Claude Code 2.1.238: Readline Keybindings and a Token-Minting Hook for Plugins
Claude Code 2.1.238 adds a headersHelper setting that runs a command to mint short-lived auth headers for private plugin marketplace fetches, plus an optional readline-style Ctrl+W keybinding.
What it is
The v2.1.238 release of Claude Code, Anthropic's CLI coding agent, iterating on plugin marketplace auth and terminal editing behavior.
What it does
A url marketplace or catalog entry can now set headersHelper to a command that mints headers, such as a short-lived token, for catalog and same-origin archive fetches; it runs only on install or update and shows the command before asking for confirmation. Separately, a new keybindingFlavor setting lets Ctrl+W delete back to the previous whitespace like Bash, instead of the prior default behavior.
Why it matters
Private or authenticated plugin marketplaces previously had no clean way to gate fetches behind short-lived credentials, so this closes a real gap for teams running internal plugin catalogs, though running an arbitrary command to mint headers on every install is worth reading closely before saying yes at the prompt.
How to use it
Set headersHelper in a marketplace or catalog entry config to point at a script that outputs the needed headers; approve the shown command with `claude plugin install/update -y` or interactively at the `[y/N]` prompt.
Claude Code 2.1.260 Adds a Live Diff Panel and Prompt-Cache Miss Reasons
Claude Code 2.1.260 adds a toggleable diff panel showing uncommitted changes beside the conversation and surfaces the likely cause of prompt-cache misses in /cost and the status line.
/skill-doctor: Claude Code Tells You Which Skills It Never Touched
Claude Code 2.1.261 adds a /skill-doctor command that reports which loaded skills went unused, plus configurable limits for how much Bash and task output Claude sees inline.
Claude Code 2.1.236 Locks Down .env Reads Even If You Rename the File
Claude Code 2.1.236 adds an ANTHROPIC_DEFAULT_MODEL variable that only sets the starting model for new sessions, and closes a macOS sandbox gap where renaming a denied file could bypass wildcard read-deny rules.