Claude Code Adds Secure ZIP Plugin Installs

Lachlan Reed

You know that absolute brick wall you hit when you're trying to push custom internal developer tooling into a locked down corporate VPC, or maybe like, an air gapped CI CD runner? Git SSH ports are totally blocked, external NPM registries are blocked, and you're basically stuck holding your breath trying to get a basic script running.

James Turner

Oh yeah, I, I, I've lost entire afternoons to that exact security lockdown. You end up having to request three different firewall exceptions just to fetch a tiny helper package.

Lachlan Reed

Right! Well, the Anthropic team just tackled this in Claude Code version 2.1.224. They added an archive plugin source, which basically means you can now install plugins directly from a zip file over HTTPS without needing git or npm on the machine at all.

James Turner

Wait, seriously? So no git binary, no npm CLI required on the build host? You just drop in a raw ZIP archive link?

Lachlan Reed

Spot on, mate. You just jump into your dot claude slash settings dot json file and set your plugin source to archive. Then you point the URL to something like artifacts dot internal dot net slash plugins slash linter v2.0 dot zip.

James Turner

And what about the security side? If you're pulling arbitrary ZIP archives over the network, how do you make sure nobody tampered with the file on the internal artifact server?

Lachlan Reed

That's the clever bit. They included optional SHA 256 pinning. So right in that same JSON configuration, you can pass a sha256 property with the exact cryptographic hash, like a3f5 and so on. If the downloaded ZIP doesn't match that exact hash, it won't execute. Complete supply chain verification built right in.

James Turner

That is huge for enterprise compliance. But wait, are there any gotchas with how the ZIP file itself has to be structured?

Lachlan Reed

A couple of strict rules, yeah. First off, the ZIP archive has to contain a valid plugin dot json file right at the root or within the top level directory. Also, unencrypted plain HTTP endpoints are rejected by default unless you explicitly override it, and if you download an unpinned ZIP without supplying that SHA 256 hash, Claude Code is gonna throw a prominent security warning at you.

James Turner

Fair enough. Security teams would throw a fit if it just silently downloaded unverified archives over the web.

Lachlan Reed

Exactly right. And, uh, speaking of enterprise stuff, version 2.1.224 and 2.1.225 brought a few other slick quality of life tweaks too. Like, if you're running on AWS Bedrock, there's a new ANTHROPIC BEDROCK REGION PREFIX environment variable so you can handle cross region inference profiles much easier.

James Turner

Oh, nice! And didn't they fix up the gateway spend limit notifications as well?

Lachlan Reed

Yeah, they did! Instead of just a generic warning, the gateway spend limit alerts now show your exact dollar cap and the exact reset time down to the minute. Plus, there's a neat interactive cancel and confirm prompt whenever you paste modified text back into the terminal, so you don't accidentally run runaway commands.

James Turner

Man, not having to install NPM on a barebones container just to run a Claude plugin is going to save so many devops headaches. Good stuff.