What probably matters to youSection of the release
What
Installing or updating a plugin can involve running a marketplace-declared command, which Claude Code normally asks you to confirm. A new --accept-command flag lets you pre-approve that specific command instead of using the broader -y/--yes flag.
--accept-command <sha256> takes the sha256 hash of the exact command text (previously reported via --json's shownCommand.sha256), and only auto-accepts if it matches the command actually shown to the user for that plugin/marketplace pair; otherwise it prints a warning and leaves the command unconfirmed.
If the marketplace's declared command has changed since the hash was generated, it refuses and re-shows the new command instead of accepting it.
This is wired through the CLI option parser and the plugin install and plugin update command handlers alike, so both flows support scoped, non-interactive command acceptance.
Why
This lets scripts and automation approve a known, specific install command without granting blanket trust via -y/--yes, and it protects against silently accepting a different command if the marketplace's listing changes.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeAdded --accept-command <sha256> to claude plugin install and claude plugin update to accept exactly the command a previous --json run…
