not inherit an unrelated repository's HEAD. Resolving the SHA only when the plugin directory actually belongs to the marketplace clone would fix it, for instance by checking that git rev-parse --show-toplevel matches the expected marketplace root before trusting the result, or by falling back to a stable placeholder when it does not.

Two smaller consequences:

• installPath embeds that SHA, so the cache directory name is derived from the user's config repo as well.
• Anyone versioning ~/.claude gets permanent churn in installed_plugins.json. My workaround was to stop tracking the file.

Environment

• Claude Code 2.1.227, macOS (Darwin 25.6.0)
• ~/.claude tracked with git, pushed to a private GitHub remote
• Affected plugin: frontend-design@claude-plugins-official, user scope, installed 2026-03-24
• Unaffected in the same install: figma@claude-plugins-official 2.2.96, superpowers@claude-plugins-official 6.3.0