← 2.1.2 Primitive inconclusive · runtime-test

FORCE_AUTOUPDATE_PLUGINS

Organizations/admins who:

FORCE_AUTOUPDATE_PLUGINS is an environment variable that allows plugin autoupdate to proceed independently of the Claude Code core auto-updater.

Overview

Claude Code 2.1.2 decouples plugin updates from core updates via FORCE_AUTOUPDATE_PLUGINS. When the main auto-updater is disabled (for stability or version-pinning), setting this flag enables plugins to refresh independently, allowing organizations to hold core versions steady while accepting security and feature patches at the plugin layer.

How It Works

Set the environment variable or config flag before launching Claude:

export FORCE_AUTOUPDATE_PLUGINS=1
claude

Or in managed settings:

{
  "autoUpdater": false,
  "FORCE_AUTOUPDATE_PLUGINS": true
}

When enabled, the plugin update routine runs even if the core updater is disabled, decoupling the two lifecycle channels.

Testing Status and Caveats

This feature was not runtime-tested. Testing is listed as "CODE REVIEW ONLY" (2026-01-16). A full verification would require disabling the main auto-updater, staging a plugin with available updates, and confirming plugin updates proceed while core remains pinned—a test not yet executed.

The intended audience is enterprise admins managing Claude Code deployments, CI/CD environments with pinned core versions, and security-conscious setups prioritizing plugin patches. The feature itself remains documented but unproven in runtime conditions.

Context

Part of the Claude Code 2.1.2 runtime-configurability push. Signals intent to give admins fine-grained control over update channels, but epistemic status is code-review confidence only.

Evidence & receipt
  • file2.1.2/tests/03-force-autoupdate-plugins/TEST-RESULTS.md
◇ ed25519 receipt
idprimitive_6b5b40e5fa7821bc6a5312a4
alged25519
pubkey9b87705613b1e2fd064d57fa75a6b679d2856ceafad6b1daa8f982493871b6dd
sigf228dce982d6da481d140bc690bc2b977caba0474dec6d2ee56d5ea7ac5d6576f7beb3627f3f62f3d88bdf94d1dc23864fb992f3454344586df6d321ddadf206

Signed with an ed25519 key held off the repo. Anyone can verify against the published public key; nobody without the secret key can forge it. Click verify: it recomputes the signature in your browser. The signature proves integrity and authorship of this exact content — not a third-party timestamp or that the underlying claim is objectively true. signedAt is when the @f3/attest pipeline ran, not when the work happened; the evidence refs carry the source dates.

Connected