CLAUDE_CODE_EVAL_CONFINED
A Claude Code environment variable, read out of the shipped bundle. It has been in the build since v2.1.251, including the newest one read.
In confined evaluation runs, publishing re-checks a file's identity before reading it.
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.251.
In the changelogs
15Releases whose published page names CLAUDE_CODE_EVAL_CONFINED.
-
v2.1.301
Files with extra hard links can now be refused case by case
Claude Code's refusal of files with more than one hard link can now be switched on for a single file access, not only by an environment variable
found in this entry's text, named in this entry
-
v2.1.301
Refusing hard-linked files can now be asked for separately
Claude Code's refusal to read hard-linked files can now be turned on for a single read, not only with
CLAUDE_CODE_EVAL_CONFINEDfound in this entry's text, named in this entry
-
v2.1.300
Files can be attached as mentions without being typed in the prompt
Claude Code can now attach mentioned files from a supplied list of file paths, not only from @-mentions typed in the prompt
found in this entry's text
-
v2.1.295
Refusals to create cloud sessions now come from one combined check
Creating a cloud session is now refused by a single check that gives its own message and reason, replacing two separate checks
found in this entry's text
-
v2.1.288
Plugins lose network access in confined sessions
Plugins are now refused network access when
CLAUDE_CODE_EVAL_CONFINEDis set, and a message says the session's credential is withheldfound in this entry's text, named in this entry
-
v2.1.284
Hooks cannot grant web fetching or searching in Projects sessions
In Projects sessions, a
PermissionRequesthook can no longer approve WebFetch or WebSearch or loosen their rulesfound in this entry's text
-
v2.1.281
Worktree isolation refused in diskless sessions
Agents can no longer use worktree isolation in sessions launched without a disk
found in this entry's text
-
v2.1.268
Strict network allowlist check consolidated and extended with CLAUDE_CODE_EVAL_CONFINED
Network sandbox strict-allowlist check consolidated into one helper, now also considering CLAUDE_CODE_EVAL_CONFINED
found in this entry's text, named in this entry
-
v2.1.257
Confined-evaluation-child mode skips remote settings fetch entirely
As a confined evaluation child, Claude Code skips fetching remote settings and uses a harness-written policy snapshot.
found in this entry's text, named in this entry
-
v2.1.251
Publish re-verifies a file's identity after opening it
In confined evaluation runs, publishing re-checks a file's identity before reading it.
named in this entry, found in this entry's text
-
v2.1.251
Subagent report-file heuristic disabled in confined runs
The subagent report-file guess is switched off entirely in confined evaluation runs.
found in this entry's text
-
v2.1.251
How the evaluation subprocess environment is assembled
The confined-evaluation flag is injected into eval child processes, confirming it's harness plumbing not a setting.
named in this entry, found in this entry's text
-
v2.1.251
A confined evaluation mode, set by Claude Code on itself
A confined evaluation mode exists that Claude Code only sets on its own eval subprocesses.
named in this entry, found in this entry's text
-
v2.1.251
Evaluation runs get narrowed permissions
In confined evaluation runs, allow rules from settings files are ignored; only CLI ones count.
named in this entry, found in this entry's text
-
v2.1.251
What the confined mode changes across cloud, permissions and plugin loading
Confined mode also blocks cloud sessions and changes how MCP servers and hooks load.
named in this entry
First cited
7The earliest release whose published evidence quoted CLAUDE_CODE_EVAL_CONFINED was v2.1.251, 28 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
1 further span in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
1Build by build
49One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the environment variable does. All environment variables.