{"name":"CLAUDE_CODE_EVAL_CONFINED","slug":"claude-code-eval-confined","family":"env","title":"Environment variables","noun":"environment variable","description":"In confined evaluation runs, publishing re-checks a file's identity before reading it.","description_source":"entry","described_by":{"version":"2.1.251","anchor":"publish-re-verifies-a-file-s-identity-after-opening-it"},"presence":{"first_seen":"2.1.251","removed_in":null,"in_current_build":true,"newest_mined":"2.1.309","builds":50,"mined_builds":150,"first_cited":{"version":"2.1.251","released_at":"2026-08-28 15:34:26","spans":9}},"aliases":[],"entries":[{"version":"2.1.309","anchor":"plugin-eval-tool-calls-enforced-against-allowed-tools-a","heading":"Plugin evaluation runs block tool calls outside their granted tools","line":"In confined plugin evaluation mode, a tool call not covered by `allowed_tools` or `--allow-tools` is now refused","released_at":"2026-10-22 20:34:13","reason":"named in this entry, found in this entry's text"},{"version":"2.1.309","anchor":"eval-confined-mode-skips-os-username-lookup","heading":"CLAUDE_CODE_EVAL_CONFINED stops Claude Code looking up your system username","line":"With CLAUDE_CODE_EVAL_CONFINED set, Claude Code takes your name from GITHUB_ACTOR, USER or USERNAME instead of asking the system","released_at":"2026-10-22 20:34:13","reason":"named in this entry, found in this entry's text"},{"version":"2.1.309","anchor":"auto-mode-repo-visibility-check-is-forced-off-when-claude-co","heading":"CLAUDE_CODE_EVAL_CONFINED now overrides auto mode's repository visibility","line":"With `CLAUDE_CODE_EVAL_CONFINED` set, auto mode always treats repository visibility as off and ignores `CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY`","released_at":"2026-10-22 20:34:13","reason":"named in this entry, found in this entry's text"},{"version":"2.1.301","anchor":"eval-confinement-hard-link-check-can-be-triggered-by-an-opti","heading":"Files with extra hard links can now be refused case by case","line":"Claude Code's refusal of files with more than one hard link can now be switched on for a single file access, not only by an environment variable","released_at":"2026-10-15 14:34:23","reason":"found in this entry's text, named in this entry"},{"version":"2.1.301","anchor":"file-readers-hard-link-refusal-can-be-switched-on-per-call","heading":"Refusing hard-linked files can now be asked for separately","line":"Claude Code's refusal to read hard-linked files can now be turned on for a single read, not only with `CLAUDE_CODE_EVAL_CONFINED`","released_at":"2026-10-15 14:34:23","reason":"found in this entry's text, named in this entry"},{"version":"2.1.300","anchor":"attachments-file-mentions-can-come-from-own-file-paths","heading":"Files can be attached as mentions without being typed in the prompt","line":"Claude Code can now attach mentioned files from a supplied list of file paths, not only from @-mentions typed in the prompt","released_at":"2026-10-14 14:27:26","reason":"found in this entry's text"},{"version":"2.1.295","anchor":"cloud-session-creation-checks-consolidated-into-one-restrict","heading":"Refusals to create cloud sessions now come from one combined check","line":"Creating a cloud session is now refused by a single check that gives its own message and reason, replacing two separate checks","released_at":"2026-10-08 18:22:58","reason":"found in this entry's text"},{"version":"2.1.288","anchor":"plugin-network-gating-now-also-covers-claude-code-eval-confi","heading":"Plugins lose network access in confined sessions","line":"Plugins are now refused network access when `CLAUDE_CODE_EVAL_CONFINED` is set, and a message says the session's credential is withheld","released_at":"2026-10-02 18:30:40","reason":"found in this entry's text, named in this entry"},{"version":"2.1.284","anchor":"in-projects-sessions-hooks-cannot-approve-webfetchwebsearc","heading":"Hooks cannot grant web fetching or searching in Projects sessions","line":"In Projects sessions, a `PermissionRequest` hook can no longer approve WebFetch or WebSearch or loosen their rules","released_at":"2026-09-28 17:11:59","reason":"found in this entry's text"},{"version":"2.1.281","anchor":"worktree-isolation-refused-in-diskless-sessions","heading":"Worktree isolation refused in diskless sessions","line":"Agents can no longer use worktree isolation in sessions launched without a disk","released_at":"2026-09-23 17:01:17","reason":"found in this entry's text"}],"entries_total":18,"docs":[],"docs_total":0,"gates":[],"related":[{"name":"CLAUDE_CODE_EVAL_","slug":"claude-code-eval","description":"An env var turns on the tool that proposes new skills; otherwise it stays off in this build."},{"name":"CLAUDE_CODE_EVAL_ALLOW_ARTIFACT_PUBLISH","slug":"claude-code-eval-allow-artifact-publish","description":"Eval suites can only publish artifacts or override feature flags if you explicitly allow it."},{"name":"CLAUDE_CODE_EVAL_ALLOW_FLAG_OVERRIDES","slug":"claude-code-eval-allow-flag-overrides","description":"Eval suites can only publish artifacts or override feature flags if you explicitly allow it."},{"name":"CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR","slug":"claude-code-eval-artifact-stub-dir","description":"Point artifact publishing at a local directory and it writes files there instead of calling the service."},{"name":"CLAUDE_CODE_EVAL_INTERVIEW_SESSION","slug":"claude-code-eval-interview-session","description":"An env var turns on the tool that proposes new skills; otherwise it stays off in this build."}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/claude-code-eval-confined","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}