# CC 2.1.128/129 Adoption — Group D: config / permission

Three upstream behavior changes (one breaking permission fix, two new commands) documented across `configure` and `setup`. Lands first to introduce the parent `## CC 2.1.128 Settings` / `## CC 2.1.129 Settings` headers — Groups C and E will hang `### subsections` under them.

## Issues closed 4

Issue | Feature | CC | Category | Skill ref
--- | --- | --- | --- | ---
#1647 + #1666 | bash_mkdir_touch_allow_rules_fix dupe pair | 2.1.129 | breaking | configure
#1649 | plugin_url_flag | 2.1.129 | new_command | configure, setup
#1658 | plugin_dir_zip_archive | 2.1.128 | new_command | configure, setup

## What changes

### 1. `Bash(mkdir *)` / `Bash(touch *)` — finally honored for in-project paths

### BEFORE 2.1.129

    // .claude/settings.json
    {
      "permissions": {
        "allow": ["Bash(mkdir *)"]
      }
    }

    // Still prompts on:
    mkdir ./src/feature/
    mkdir tests/new-suite/

    // Workaround: enumerate every path
    "Bash(mkdir:./src/*)"
    "Bash(mkdir:./tests/*)"
    …

### AFTER 2.1.129

    // .claude/settings.json
    {
      "permissions": {
        "allow": ["Bash(mkdir *)"]
      }
    }

    // Honored as documented.
    mkdir ./src/feature/    ✓ no prompt
    mkdir tests/new-suite/  ✓ no prompt

    // Collapse old workarounds.

### 2. `--plugin-dir <path-to-zip>` (CC 2.1.128+)

    # Load a plugin from a local zip — same flag, now accepts archives
    claude --plugin-dir ./vendor/some-plugin.zip

### 3. `--plugin-url <url>` (CC 2.1.129+) — companion fetch wrapper

    # Trial a plugin without committing to a marketplace install
    # Session-scoped: discarded when CC exits
    claude --plugin-url https://example.com/some-plugin.zip

## Files changed doc-only

Path | Change
--- | ---
src/skills/configure/references/cc-version-settings.md | +49 — new `## CC 2.1.128` + `## CC 2.1.129` parent sections
src/skills/configure/SKILL.md | +2 — one-line aside next to existing CC 2.1.111 callout
src/skills/setup/SKILL.md | +15 — bullets for `--plugin-url` and `.zip --plugin-dir` in plugin-seeding section
plugins/ork/… | mirrored by `npm run build`
docs/site/content/docs/reference/skills/{configure,setup}.mdx | regenerated by build

## Group plan

- ✅ A · Foundation — 4 doc additions (PR #1672 merged)
- ✅ B · MCP hygiene — 5 features + manifest restructure (PR #1674 merged)
- D · Config / permission (this PR) — bash allow-rules fix + plugin URL/zip ✅
- ⏳ C · Security-adjacent — OAuth scope, OTel isolation (depends on D's parent headers)
- ⏳ E · New surface — channels, gateway opt-in, init plugin_errors (depends on D's parent headers)

## Verification

- ✅ `npm run build` — plugins/ regenerated, no count drift (107 skills / 37 agents / 188 hooks unchanged)
- ✅ `npm run test:skills`
- ✅ `npm run test:agents`
- ✅ `npm run test:manifests`
- ✅ `npm run test:security` — 14/14
- ✅ `npm run typecheck` — clean