Follow Discord
Sweep 19 Sep 2026 · 02:36Z Build v2.1.278 500 read Stable v2.1.267 Latest v2.1.278 Next v2.1.278 Feeds RSS JSON llms.txt Unofficial
Claude Code v2.1.271 ·

New content-source integrity hashing for plugin commands and 'entry helper' sources

← All of v2.1.271 Home All releases

New integrity-hashing system checks plugin commands and their sources before trusting them

TierUnder the hoodhow much it should matter to you
Useful2my rating, 1 to 5
Signal2worth watching, 1 to 5
AreaPluginswhat it touches
KindInternal Changesin v2.1.271,
Under the hood

New integrity-hashing system checks plugin commands and their sources before trusting them

What

Claude Code now computes a cryptographic fingerprint (a SHA-256 hash) over a plugin command's type, plugin ID, and command text, combined with either a catalog revision or an archive URL. A separate "catalog revision" value is derived from the plugin's git commit, a digest file in cloud storage, or a hash of its marketplace and package files.

A new set of outcomes determines whether a plugin command is trusted before it runs:

  • command_source_refused
  • command_source_declined
  • entry_helper_unconfirmed
  • entry_helper_declined
Why

This adds a verification step so plugin commands can be checked against a known-good source before Claude Code trusts them, reducing the risk of running a command whose origin can't be confirmed.

See this entry in the whole of v2.1.271 →