{"version":"2.1.139","anchor":"bug-fixes","canonical_anchor":"bug-fixes","heading":"","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.139\/e\/bug-fixes","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.139","markdown":"- Bash safety analysis now detects ambiguous heredoc terminators, including `<<-` tab-prefixed delimiters and heredoc body lines that can be mistaken for terminators with shell metacharacters. Evidence: heredoc safety checks (search for `\"ambiguous heredoc terminator\"`, `\"Heredoc uses <<- with a tab-prefixed delimiter\"`)\n\n- Plugin ZIP loading now handles archives with a wrapper directory instead of failing or choosing the wrong root. Evidence: inline plugin ZIP handling (search for `\"Inline plugin zip had wrapper directory; using\"`)\n\n- Missing plugin errors are more actionable and now suggest `claude plugin list` or `--plugin-dir <path>`. Evidence: plugin lookup error (search for `\"not found. Run `claude plugin list` to see installed plugins\"`)\n\n- Marketplace plugin cache misses now explain that the plugin may have been removed and tell users to disable it via `\/plugin`. Evidence: plugin source cache-miss message (search for `\"the plugin may have been removed. Disable it via \/plugin to clear this warning\"`)\n\n- Settings-file watching now tracks symlink targets so atomic-save edits to the target file are detected. Evidence: symlink target watcher (search for `\"also watching\"`, `\"so atomic-save edits to the target are detected\"`)\n\n- Plugin directory copying now handles cyclic symlinks, non-regular symlink targets, and symlinks escaping the containment root more carefully. Evidence: symlink materialization safeguards (search for `\"copyDir: skipping cyclic symlink target\"`, `\"copyDir: skipping symlink escaping containment root\"`)\n\n- HTTP\/SSE transport now aborts streams that exceed the body limit without an SSE event boundary, preventing unbounded memory growth when a server returns non-protocol data. Evidence: SSE body overflow guard (search for `\"without an SSE event boundary\"`, `\"HttpBodyOverflowError\"`)\n\n- Proxy and TLS connection setup now has explicit timeout\/failure errors for gateway-style connections. Evidence: connection error strings (search for `\"TLS connection timed out\"`, `\"proxy CONNECT failed\"`, `\"proxy CONNECT timed out\"`)"}