Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.238 Home All releases ←olderv2.1.237 v2.1.239newer→
Claude Code v2.1.238

Zip-archive plugin entries can carry their own fetch credentials

Use it now
Useful3 Signal3
Plugins Notable

Plugin archives can carry their own fetch headers or a helper command instead of inheriting them.

headersheadersHelper--yes
What

Marketplace catalog entries and plugin entries declared in settings files both accept headers and a headersHelper command, so an archive no longer has to inherit authentication from the enclosing marketplace. -y, --yes now also consents to the helper command used to fetch an archive, and on updates to a changed install command.

Details
  • An entry's own auth is bound to its URL and overlaid on the enclosing url-source marketplace's headers only when the archive shares that origin.
  • One resolver now decides archive auth from the marketplace source, the trusted declaration and the settings-entry auth together.
  • headersHelper values are validated as printable ASCII and capped at a length the install consent pane can render.
  • A managed-policy refusal reports entry_helper_disabled_by_policy or entry_helper_remote_policy_unconsented.
  • Trust telemetry gained hasMarketplaceHeadersHelper and hasRepoHeadersHelpers; a new on-disk cache namespace pluginAssetCache, keyed by archive digest, sits alongside.
Evidence

headersHelper must not be longer than the install consent UI can display, bound to this URL, one whose archive is fetched through a headersHelper command (required when stdin or stdout is not a TTY)

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.238 →