Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.216 Home All releases ←olderv2.1.215 v2.1.217newer→
Claude Code v2.1.216

/auto-mode-setup Now Requires File Hash Before Applying

What

The --apply-file flag now requires a preceding --expect-sha256 <64-hex> argument. The apply step is refused unless the proposal file's exact bytes hash to the given SHA-256, preventing a file-swap attack between review and apply.

Usage
# Step 1: generate proposal (unchanged)
/auto-mode-setup --wizard posture=personal scope=all depth=both --propose

# Step 2: apply with hash
/auto-mode-setup --expect-sha256 <64-hex> --apply-file /tmp/auto-mode-proposal.json
Details
  • --expect-sha256 must come directly before --apply-file and must not use = syntax
  • Optional --request-id <uuid> can be placed first; the UUID is echoed back in the JSON result as requestId, letting a host correlate replies to requests
  • --request-id must be in canonical 8-4-4-4-12 hex-and-dash UUID format
  • Passing --request-id after --apply-file is an error; it must come first
  • The hash mismatch error is: "The proposal file's bytes do not match the reviewed digest"
Evidence

New argument parser (search for "--expect-sha256 is required" or "--request-id must be a UUID").

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.216 →