Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.193 Home All releases ←olderv2.1.191 v2.1.195newer→
Claude Code v2.1.193

tengu_cobalt_plinth_putguard [In Development]

Feature flag
tengu_cobalt_plinth_putguard On for this account, and not off by default

The flag server returned on for the one account this site reads, and nothing in this release compiles it off by default. The compiled default is shown below, and says which it is when we cannot read one: a fifth of gates compile in a string or a number rather than on or off, and most published releases have no gate table behind them at all. No client can see what the server returns for your account.

This account: on · anonymous baseline: on · compiled default in v2.1.193: on

These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.

Read once, for one account on one subscription tier, against v2.1.193. It isn't a statement about your account. What a flag value here can and cannot tell you

What

A dormant security flag that, when enabled, detects proxy interception of GCS artifact uploads by checking for a header that only real GCS responses include.

Status

Feature-flagged (off by default)

Details
  • Export name isFrameSignedPutHeaderCheckEnabled reveals the intent.
  • After a successful (2xx) HTTP PUT to Google Cloud Storage, the guard checks for the x-goog-generation response header — present on every authentic GCS response, absent on proxied ones.
  • If the header is missing on a 2xx, the upload is rejected with: "upload intercepted: 2xx without x-goog-generation — a proxy answered in place of GCS" (status 403, intercepted: true).
  • Scoped to GCS PUT responses only. Anthropic API traffic (api.anthropic.com), telemetry, OAuth, and MCP are unaffected — this does not block proxying of model requests or conversation content.
  • When enabled, would break transparent proxies that cannot forward GCS headers intact: Burp Suite, mitmproxy, corporate SSL inspection, LLM gateways (LiteLLM, Portkey, etc.).
Evidence

Flag check mrl() in vKp() GCS upload handler; export isFrameSignedPutHeaderCheckEnabled (search for "x-goog-generation")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.193 →