Claude Code 2.1.271 plugin command hashes: approve the command you actually reviewed

Quick answer

Claude Code 2.1.271 adds --accept-command to plugin install and update. First preview with --json, review the displayed command, then rerun the same operation with its shownCommand.sha256. The digest is accepted only for that command, plugin, and marketplace catalog; a change forces a new review. This controls execution approval, not publisher trust or the installed plugin's later behavior.

Who this is for

This guide is for teams that install or update plugins from CI or a non-interactive terminal, especially from private marketplaces.

After installation, use the plugin eval checklist. For MCP servers, hooks, or shell tools, add the credential boundary checklist.

What changed and why now

Anthropic published Claude Code 2.1.271 on September 14, 2026. The release, tagged CLI help, and plugin reference define this boundary:

• --json puts the machine-readable result on the last stdout line.
• A shown but unexecuted marketplace command includes shownCommand.sha256.
• --accept-command applies only to that command, plugin, and catalog.
• Catalog changes invalidate the approval; the flag cannot be combined with -y or used inside a Claude Code session.

Version 2.1.271 is the minimum; record the actual binary when using a newer patch.

The four receipts you need

Receipt	What it proves	What it does not prove
Marketplace receipt	The expected catalog and qualified plugin name were selected	The catalog is trustworthy or unchanged forever
Command receipt	A person reviewed the exact command represented by the digest	The command is safe in every environment
Install receipt	The CLI reported a terminal install or update outcome	The plugin loaded or became active
Runtime receipt	The intended version and components work after reload or restart	Future catalog updates will remain equivalent

A matching digest is only one receipt: a successful command can still target the wrong scope or install a plugin that fails to load.

A fail-closed workflow

1. Pin the operator runtime

Record the Claude Code binary path and version. Confirm the two commands expose the new flag:

claude --version
claude plugin install --help
claude plugin update --help

Pin at least 2.1.271; record any newer resolved version.

2. Qualify the plugin and scope

Use plugin@marketplace, record the target scope, and check configured marketplaces:

claude plugin marketplace list --json

The digest does not bind scope: project scope changes shared settings; user scope affects every project for that user.

3. Preview without broad acceptance

Run the exact intended operation with --json, but without -y or --accept-command:

claude plugin install audit-tools@team-marketplace \
  --scope project --json | tee plugin-install-preview.log

tail -n 1 plugin-install-preview.log | \
  jq '{outcome, failureCode, pluginId, shownCommand}'

Because command text may precede the JSON object, parse only the last line.

4. Review the command as code

Inspect the executable, arguments, hosts, output paths, shell expansion, lifecycle behavior, and credential exposure. Confirm the qualified plugin and marketplace. Protect preview logs that reveal internal paths or endpoints.

Never extract and accept the digest in one unattended pipeline; that recreates -y with extra syntax.

5. Execute with the reviewed digest

After review, copy the digest into the same operation:

claude plugin install audit-tools@team-marketplace \
  --scope project \
  --accept-command '' \
  --json | tee plugin-install-result.log

If shownCommand.acceptCommandMatched is false, stop and review the newly displayed command. Do not fall back to -y.

6. Verify the installed state

Record the result and inspect installed plugins:

tail -n 1 plugin-install-result.log | jq .
claude plugin list --json

Confirm identity, marketplace, scope, version, enabled state, and components. After an update, restart Claude Code and run a harmless canary. Hold if the plugin is absent, disabled, stale, or fails to load.

Seven-case acceptance matrix

Case	Action	Expected result
Exact replay	Use the reviewed digest with the same qualified plugin and catalog	Command may proceed; installation still needs verification
Command changed	Alter one declared command argument upstream	Old digest is refused and the new command is shown
Catalog moved	Refresh the marketplace to a different catalog state	Old approval is not silently reused
Wrong plugin	Supply the digest to another plugin name	Refused
Wrong marketplace	Use the same plugin name from another catalog	Refused
Conflicting acceptance	Combine --accept-command with -y	Usage is rejected
Post-install failure	Simulate a plugin that installs but does not load	Install receipt exists; runtime gate remains failed

Test negative paths with marker-only fixtures in a disposable marketplace, never production credentials.

Copyable approval record

date / reviewer / change ticket:
claude binary / version / sha256:
operation: install | update
plugin id / marketplace / catalog revision:
scope / requested version / current version:
shown command sha256:
reviewed executable / args / hosts / outputs:
credential and side-effect boundary:
accept-command result / failureCode:
installed plugin identity / resolved version / enabled:
reload or restart completed:
harmless runtime canary:
decision: hold | retry-review | limited-rollout | approved

Common mistakes

• Accepting shownCommand.sha256 in the same unattended pipeline.
• Using a bare plugin name or treating -y as equivalent.
• Saving only the digest while discarding the command.
• Calling install success an active plugin without state and runtime checks.

Building something? Turn your product page into a show people want to watch with PromoFast—hosted, embeddable, and ready to export.

FAQ

Is --accept-command a plugin signature?

No. It binds your acceptance to a displayed command plus plugin and marketplace-catalog identity. It does not certify the publisher, plugin contents, dependencies, or later runtime actions.

Why not use -y in CI?

-y skips confirmation. A digest preserves review of one command and rejects a changed command.

Can a script automatically approve the digest?

Mechanically yes, but that defeats the control. Separate preview from execution and retain the command plus digest.

Does the flag work inside a Claude Code conversation?

No. The official reference says it has no effect inside a Claude Code session. Run the plugin command from your own terminal.

Sources

• Claude Code v2.1.271 official release
• Claude Code plugin CLI reference
• Claude Code plugin discovery and marketplace guide
• Official Claude Code 2.1.271 npm package
• Claude Code issue #88210: copied marketplace command report — community demand evidence only

Originally published on IndieSeek.