{"version":"2.1.193","anchor":"tengu-cobalt-plinth-putguard-in-development","canonical_anchor":"tengu-cobalt-plinth-putguard-in-development","heading":"tengu_cobalt_plinth_putguard [In Development]","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.193\/e\/tengu-cobalt-plinth-putguard-in-development","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.193","markdown":"### `tengu_cobalt_plinth_putguard` [In Development]\n\n**What**\n\nA dormant security flag that, when enabled, detects proxy interception of GCS artifact uploads by checking for a header that only real GCS responses include.\n\n**Status**\n\nFeature-flagged (off by default)\n\n**Details**\n\n- Export name `isFrameSignedPutHeaderCheckEnabled` reveals the intent.\n- After a successful (2xx) HTTP PUT to Google Cloud Storage, the guard checks for the `x-goog-generation` response header \u2014 present on every authentic GCS response, absent on proxied ones.\n- If the header is missing on a 2xx, the upload is rejected with: `\"upload intercepted: 2xx without x-goog-generation \u2014 a proxy answered in place of GCS\"` (status 403, `intercepted: true`).\n- Scoped to GCS PUT responses only. Anthropic API traffic (`api.anthropic.com`), telemetry, OAuth, and MCP are unaffected \u2014 this does not block proxying of model requests or conversation content.\n- When enabled, would break transparent proxies that cannot forward GCS headers intact: Burp Suite, mitmproxy, corporate SSL inspection, LLM gateways (LiteLLM, Portkey, etc.).\n\n**Evidence**\n\nFlag check `mrl()` in `vKp()` GCS upload handler; export `isFrameSignedPutHeaderCheckEnabled` (search for `\"x-goog-generation\"`)\n\n- Flag `tengu_cobalt_plinth_putguard`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.193; this account: on, anonymous baseline: on, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release."}