Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.229entry #36

Claude Code v2.1.229 ·

Plugins can be installed from a command that produces the plugin directory

Marketplaces can declare command plugin sources, and admins can block them with one setting.

Use it now Notable New Features
JSON All of v2.1.229
Use it nowTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
PluginsArea: what it touches
New FeaturesKind: in v2.1.229,
What probably matters to youSection of the release
What

A marketplace can now declare a command plugin source, where Claude Code runs that command on your machine to produce the plugin directory. Installs and updates prompt before running the command. A new managed setting disableCommandPluginSources turns it off; when it is unset, the existing allowManagedHooksOnly managed setting decides, and an invalid value for either key is treated as disabled.

Details
  • command is now listed alongside github, git-subdir, npm, url and archive in marketplace validation messages.
  • Each installation records the command that produced it, the directory it produced, and the directories previous runs produced, so the sandbox keeps refusing writes to superseded producer directories.
  • Both settings keys are read from managed settings only, so a user or project settings file cannot re-enable this.
Evidence

disableCommandPluginSources

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from
Names in the bundledisableCommandPluginSourcesallowManagedHooksOnly
How sure we are
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this buildNew in this build: disableCommandPluginSources

See this entry in the whole of v2.1.229 →

Feedback