Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.229 Home All releases ←olderv2.1.228 v2.1.231newer→
Claude Code v2.1.229

Plugins can be installed from a command that produces the plugin directory

Use it now
Useful3 Signal3
Plugins Notable

Marketplaces can declare command plugin sources, and admins can block them with one setting.

disableCommandPluginSourcesallowManagedHooksOnly
What

A marketplace can now declare a command plugin source, where Claude Code runs that command on your machine to produce the plugin directory. Installs and updates prompt before running the command. A new managed setting disableCommandPluginSources turns it off; when it is unset, the existing allowManagedHooksOnly managed setting decides, and an invalid value for either key is treated as disabled.

Details
  • command is now listed alongside github, git-subdir, npm, url and archive in marketplace validation messages.
  • Each installation records the command that produced it, the directory it produced, and the directories previous runs produced, so the sandbox keeps refusing writes to superseded producer directories.
  • Both settings keys are read from managed settings only, so a user or project settings file cannot re-enable this.
Evidence

disableCommandPluginSources

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.229 →