{"version":"2.1.216","anchor":"auto-mode-setup-now-requires-file-hash-before-applying","canonical_anchor":"auto-mode-setup-now-requires-file-hash-before-applying","heading":"\/auto-mode-setup Now Requires File Hash Before Applying","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216\/e\/auto-mode-setup-now-requires-file-hash-before-applying","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216","markdown":"### `\/auto-mode-setup` Now Requires File Hash Before Applying\n\n**What**\n\nThe `--apply-file` flag now requires a preceding `--expect-sha256 <64-hex>` argument. The apply step is refused unless the proposal file's exact bytes hash to the given SHA-256, preventing a file-swap attack between review and apply.\n\n**Usage**\n\n`# Step 1: generate proposal (unchanged) \/auto-mode-setup --wizard posture=personal scope=all depth=both --propose # Step 2: apply with hash \/auto-mode-setup --expect-sha256 <64-hex> --apply-file \/tmp\/auto-mode-proposal.json` **Details** - `--expect-sha256` must come directly before `--apply-file` and must not use `=` syntax - Optional `--request-id <uuid>` can be placed first; the UUID is echoed back in the JSON result as `requestId`, letting a host correlate replies to requests - `--request-id` must be in canonical 8-4-4-4-12 hex-and-dash UUID format - Passing `--request-id` after `--apply-file` is an error; it must come first - The hash mismatch error is: \"The proposal file's bytes do not match the reviewed digest\" **Evidence** New argument parser (search for `\"--expect-sha256 is required\"` or `\"--request-id must be a UUID\"`)."}