Claude Code Adds an `archive` Plugin Source With SHA-256 Pinning
Claude Code Changelog·medium signal
2.1.224 adds an `archive` plugin source that installs plugins from a zip over HTTPS with SHA-256 pinning. This is the first Claude Code plugin install path with content-addressed integrity verification, as opposed to trusting a marketplace or git ref that can be force-pushed. If you distribute internal plugins, pinning the hash is now the way to make an install reproducible and tamper-evident.