plugin update --scope project can update the wrong repository, silently, and report success

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

claude plugin update --scope project can update a different repository than the one you run it
in, silently, and reports success.

Cause

The project-scope lookup matches the recorded projectPath against the process working directory
case-sensitively. On Windows, Node reports an uppercase drive letter (C:\...) while the stored
config may hold a lowercase one (c:\...), so the comparison fails on paths that are the same path.

On a failed match the code does not error. It falls back to updating the first project-scope entry
in the file, whichever repository that happens to be.

Impact

Two failures compound. The update lands in the wrong repository, and the repository you ran it in stays
on its old version while the command reports success. A plugin can then sit many releases behind while
every drift check reports everything current, because the checks compare a template revision that only
moves when the template changes.

We found seven repositories pinned to project-scope copies spanning six minor versions while user
scope was current. Five of them predated a hook that blocks destructive commands, so that protection
was simply absent in five repositories, silently, for weeks. Separating one genuine hook defect from
the stale-version artefacts took four rounds of investigation.

What Should Happen?

Expected

Either match the path case-insensitively on platforms with case-insensitive filesystems, or, when no
entry matches the working directory, fail with a message naming the directory it looked for and the
entries it found. Falling back to the first entry is the one behaviour that cannot be right.

Error Messages/Logs

Steps to Reproduce

Reproduction

On Windows:

1. Install a plugin at project scope in two separate repositories, A and B, so the config holds two

project-scope entries with A first.

1. Ensure the stored projectPath for B differs from Node's process.cwd() only in the case of the

drive letter. Editing the config by hand to lowercase B's drive letter is the direct way.

1. From repository B, run claude plugin update <plugin> --scope project.
2. Observe that the command reports success, repository A's pin moves, and repository B's does not.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.251

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

Workaround

Remove every project-scope pin and let all repositories resolve to user scope. We did that and keep it
that way.

Environment

Windows 11, Claude Code CLI, plugin installed from a private git-backed marketplace source.