forked from bchanot/claude
bastienandClaude Opus 4.7
64d6ca7843
Two interlocked bugs masking each other: 1. install-plugins.sh installed but never enabled marketplace plugins. `claude plugin install` only writes to ~/.claude/plugins/cache; without a separate `claude plugin enable` the plugin sits dormant in the user's enabledPlugins map. security-guidance and superpowers shipped as ALWAYS-ON in CLAUDE.md/README/installer banner but in practice landed disabled on every fresh install. 2. session-start.sh hardcoded the literal "security-guidance rtk superpowers" in the ✅ ON row, so the misleading banner agreed with the misleading documentation. The bug stayed invisible. Fixes: - install-plugins.sh now calls enable_plugin (added in the caveman commit) for security-guidance and superpowers immediately after install. Idempotent: skips if already in enabledPlugins. - session-start.sh builds the ALWAYS-ON row dynamically from RTK binary detection + plugin_enabled() lookups against settings.json. Plugins that are not enabled are omitted, so the banner reflects reality. Wider strings split across two lines like the toggle row. - settings.json: ship security-guidance and superpowers in enabledPlugins so this user's machine matches the contract until install-plugins.sh runs again. Out of scope (separate bug, not addressed here): the marketplace-aware detect_security_guidance / detect_plugin_dev cache scans miss plugins nested under cache/<marketplace>/<plugin>/<version>/. They aren't on the always-on path so the symptom is hidden — left for a follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>