1
00:00:00,079 --> 00:00:01,959
Brought to you by Jellypod AI...

2
00:00:03,819 --> 00:00:07,919
you know, I, I was literally sitting at my
desk yesterday, pulled my mate's latest

3
00:00:07,960 --> 00:00:11,659
commit, ran slash plugin install tool at
team marketplace...

4
00:00:12,279 --> 00:00:13,619
and bam, error.

5
00:00:14,299 --> 00:00:19,739
Stale local index cache rejecting the
whole thing because the manifest was out of

6
00:00:19,779 --> 00:00:21,359
date by like, five minutes.

7
00:00:21,738 --> 00:00:25,858
Man, that slash plugin install cache bug
was driving everyone crazy!

8
00:00:26,617 --> 00:00:30,697
But version two point one point two
hundred thirty two finally fixes it by

9
00:00:30,777 --> 00:00:34,878
automatically refreshing that marketplace
manifest index right before executing any

10
00:00:34,918 --> 00:00:35,637
install command.

11
00:00:36,237 --> 00:00:38,298
So no more manual cache clearing required.

12
00:00:38,492 --> 00:00:38,732
Right!

13
00:00:38,953 --> 00:00:40,992
It just fetches the fresh manifest on the
fly.

14
00:00:41,793 --> 00:00:46,432
And speaking of team setups, they also
completely cleaned up marketplace governance

15
00:00:46,492 --> 00:00:47,452
in that same release.

16
00:00:48,052 --> 00:00:50,972
You can toss out those bloated legacy
config options now.

17
00:00:51,241 --> 00:00:51,542
Oh yeah?

18
00:00:52,421 --> 00:00:53,441
What did they replace them with?

19
00:00:53,917 --> 00:00:55,597
It is so much cleaner now.

20
00:00:55,737 --> 00:01:00,317
You just use additionalMarketplaces and
allowedMarketplaces in your configuration.

21
00:01:00,437 --> 00:01:04,477
And for security teams who need to lock
things down tight, you can set

22
00:01:04,537 --> 00:01:08,397
blockedMarketplaces using bare git
repository URLs.

23
00:01:08,493 --> 00:01:12,957
They even added support for nested
subgroup repositories on gitlab.com,

24
00:01:13,010 --> 00:01:16,877
which is huge for enterprise setups that
partition their internal tools deep in

25
00:01:16,930 --> 00:01:18,157
group hierarchies.

26
00:01:18,576 --> 00:01:22,676
That gitlab.com subgroup support is
massive for corporate permissions.

27
00:01:22,736 --> 00:01:26,496
And, and then right on the heels of that,
version two point one point two hundred

28
00:01:26,677 --> 00:01:29,676
thirty three dropped some incredible local
development tooling.

29
00:01:30,116 --> 00:01:32,216
Have you tried running claude plugin
validate yet?

30
00:01:32,250 --> 00:01:33,930
Not on the raw folder structure, no.

31
00:01:34,010 --> 00:01:34,890
What changed?

32
00:01:34,875 --> 00:01:39,595
So, previously you had to package things
up, but now claude plugin validate scans

33
00:01:39,695 --> 00:01:43,275
raw dot claude slash skills workspace
folders directly!

34
00:01:43,462 --> 00:01:48,955
It parses the SKILL dot md files and flags
any invalid YAML frontmatter right there

35
00:01:48,982 --> 00:01:51,195
in your terminal before you even make a
git commit.

36
00:01:51,627 --> 00:01:56,887
Oh, that would have saved me, um, at least
three embarrassing broken commits last

37
00:01:56,987 --> 00:01:57,167
week.

38
00:01:58,487 --> 00:02:01,848
Did they fix that weird file lock bug when
running multiple terminals,

39
00:02:01,887 --> 00:02:02,027
too?

40
00:02:02,262 --> 00:02:02,543
Yes!

41
00:02:02,742 --> 00:02:03,602
Exactly that.

42
00:02:04,022 --> 00:02:08,602
They patched a concurrent write race
condition on known marketplaces dot json.

43
00:02:08,682 --> 00:02:12,383
If you had two parallel terminal sessions
running Claude Code at once,

44
00:02:12,442 --> 00:02:16,583
they used to collide when updating that
marketplace file, but now concurrent writes

45
00:02:16,622 --> 00:02:17,583
are safely handled.

46
00:02:17,583 --> 00:02:19,103
Ah, absolute bliss.

47
00:02:19,274 --> 00:02:23,583
Though, look, there is one security caveat
in two point one point two hundred thirty

48
00:02:23,623 --> 00:02:28,223
three that every dev needs to know about,
especially if you pull public repos.

49
00:02:28,399 --> 00:02:32,303
They locked down sandbox dot ripgrep path
overrides.

50
00:02:32,531 --> 00:02:35,772
Wait, why restrict sandbox dot ripgrep
overrides?

51
00:02:35,792 --> 00:02:40,592
Because a malicious workspace repository
could ship a project config file pointing

52
00:02:40,672 --> 00:02:46,112
sandbox dot ripgrep to a fake binary
inside the repo, effectively hijacking your

53
00:02:46,169 --> 00:02:49,232
system search executable the second you
opened the project.

54
00:02:49,432 --> 00:02:54,832
Now, path overrides for ripgrep are
strictly restricted to global user settings and

55
00:02:54,892 --> 00:02:56,512
managed administrator settings.

56
00:02:56,624 --> 00:02:59,312
Workspace level configs cannot touch it.

57
00:02:59,491 --> 00:03:02,311
Wow, that is a subtle attack vector.

58
00:03:03,111 --> 00:03:08,032
So malicious repos can't trick Claude Code
into executing arbitrary binaries during

59
00:03:08,052 --> 00:03:08,771
a ripgrep scan.

60
00:03:08,792 --> 00:03:09,432
Spot on.

61
00:03:09,565 --> 00:03:13,832
If you are building internal plugin
registries, keep your blockedMarketplaces

62
00:03:13,892 --> 00:03:18,792
defined in managed settings, validate your
local SKILL dot md files before pushing,

63
00:03:18,892 --> 00:03:22,232
and let Claude handle the index cache
syncing automatically.

64
00:03:22,312 --> 00:03:25,032
Makes the whole team workflow smooth as
butter.