What
Claude Code includes a schema for Cowork 3P settings. A schema is the description of which settings exist and what shape they take. The allowedPluginMarketplaces setting in it now shows a warning when an entry is not pinned to one exact version:
- URL sources need a Manifest SHA-256.
- Other sources need a full 40-character commit SHA in Ref.
The warning reads: "Without one this marketplace is treated as available: it is listed, but this setting installs nothing."
Why
An administrator who expects a marketplace to install plugins automatically is now told when the entry will only list the marketplace instead.