Claude Code 2.1.265 loads a whole folder of plugins

As of Claude Code 2.1.265, the --plugin-dir flag can point at a folder that holds several plugins. Every child folder with a manifest loads, and child folders added or removed while the session runs are picked up without a restart. That is the headline item in the release notes Anthropic published on GitHub on September 8.

The release also fixes two prompt-cache bugs in subagents and caps tool results saved to disk at 1 GB. It closes a hole in how plugin paths are checked, and it moves gateway telemetry closer to what terminal sessions already send.

The live pickup goes against how plugins normally load. The Claude Code docs describe three stages: a plugin is declared in settings, fetched to disk under ~/.claude/plugins/, and then loaded into the running session. That last step happens at session start, from installed_plugins.json and the cache, with no network access. Anything that changes on disk later stays invisible until you run /reload-plugins or open a new session. A folder passed to --plugin-dir now skips that step for its children: drop a plugin folder in and it loads, delete one and it goes. The likeliest beneficiaries are people developing several plugins side by side, who until now had to name each directory on the command line.

Three other plugin fixes deal with the edges of that folder. On macOS and Linux, a plugin path containing a backslash could get past the symlink containment check, the check that keeps a plugin from reaching outside its root. Plugin directories whose names begin with two dots were wrongly refused as being outside the plugin root. And a default component folder the OS cannot check, such as a symlink loop, used to be skipped silently; it now shows up in /plugin with an error code. The containment fix matters more because of where plugins come from: Tech Times cited January 2026 research by SentinelOne on malicious marketplace plugins that redirected dependency installs. On the display side, the Installed tab and claude plugin details now prefer the marketplace entry’s metadata over plugin.json and fill any gaps from the latter.

The cache fixes concern the prefix that prompt caching reuses from one turn to the next. Resuming a subagent spawned in the foreground changed its tool list and system prompt prefix. Agent teammates and resumed subagents moved SubagentStart hook context and preloaded skills out of the prompt prefix on later turns. Neither bug changed what the agent did. Both quietly made each later turn pay again for a prefix it had already sent. Changed tool definitions were already on the list of cache-miss causes that the status line started naming in early September. The advisor tool got a related change: whether it is used, and its instructions, are no longer decided again on each request based on that request’s model. The decision is made once, and the conversation announces it when it changes.

The 1 GB cap applies to tool results Claude Code writes to disk, and the in-conversation preview says when a saved file was truncated. Resume also behaves better when the previous process died mid-tool: the last prompt is no longer rewritten, and the interrupted tool call is kept and marked as interrupted. A resumed workflow whose run journal is missing after a container restart now fails with a clear error. Before, it reran every agent.

Other changes that affect daily work:

• MCP servers configured as http that only speak the legacy HTTP+SSE transport now connect: Claude Code falls back to SSE, as the MCP spec describes.
• In non-interactive sessions (-p with stream-json input, the Agent SDK, cloud sessions), a cd now persists across turns.
• Two-key shortcuts used to cancel silently inside tmux. They now wait 3 seconds and show a notice when they time out.
• --worktree checks out the new worktree in parallel on large repositories (git 2.32+).
• When Claude reads an artifact someone else wrote, the Artifact tool treats the page as untrusted content and flags embedded instructions instead of relaying them.
• In VS Code, the new “Archive inactive sessions” setting archives idle sessions, after 14 days by default.

For Claude apps gateway deployments, Claude Desktop and Cowork now send user.email and user.groups in their telemetry, as terminal sessions already did. When the gateway’s managed settings name a collector in OTEL_EXPORTER_OTLP_ENDPOINT, sessions export OpenTelemetry straight to it. Sessions without one still go through the relay, which no longer pauses all forwarding for 30 seconds after the collector rejects a few payloads. Machines with forceLoginGatewayUrl in managed settings start as gateway sessions, like forceLoginMethod: "gateway", and a leftover claude.ai login or API key on the machine is not used.