Claude Code v2.1.238: Plugin Marketplaces Can Mint Their Own Auth Headers#

Part of the Claude Code Version Tracker series. | Official Env Vars | Official Changelog

Coming from v2.1.237, a v2.1.238 user can install plugins from a private marketplace that sits behind short-lived auth. A headersHelper command on a URL marketplace or a catalog entry mints HTTP headers (for example a token good for a few minutes) that Claude Code attaches to catalog reads and same-origin archive downloads.[1] The helper runs only when you install or update that plugin, after its command is shown to you, and claude plugin install/update prompt [y/N] (or take -y). The rest of the release is a long list of fixes, with a large Remote Control reliability pass and a memory-growth fix for long sessions.

How the headers helper is wired#

The binary runs the helper through the same guarded path used for other config-resident commands, and it hands the helper a small, fixed environment. A marketplace helper receives CLAUDE_CODE_MARKETPLACE_URL (and CLAUDE_CODE_MARKETPLACE_NAME when the marketplace is named); a plugin helper receives CLAUDE_CODE_PLUGIN_NAME and CLAUDE_CODE_PLUGIN_ARCHIVE_URL. When the source is not operator-authored (a project .mcp.json, a plugin, or an agent file rather than managed settings), inherited credential env vars are scrubbed before the helper runs, so a repo-checked-in helper cannot read your tokens. Headers it emits are filtered too: request-routing and client-identity header names are dropped from non-operator sources, and malformed names or values are rejected. The helper string itself must be printable ASCII with no long runs of spaces and short enough for the install-consent UI to display in full.

VariableWhat It Does
CLAUDE_CODE_MARKETPLACE_URLSet in the environment of a marketplace headersHelper command when Claude Code fetches that marketplace's catalog, alongside CLAUDE_CODE_MARKETPLACE_NAME. The helper reads it to mint headers scoped to that URL; results are memoized with an expiry so the command is not re-run on every fetch. New in v2.1.238.
CLAUDE_CODE_PLUGIN_ARCHIVE_URLSet in the environment of a plugin's headersHelper command at install or update time, together with CLAUDE_CODE_PLUGIN_NAME, so the helper can mint headers for the archive download. Runs only when you install or update that plugin, never during catalog browsing. New in v2.1.238.
MCP_DISCOVERY_CACHE_STRIKESOverrides the strike count that governs the MCP discovery cache (used with MCP_DISCOVERY_CACHE_TTL_S and MCP_DISCOVERY_CACHE_MAX_STALE_S). When set above zero it replaces the built-in default; otherwise the default applies. Paired with a reworked gate, tengu_mcp_discovery_cache_enable.
CLAUDE_CODE_ADOPT_UNDERIVABLE_PARKED_PERMISSIONIn print/SDK mode, when a host reconnects and a permission prompt was left parked with no persisted answer that can be rederived, adopt that prompt and retire the interrupted turn's tool-use IDs instead of re-running the tool call. Works with the hold/retire parked-permission flags.
CLAUDE_CODE_SILENT_TURN_REMINDER_TEXTOverrides the text of the silent-turn reminder (the nudge injected after turns that produce no output). Falls back to the tengu_hushed_lark_text gate value, then a built-in default. Companion to the existing enable/turns knobs.

Fixes that change day-to-day behavior#

Two fixes stand out for long-running use. Interactive sessions no longer grow memory without bound: a subagent's tool results are released once they scroll past the recent display window. And custom, project, and plugin output styles stop drifting back to the default voice partway through a session. A smaller one restores CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true when your account is near, but not over, its usage limit.

Remote Control got the heaviest attention. A session whose process crashed can be reused the next time you message it instead of staying dead until restart; brief HTTP 403 refusals from a VPN or proxy are tolerated for up to three minutes before the blocker is named; model picks made on a phone or the web now update the terminal; messages sent mid-turn from web or Desktop no longer vanish after the turn ends; and ListAgents/SendMessage now work from claude remote-control and Desktop/IDE hosts, while hiding the pre-warmed idle worker until a task claims it. On the MCP side, stdio servers no longer get a server/discover before initialize, so lazy servers stop booting their backend on every session open.

Editing keys, readline style#

A new keybindingFlavor setting under /config chooses how the prompt's editing keys behave. Set it to "readline" and Ctrl+W deletes back to the previous whitespace, matching Bash and other readline programs; the default "classic" keeps deleting the previous word. Separately, Ctrl+L and Cmd+K in fullscreen now always just repaint, and the old double-press /clear shortcut is gone, so 1-row terminals no longer trigger runaway /clear loops.

What these tell us#

The marketplace work makes private plugin distribution practical without baking secrets into config: the helper mints credentials on demand, the environment it sees is minimal and scrubbed for untrusted sources, and the headers it can set are filtered so a repo cannot rewrite request-routing or identity. That is a distribution-security posture, built around per-install consent.

The artifact collaboration surface first seen (unannounced) in v2.1.221 keeps growing, and again with no changelog mention. A new CLAUDE_CODE_ARTIFACT_ROOM variable and an tengu_artifact_verify gate both first appear in v2.1.238, next to new prompt strings that tell the model to check its own published output: "After publishing, never claim the page works without observing it," and that an empty viewer result "can mean no viewer has loaded the version yet, which is NOT evidence of a clean render." The feature is gated and absent from the release notes, the same quiet-then-announce pattern the comment threads followed.

This analysis is conducted for educational and research purposes under fair use principles. All trademarks and software referenced belong to their respective owners. This content is not intended to infringe on any intellectual property rights, circumvent any protections, or encourage unauthorized access to proprietary systems.

Sources#

  1. Claude Code Official Changelog, v2.1.238 release notes

Let's Connect

BlueskyLinkedInThreads
← Back to all posts