Week 19 · May 4–8, 2026
Load plugins from .zip archives and URLs, search command history across every project with Ctrl+R, branch new worktrees from local HEAD or the remote default, and block actions unconditionally with auto mode hard deny rules.
`--plugin-dir` now accepts a .zip plugin archive in addition to a directory, and the new `--plugin-url` flag fetches a plugin archive from a URL for the current session. Useful for trying a plugin before adding it to a marketplace, or for shipping internal plugins from an artifact store.
Load a plugin straight from a URL:
claude --plugin-url https://example.com/my-plugin.zip
<a className="digest-feature-link" href="/docs/en/plugins">Plugins guide
Ctrl+R reverse-search now defaults to all prompts across every project, restoring the behavior from before v2.1.124. Press Ctrl+S while searching to narrow back to the current project or session. Handy when you remember a command you ran in another repo last week and don't want to go digging for it.
<a className="digest-feature-link" href="/docs/en/interactive-mode#command-history">Interactive mode: command history
Other wins
worktree.baseRef setting (fresh | head) controls whether --worktree, the EnterWorktree tool, and agent-isolation worktrees branch from the remote default branch or local HEAD; the default fresh keeps unpushed commits out of new worktreessettings.autoMode.hard\_deny rules block matching actions unconditionally in auto mode, regardless of allow exceptions, for actions that should never run automatically even when broader allow rules apply\$CLAUDE\_EFFORTCLAUDE\_CODE\_DISABLE\_ALTERNATE\_SCREEN=1 opts out of the fullscreen alternate-screen renderer and keeps the conversation in the terminal's native scrollbackCLAUDE\_CODE\_PACKAGE\_MANAGER\_AUTO\_UPDATE lets Homebrew or WinGet installations run the upgrade in the background and prompt to restartCLAUDE\_CODE\_SESSION\_ID is now in the Bash tool subprocess environment, matching the session\_id passed to hooks/mcp now shows the tool count for connected servers and flags servers that connected with 0 tools--channels now works with console (API key) authenticationOTEL\_\* environment variables, so OTEL-instrumented apps run via the Bash tool no longer pick up the CLI's own OTLP endpointcache\_creation token cost by roughly 3xparentSettingsBehavior admin key lets admins opt SDK managedSettings into the policy merge