You'll notice
Useful3 Signal2
Plugin folders that other users can write to are now refused instead of loaded.
What's wrong with this entry?
Anonymous. No account, no email.
What
Before reading a plugin's manifest, Claude Code now checks that the plugin directory is actually owned by you and not writable by anyone else. Trees that fail the check are refused, so a plugin folder someone else can edit no longer gets consulted.
Details
- Refusal conditions include: owner uid that is not the real user, other-writable or group-writable modes, non-sticky writable ancestors, hard links, symlinks pointing outside the tree, and
.gitmetadata that was not created locally. - The walk is capped by a maximum entry count and depth, so a huge or deeply nested tree stops the scan rather than hanging it.
- Group membership is resolved by reading /etc/group, /etc/passwd and /etc/nsswitch.conf. If nsswitch lists a non-file source for groups, membership is treated as unverifiable and the refusal says so.
- Running under sudo is handled: SUDO_UID, SUDO_GID and SUDO_USER are cross-checked against /usr/bin/id. Container evidence (/run/.containerenv, /proc/1/cgroup) relaxes the uid rules.
- macOS skips the group-writable check, and the whole layer needs process.getuid to be available.
Evidence
is group-writable, and group membership cannot be verified on this system (
Strings lifted out of the shipped bundle, so the claim above can be checked against them.