CC 2.1.128/129 Group D — bash mkdir/touch + plugin URL/zip

Three upstream behavior changes (one breaking permission fix, two new commands) documented across configure and setup. Lands first to introduce the parent ## CC 2.1.128 Settings / ## CC 2.1.129 Settings headers — Groups C and E will hang ### subsections under them.

Issues closed 4

Issue	Feature	CC	Category	Skill ref
#1647 + #1666	bash_mkdir_touch_allow_rules_fix dupe pair	2.1.129	breaking	configure
#1649	plugin_url_flag	2.1.129	new_command	configure, setup
#1658	plugin_dir_zip_archive	2.1.128	new_command	configure, setup

What changes

1. `Bash(mkdir )` / `Bash(touch )` — finally honored for in-project paths

BEFORE 2.1.129

// .claude/settings.json
{
  "permissions": {
    "allow": ["Bash(mkdir *)"]
  }
}

// Still prompts on:
mkdir ./src/feature/
mkdir tests/new-suite/

// Workaround: enumerate every path
"Bash(mkdir:./src/*)"
"Bash(mkdir:./tests/*)"
…

AFTER 2.1.129

// .claude/settings.json
{
  "permissions": {
    "allow": ["Bash(mkdir *)"]
  }
}

// Honored as documented.
mkdir ./src/feature/    ✓ no prompt
mkdir tests/new-suite/  ✓ no prompt

// Collapse old workarounds.

2. `--plugin-dir <path-to-zip>` (CC 2.1.128+)

# Load a plugin from a local zip — same flag, now accepts archives
claude --plugin-dir ./vendor/some-plugin.zip

3. `--plugin-url <url>` (CC 2.1.129+) — companion fetch wrapper

# Trial a plugin without committing to a marketplace install
# Session-scoped: discarded when CC exits
claude --plugin-url https://example.com/some-plugin.zip

Files changed doc-only

Path	Change
src/skills/configure/references/cc-version-settings.md	+49 — new `## CC 2.1.128` + `## CC 2.1.129` parent sections
src/skills/configure/SKILL.md	+2 — one-line aside next to existing CC 2.1.111 callout
src/skills/setup/SKILL.md	+15 — bullets for `--plugin-url` and `.zip --plugin-dir` in plugin-seeding section
plugins/ork/…	mirrored by `npm run build`
docs/site/content/docs/reference/skills/{configure,setup}.mdx	regenerated by build

Group plan

✅ A · Foundation — 4 doc additions (PR #1672 merged)
✅ B · MCP hygiene — 5 features + manifest restructure (PR #1674 merged)
D · Config / permission (this PR) — bash allow-rules fix + plugin URL/zip ✅
⏳ C · Security-adjacent — OAuth scope, OTel isolation (depends on D's parent headers)
⏳ E · New surface — channels, gateway opt-in, init plugin_errors (depends on D's parent headers)

Verification

✅ npm run build — plugins/ regenerated, no count drift (107 skills / 37 agents / 188 hooks unchanged)
✅ npm run test:skills
✅ npm run test:agents
✅ npm run test:manifests
✅ npm run test:security — 14/14
✅ npm run typecheck — clean

CC 2.1.128/129 Adoption — Group D: config / permission