Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.238 Home All releases ←olderv2.1.237 v2.1.239newer→
Claude Code v2.1.238

Plugins that run a local command to fetch their archive now ask first

Use it now
Useful4 Signal4
Plugins Notable

Plugins that mint headers via a local command now ask you to confirm; -y is ignored in-session.

-y--yes
What

If a plugin fetches its archive using headers minted by a local helper command, installing or updating it now shows the exact command and destination and waits for confirmation. Non-interactive runs are recorded as "unconfirmed" and abort. Inside a Claude Code session, -y/--yes is ignored and you are told to run the install in your own terminal. Autoupdate never runs the helper at all.

Details
  • The prompt reads "Fetching this plugin's archive sends helper-minted headers to" followed by the destination.
  • Autoupdate records a deferred error instead of running the helper.
  • Managed policy can refuse the helper outright.
  • Applies to every plugin declaring such a helper; there is no flag.
Evidence

Fetching this plugin's archive sends helper-minted headers to

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.238 →