Brought to you by Jellypod AI...
you know, I, I was literally sitting at my desk yesterday, pulled my mate's latest
commit, ran slash plugin install tool at team marketplace...
and bam, error.
Stale local index cache rejecting the whole thing because the manifest was out of
date by like, five minutes.
Man, that slash plugin install cache bug was driving everyone crazy!
But version two point one point two hundred thirty two finally fixes it by
automatically refreshing that marketplace manifest index right before executing any
install command.
So no more manual cache clearing required.
Right!
It just fetches the fresh manifest on the fly.
And speaking of team setups, they also completely cleaned up marketplace governance
in that same release.
You can toss out those bloated legacy config options now.
Oh yeah?
What did they replace them with?
It is so much cleaner now.
You just use additionalMarketplaces and allowedMarketplaces in your configuration.
And for security teams who need to lock things down tight, you can set
blockedMarketplaces using bare git repository URLs.
They even added support for nested subgroup repositories on gitlab.com,
which is huge for enterprise setups that partition their internal tools deep in
group hierarchies.
That gitlab.com subgroup support is massive for corporate permissions.
And, and then right on the heels of that, version two point one point two hundred
thirty three dropped some incredible local development tooling.
Have you tried running claude plugin validate yet?
Not on the raw folder structure, no.
What changed?
So, previously you had to package things up, but now claude plugin validate scans
raw dot claude slash skills workspace folders directly!
It parses the SKILL dot md files and flags any invalid YAML frontmatter right there
in your terminal before you even make a git commit.
Oh, that would have saved me, um, at least three embarrassing broken commits last
week.
Did they fix that weird file lock bug when running multiple terminals,
too?
Yes!
Exactly that.
They patched a concurrent write race condition on known marketplaces dot json.
If you had two parallel terminal sessions running Claude Code at once,
they used to collide when updating that marketplace file, but now concurrent writes
are safely handled.
Ah, absolute bliss.
Though, look, there is one security caveat in two point one point two hundred thirty
three that every dev needs to know about, especially if you pull public repos.
They locked down sandbox dot ripgrep path overrides.
Wait, why restrict sandbox dot ripgrep overrides?
Because a malicious workspace repository could ship a project config file pointing
sandbox dot ripgrep to a fake binary inside the repo, effectively hijacking your
system search executable the second you opened the project.
Now, path overrides for ripgrep are strictly restricted to global user settings and
managed administrator settings.
Workspace level configs cannot touch it.
Wow, that is a subtle attack vector.
So malicious repos can't trick Claude Code into executing arbitrary binaries during
a ripgrep scan.
Spot on.
If you are building internal plugin registries, keep your blockedMarketplaces
defined in managed settings, validate your local SKILL dot md files before pushing,
and let Claude handle the index cache syncing automatically.
Makes the whole team workflow smooth as butter.