docs: Claude Code v2.1.273 - Local-directory marketplace plugins load in place, env scrub tightened

[claude-yolo]

Night shift report

WHY THIS MATTERS: Two real behavioral changes land in the plugin and security docs for v2.1.273. Plugin developers using local-directory marketplaces now get live-reload semantics — edits to a relative-path source take effect at the next session start or /reload-plugins without any version bump or cache dance. Separately, CLAUDE_CODE_SUBPROCESS_ENV_SCRUB now also strips Claude Code's own config-dir pointer variables (CLAUDE_CONFIG_DIR etc.) from child processes, closing a gap where a subprocess could locate a relocated config directory and read secrets out of it.

HIGHLIGHTS:

• Local-directory marketplace plugins load in place (plugins-reference.md, plugin-marketplaces.md, plugins.md, claude-directory.md): A relative-path source in a marketplace added from a local directory now loads in place rather than copying to the cache. ${CLAUDE_PLUGIN_ROOT} points at the stable source directory; edits are live on next session start or /reload-plugins; version pinning is bypassed (current files always load regardless of the version field). Node.js deps are not auto-installed — must be installed manually in the source dir or into the persistent data directory.
• CLAUDE_CODE_SUBPROCESS_ENV_SCRUB strips config-dir pointers on v2.1.251+ (env-vars.md): In addition to credential variables, the scrub now removes CLAUDE_CONFIG_DIR and similar pointer variables so child processes can't locate a relocated configuration directory. Users who need subprocesses to read these variables must leave the scrub unset.
• ${CLAUDE_PLUGIN_ROOT} scope clarified (plugins-reference.md): Explicitly documented that this variable (and ${CLAUDE_PLUGIN_ROOT}, ${CLAUDE_PLUGIN_DATA}) are not injected into Bash tool commands run by Claude in the main session or subagents — only into hook processes and MCP/LSP servers. Plugin authors should use the placeholder in plugin content and let Claude Code substitute it, not rely on the env var being present in Bash tool execution.
• hooks.md cross-reference updated: ${CLAUDE_PLUGIN_ROOT} now links to the full env-variable behavior section in plugins-reference rather than the old one-liner about it changing on updates.
• Support articles: ~60 files updated with minor wording/formatting changes; no substantive content.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning