[BUG] Plugin auto-update from a github source with a ref leaves gitCommitSha at the previous install's commit

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet as a single report (#73673 point 4 records the same field going stale, inside a Desktop report about three other problems)
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

After the background plugin auto-updater installs a new version of a plugin whose marketplace entry is a github source with a ref, the plugin's record in ~/.claude/plugins/installed_plugins.json gets the new version, installPath, and lastUpdated, but gitCommitSha keeps the commit of the previous install.

The plugin comes from this marketplace entry, which points at a branch that is rewritten on each release, with the release version written into the plugin manifest on that branch:

{
  "name": "envato-guardrails",
  "source": { "source": "github", "repo": "envato/ai-guardrails-catalog", "ref": "dist" }
}

Record before, after a manual claude plugin update on 2026-09-17 (the dist branch was at 9d4c0c0 then):

version: 0.1.0-rc9   installPath: .../envato-guardrails/0.1.0-rc9    gitCommitSha: 9d4c0c0d...

Record after the auto-updater ran on 2026-09-21 at 05:39:48Z, when dist was at 64657ee:

version: 0.1.0-rc10  installPath: .../envato-guardrails/0.1.0-rc10   gitCommitSha: 9d4c0c0d...

The installed content is right: the cache directory's manifest reads 0.1.0-rc10 and the binary in it reports v0.1.0-rc10. Only the recorded commit is stale.

Two plugins from a different marketplace updated in the same auto-update batch, six seconds earlier, and their gitCommitSha did move to the marketplace's current commit. Those plugins are sourced from paths inside the marketplace repository rather than from a separate ref, so the stale field seems specific to the github source with a ref.

What Should Happen?

gitCommitSha should be the commit of the ref that was cloned for the version now installed, the same as it is after a fresh install.

Steps to Reproduce

1. Add a marketplace whose plugin entry is {"source": "github", "repo": "<owner>/<repo>", "ref": "<branch>"}, where the branch root is the plugin and its plugin.json carries a version.
2. Install the plugin and enable auto-update for the marketplace. Note gitCommitSha in installed_plugins.json.
3. Push a new commit to that branch with a higher version in plugin.json.
4. Start a new Claude Code session and wait for the background update (about five minutes here).
5. Read installed_plugins.json: version and installPath are the new version, gitCommitSha is still the commit from step 2.

Claude Model

Not model related.

Is this a regression?

Unknown. #73673 point 4 reports the same stale field after a CLI plugin update on 2.1.121.

Claude Code Version

2.1.278

Platform

macOS

Operating System

macOS 15.7.7

Terminal/Shell

zsh in tmux

Additional Information

The marketplace entry carries no version field. The auto-updater still found the new release, so it reads the version from the plugin manifest on the ref, which is the behaviour I expected; only the recorded commit is wrong.