Organization-managed plugins with a hooks module are verified by folder digest before loading

What

A plugin is an add-on package for Claude Code. A hooks module is the code a plugin runs at set points in a session. Organization-managed plugins that carry a hooks module now go through a sealed read before they load:

• Folder check: Claude Code walks the plugin folder. It refuses symlinks (shortcut files that point elsewhere) and names that are not valid UTF-8 text, and it caps the number and size of files.
• Digest: it computes a sha256 digest (a fingerprint of the whole folder's contents), which must be in the list of allowed digests.
• Manifest: the plugin manifest (its description file) must match what the loader read, must declare no hooks of its own, and must list exactly one hooks module, which is also checked against what the loader read.
• Refusal: a plugin that fails is logged as 'is not treated as the organization's, and does not load', and plugin_sealed_read is recorded as a failure.
• Unsealed plugins: plugins that are not sealed take the old path, which only checks policy.

Why

If the files of an organization-managed plugin are changed after approval, the plugin is refused instead of running altered code.