Installed plugin details use another marketplace's metadata when plugin IDs collide

[MPIsaac-Per]

Summary

After installing a plugin from a custom marketplace, its Extensions detail page shows another marketplace's author, description, repository URL, listing date, and related plugins when both entries share the same plugin ID. The installed source and marketplace badge remain correct, leaving one page with conflicting provenance.

Versions and environment

• BB 0.42.1, npm installation on a remote Linux server. bb updates status --json reports currentVersion: "0.42.1", latestVersion: "0.42.1", and source: "npm".
• macOS 26.6.2 client, viewing BB remotely. CLI-machine Node: v24.19.0.
• Custom marketplace plus BB Community enabled.
• Live UI behavior was observed on 0.42.1. The matching lookup was independently reproduced from upstream main at aa7d2458180df037b7db3c56c8a3501e6f7473b7; I did not run a full UI build of that commit.

Steps to reproduce

1. Enable two marketplaces containing entries with the same plugin ID. The observed case is linear in BB Community and linear in a custom marketplace.
2. Install the custom entry using bb plugin install linear@<custom-marketplace>.
3. Open Extensions → installed Linear → details.
4. Compare the marketplace badge/installed path with the author, description, Source, Details → Marketplace, and More from this author sections.

A minimal source-level reproduction of the current lookup, requiring no credentials or plugin installation:

const pluginId = "linear";
const selectedPlugin = {
  id: "linear",
  catalogEntryId: "linear",
  catalogMarketplaceName: "custom",
};
const catalogQuery = { data: { entries: [
  { pluginId: "linear", entryId: "linear", marketplace: "bb-community",
     description: "Community description" },
  { pluginId: "linear", entryId: "linear", marketplace: "custom",
     description: "Installed custom description" },
] } };
const selectedCatalogEntry =
  catalogQuery.data?.entries.find((entry) => entry.pluginId === pluginId) ?? null;
console.log(selectedPlugin.catalogMarketplaceName, selectedCatalogEntry.marketplace);
// Actual: custom bb-community
// Expected: custom custom

Expected vs actual

Expected: installed plugin details use that installation's marketplace and catalog entry. When the matching entry is unavailable, use installed-package metadata rather than a different publisher's entry.

Observed in the supplied screenshot:

• Header badge: MPIV Plugins; installed path points to our custom repository and pinned commit.
• Author: By Vedran Burojević.
• Source: github.com/vburojevic/bb-plugin-linear.
• Details → Marketplace: BB Community.
• Description advertises the community plugin's local mirror, thirteen tools, and CLI; these are not the installed plugin's features.

Selected fields from the live bb plugin list --json response confirm the installation's identity:

{
  "id": "linear",
  "version": "0.1.0",
  "catalogEntryId": "linear",
  "catalogMarketplaceName": "mpiv-plugins",
  "publisherLabel": "MPIV Plugins",
  "description": "Browse Linear issues, attach their context to BB threads, and explicitly post results or update status."
}

Evidence

The detail-page lookup selects the first entry whose pluginId matches and does not consult the installed plugin's catalogMarketplaceName or catalogEntryId.

That entry is then used for header metadata and listing/related-author sections.

I extracted and executed the selector from that exact upstream commit with the fixture above. Result:

{"installedMarketplace":"custom","selectedMarketplace":"bb-community","selectedDescription":"Community description","wrongMarketplace":true}

Investigation reference: BB thread thr_fcqjaij8b9. The screenshot's conflicting fields are transcribed above; the image is not attached to this report.

What was ruled out

• The wrong plugin was not installed: the live response's source and root directory point to the custom repository and expected pinned commit.
• The custom manifest has the correct author and description; its refresh completed without an error.
• This is distinct from Marketplace plugin cards do not link to the plugin repository #1968, which concerned missing repository links.
• Searched open/closed issues and PRs for marketplace metadata, plugin collisions, wrong plugin details, author attribution, and catalogMarketplaceName; no matching report found.

Suggested fix

Resolve an installed plugin's catalog metadata by marketplace plus entry identity. Avoid falling back to an unrelated same-ID entry. Add a regression with two marketplaces containing linear, including the case where the installed marketplace's entry disappears.

The observed impact is incorrect publisher/source attribution. I have not observed incorrect code installation, data loss, or credential leakage.

[bb-slop-cop]

🚨 SLOP COP 🚨 · new-issue-autopilot

Classified as Bug · Priority: Medium · Effort: Low · area: plugins.

• Report: https://get-bb.github.io/reports/issues/3263.html
• Verdict: REPRODUCED · confidence: high
• Root cause: the app discarded the installed marketplace identity and resolved detail metadata by plugin ID alone.
• Reproduction label: confirmed-repro
• Fix: Fix catalog identity resolution for installed plugin details #3273