feat(plh): flag plugin namespace collisions (same declared name)

Two plugins that declare the same `name` in plugin.json collapse into one
component namespace (/name:command, name:skill, agent "name"). Resolution
between two installed same-name plugins is undocumented, so one plugin's
commands/skills/agents are silently shadowed and unreachable. PLH now flags
this at medium severity, keying on the declared `name` (not folder basename,
via new declaredName on scanSinglePlugin) with a COL-shaped details.namespaces
payload. Name-less plugins are excluded from the collision map.

Search-first (code.claude.com/docs/en/plugins): plugin components are
namespaced by the declared name, so a plugin component can never shadow a
user/project one — only a same-name collision loses components. This refutes
the original "plugin vs user vs project shadowing" framing in the backlog.

Adds humanizer pattern, fixture (duplicate-plugin-name: 2 colliding + 2
name-less), and 3 tests. Suite 929->932. self-audit A 97 / A 100, scanners 13.

scanners/lib/humanizer-data.mjs

@@ -723,6 +723,14 @@ export const TRANSLATIONS = {
           recommendation: 'Add the missing setting shown in the details.',
         },
       },
+      {
+        regex: /^Plugin namespace collision:/,
+        translation: {
+          title: 'Two plugins share the same namespace, so one hides the other',
+          description: 'Claude Code names a plugin\'s commands, skills, and agents after the plugin (like `/name:command`). When two plugins declare the same name, they share one namespace and only one is reachable — the other\'s commands, skills, and agents silently disappear.',
+          recommendation: 'Give each plugin a distinct `name` in its `plugin.json`. The folder name doesn\'t matter — the `name` field is what forms the namespace.',
+        },
+      },
     ],
     _default: {
       title: 'A plugin has a configuration issue',

scanners/plugin-health-scanner.mjs

@@ -99,6 +99,9 @@ async function scanSinglePlugin(pluginDir) {
   const pluginName = basename(pluginDir);
   let commandCount = 0;
   let agentCount = 0;
+  // Declared namespace from plugin.json `name` (the prefix for /name:command,
+  // name:skill, agent "name"). Folder basename is NOT the namespace.
+  let declaredName = null;
 
   // 1. Validate plugin.json
   const pluginJsonPath = join(pluginDir, '.claude-plugin', 'plugin.json');
@@ -119,6 +122,9 @@ async function scanSinglePlugin(pluginDir) {
     }
 
     if (parsed) {
+      if (typeof parsed.name === 'string' && parsed.name.trim()) {
+        declaredName = parsed.name.trim();
+      }
       for (const field of REQUIRED_PLUGIN_JSON_FIELDS) {
         if (!parsed[field]) {
           findings.push(finding({
@@ -309,7 +315,7 @@ async function scanSinglePlugin(pluginDir) {
     }
   } catch { /* skip */ }
 
-  return { name: pluginName, findings, commandCount, agentCount };
+  return { name: pluginName, declaredName, findings, commandCount, agentCount };
 }
 
 /**
@@ -374,6 +380,48 @@ export async function scan(targetPath) {
     } catch { /* no commands dir */ }
   }
 
+  // Cross-plugin checks: plugin namespace (declared name) collisions.
+  // Claude Code namespaces every plugin component by the plugin's declared
+  // `name` (/name:command, name:skill, agent "name"). Two plugins that declare
+  // the SAME name collapse into one namespace; the resolution between two
+  // installed plugins is undocumented, so one plugin's components are silently
+  // shadowed. Name-less plugins are flagged elsewhere and never grouped here.
+  const byDeclaredName = new Map(); // declaredName → string[] of plugin dirs
+  for (let idx = 0; idx < pluginResults.length; idx++) {
+    const declaredName = pluginResults[idx].declaredName;
+    if (!declaredName) continue;
+    if (!byDeclaredName.has(declaredName)) byDeclaredName.set(declaredName, []);
+    byDeclaredName.get(declaredName).push(pluginDirs[idx]);
+  }
+  for (const [declaredName, dirs] of byDeclaredName) {
+    if (dirs.length < 2) continue;
+    allFindings.push(finding({
+      scanner: SCANNER,
+      severity: SEVERITY.medium,
+      title: `Plugin namespace collision: "${declaredName}"`,
+      description:
+        `${dirs.length} plugins declare the same name "${declaredName}" in plugin.json. ` +
+        `Claude Code namespaces every plugin component by that name ` +
+        `(/${declaredName}:command, ${declaredName}:skill, agent "${declaredName}"), so the ` +
+        'namespaces collapse into one. Resolution between two installed plugins of the same ' +
+        "name is undocumented — one plugin's commands, skills, and agents are silently shadowed " +
+        'and become unreachable.',
+      file: join(dirs[0], '.claude-plugin', 'plugin.json'),
+      evidence: `name="${declaredName}"; plugins=${dirs.map(d => basename(d)).join(',')}`,
+      recommendation:
+        'Rename one plugin\'s "name" in plugin.json so each plugin owns a distinct namespace. ' +
+        'The folder name does not matter — the declared "name" field is the namespace.',
+      category: 'plugin-hygiene',
+      details: {
+        namespaces: dirs.map(d => ({
+          source: `plugin:${basename(d)}`,
+          name: declaredName,
+          path: join(d, '.claude-plugin', 'plugin.json'),
+        })),
+      },
+    }));
+  }
+
   return scannerResult(SCANNER, 'ok', allFindings, pluginDirs.length, Date.now() - start);
 }