fix(install,session-start): enable always-on plugins + truthful banner

Two interlocked bugs masking each other:

1. install-plugins.sh installed but never enabled marketplace plugins.
   `claude plugin install` only writes to ~/.claude/plugins/cache; without
   a separate `claude plugin enable` the plugin sits dormant in the
   user's enabledPlugins map. security-guidance and superpowers shipped
   as ALWAYS-ON in CLAUDE.md/README/installer banner but in practice
   landed disabled on every fresh install.

2. session-start.sh hardcoded the literal "security-guidance rtk
   superpowers" in the ✅ ON row, so the misleading banner agreed with
   the misleading documentation. The bug stayed invisible.

Fixes:
  - install-plugins.sh now calls enable_plugin (added in the caveman
    commit) for security-guidance and superpowers immediately after
    install. Idempotent: skips if already in enabledPlugins.
  - session-start.sh builds the ALWAYS-ON row dynamically from RTK
    binary detection + plugin_enabled() lookups against
    settings.json. Plugins that are not enabled are omitted, so the
    banner reflects reality. Wider strings split across two lines like
    the toggle row.
  - settings.json: ship security-guidance and superpowers in
    enabledPlugins so this user's machine matches the contract until
    install-plugins.sh runs again.

Out of scope (separate bug, not addressed here): the marketplace-aware
detect_security_guidance / detect_plugin_dev cache scans miss plugins
nested under cache/<marketplace>/<plugin>/<version>/. They aren't on
the always-on path so the symptom is hidden — left for a follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
bastien
2026-05-03 23:03:21 +02:00
co-authored by Claude Opus 4.7
parent e4f4edc121
commit 64d6ca7843
3 changed files with 28 additions and 2 deletions
+23 -1
View File
@@ -123,7 +123,29 @@ unset _passive_t _budget_pct _budget
echo ""
echo "┌─ Claude Code config ──────────────────────────────────┐"
printf "│ ✅ ON : %-40s│\n" "security-guidance rtk superpowers"
# "ALWAYS ON" row — actual state, not hardcoded. RTK is a binary on PATH;
# the others are marketplace plugins whose state lives in
# settings.json:enabledPlugins. Anything missing/disabled is omitted so
# the user sees the real picture instead of a misleading literal.
ALWAYS_ON=()
detect_rtk &>/dev/null && ALWAYS_ON+=("rtk")
plugin_enabled "security-guidance@claude-code-plugins" && ALWAYS_ON+=("security-guidance")
plugin_enabled "superpowers@superpowers-marketplace" && ALWAYS_ON+=("superpowers")
plugin_enabled "caveman@caveman" && ALWAYS_ON+=("caveman")
ALWAYS_ON_STR="${ALWAYS_ON[*]:-none}"
# Same 40-char-width split policy as the toggle row below — keeps the
# right border aligned when 4 always-on plugins overflow the field.
if [ "${#ALWAYS_ON_STR}" -le 40 ]; then
printf "│ ✅ ON : %-40s│\n" "$ALWAYS_ON_STR"
else
_ao_line1="${ALWAYS_ON[0]} ${ALWAYS_ON[1]} ${ALWAYS_ON[2]:-}"
_ao_rest=("${ALWAYS_ON[@]:3}")
_ao_line2="${_ao_rest[*]}"
printf "│ ✅ ON : %-40s│\n" "$_ao_line1"
printf "│ %-40s│\n" "$_ao_line2"
unset _ao_line1 _ao_line2 _ao_rest
fi
unset ALWAYS_ON ALWAYS_ON_STR
# Plugin display — all plugins shown, split across 2 lines if >4
_active_count=${#TOGGLE_ACTIVE[@]}
_inactive_count=${#TOGGLE_INACTIVE[@]}