v2.1.238

Claude Code 2.1.238 moves plugin marketplace credentials into a command: headersHelper on a url marketplace or on a catalog entry mints the HTTP headers, a short-lived token among them, used for catalog and same-origin archive fetches. The release notes on GitHub list the change alongside two authentication flags for self-hosted runners and a long run of Remote Control fixes.

At a glance

• Long interactive sessions no longer grow unbounded: subagent tool results are released once they leave the recent display window, and custom, project and plugin output styles stop drifting back to the default voice mid-session.
• claude self-hosted-runner gains --defer-shutdown-max-min, which keeps attached sessions served after SIGTERM before parking the rest, and --proxy-authorization-command or --proxy-authorization-file for egress proxies demanding a freshly issued header on every connection.
• Startup improves on macOS, the automatic update check now runs about ten seconds after launch instead of competing for CPU, and held Backspace is no longer ignored on terminals sending Ctrl+H during large keystroke bursts.

The through-line reads as credential hygiene: values that previously sat in a config file or arrived through inherited environment variables are now produced by a command at a defined moment, under a trust check and an explicit confirmation. For teams running Claude Code behind an authenticating egress proxy or on self-hosted runners, that likely trades a long-lived secret on disk for one more executable in the setup, and it puts marketplace authentication on the same footing as MCP server authentication.

A catalog entry's headersHelper runs only at install or update, behind a [y/N] prompt

On a url marketplace or on an individual catalog entry, headersHelper names a command that mints the HTTP headers used for catalog and same-origin archive fetches, a short-lived token among them. A catalog entry's helper runs only when that plugin is installed or updated, after its command is shown; claude plugin install and update ask [y/N], or take -y.

MCP headersHelper in a project .mcp.json, and inline MCP servers in project or --add-dir agent files, now require that folder's trust dialog to have been accepted, including under claude -p. Helpers from a project .mcp.json, a plugin or an agent file run without inherited credential environment variables.

User, managed and claude.ai-scope helpers now run from the Claude config directory. Separately, stdio MCP servers no longer receive a server/discover request before initialize, a sequence that had forced lazy servers to start their backend each time a session was opened.

Self-hosted runners can defer shutdown by a set number of minutes after SIGTERM

claude self-hosted-runner takes a new --defer-shutdown-max-min <minutes> flag that changes the response to SIGTERM: the runner keeps serving attached sessions, parks whatever remains once that many minutes have passed, then exits. Runners are also no longer removed by the server after a single slow or lost poll request, which had handed a healthy session to another runner.

For egress proxies that demand a freshly issued Proxy-Authorization header on every connection, the runner accepts --proxy-authorization-command or --proxy-authorization-file. A proxy's refusal of a connection is now reported by naming the proxy instead of surfacing as a generic network error.

Cross-session messaging also reports failures that used to pass silently: sending to a session on the same machine that refuses inbound messages, for example with crossSessionInbound set to "refuse", now returns "refused" to the sender, and a session whose inbox drops messages on a rate limit or a full queue now says so.

Remote Control tolerates brief HTTP 403 refusals for up to three minutes

Brief HTTP 403 refusals from a network edge, VPN or proxy are tolerated for up to three minutes, and the refusing party is named when a block persists. A short network hiccup that delays renewing a sign-in no longer disconnects the session with "login expired": it retries and stays connected.

Messages sent from the web or Desktop while Claude is mid-turn stay in the transcript after the turn finishes, model picks made on a phone or the web update the model shown in the terminal, and per-task Stop from the tasks panel works on CLI-hosted sessions.

A Remote Control session whose process crashed can now be reused at the next message, instead of staying unavailable until claude remote-control is restarted; sessions started that way no longer inherit session-scoped environment variables from the launching shell. ListAgents and SendMessage reach Remote Control peers in server-mode and Desktop or IDE-hosted sessions, and no longer expose the idle worker pre-warmed for the next background session.

Ctrl+L now only repaints. In fullscreen, Ctrl+L and Cmd+K always repaint the screen: the double-press /clear shortcut is gone, and 1-row nvim terminals no longer trigger automatic /clear loops. claude mcp list and claude mcp get show disabled servers as ⊘ Disabled instead of connecting to them for a health check. keybindingFlavor stays opt-in, with "classic" the unchanged default and "readline" making Ctrl+W delete back to the previous whitespace, as in Bash.