{"version":"2.1.224","anchor":"plugins-can-be-installed-from-a-zip-archive-over-https","canonical_anchor":"plugins-can-be-installed-from-a-zip-archive-over-https","heading":"Plugins can be installed from a zip archive over HTTPS","tier":"use","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/plugins-can-be-installed-from-a-zip-archive-over-https","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Plugins can be installed from a zip archive over HTTPS\n\nInstall plugins from an HTTPS zip, with a sha256 pin checked on every download.\n\n**What**\n\nMarketplaces can now offer a plugin as a downloadable zip. A new source kind `archive` takes an HTTPS zip URL plus an optional `sha256` pin; when the pin is set every download is checked against it and the install is refused on mismatch, and the digest also stands in as the plugin's version when none is declared.\n\n**Details**\n\n- Downloads are hardened against server-side request forgery: HTTPS only, loopback, link-local and cloud-metadata hosts refused, at most 5 redirects, a 256 MB size cap, a 120 second timeout, and a fixed User-Agent of `Claude-Code-Plugin-Manager`.\n- Headers configured on the enclosing marketplace url-source are only reused when the origin matches.\n- Installed plugin records gained a `contentSha256` field, and the temp directory used during install has an \"archive\" naming case.\n\n**Evidence**\n\n`plugin archive URL policy rejected`\n\n- Area: Plugins\n- Names: `archive`, `sha256`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 2\/5"}