Plugins can now be installed and updated directly from the npm registry

What

• Plugin installs and updates can now use an npm registry as the source, alongside the existing git and claude.ai sources. Install records track npmVersionSpec, npmResolved, npmIntegrity, and npmRegistry, and installation refuses to proceed if the package's integrity can't be verified.
• Plugin identifiers can now reference npm-scoped packages, such as @scope/name, and @scope/name@npm is understood as that package sourced from npm.
• claude plugin install recognizes an @npm-suffixed spec (name@npm, @scope/name@npm, [email protected]@npm) and a new --registry option to install straight from a given npm registry URL, bypassing the marketplace system entirely.
• A deep link (claude://install-plugin) can now install a plugin directly, taking a plugin name and an optional marketplace, which can also point at an npm source.
• This whole capability is gated behind an account flag and a feature gate (tengu_plugins_npm_marketplace).

Why

This lets teams distribute and install plugins as ordinary npm packages instead of requiring a git-based marketplace, while still verifying the downloaded package's integrity before trusting it.