{"version":"2.1.224","anchor":"files-received-from-a-peer-session-are-verified-before-use","canonical_anchor":"files-received-from-a-peer-session-are-verified-before-use","heading":"Files received from a peer session are verified before use","tier":"soon","area":"Cross-Session Messaging","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/files-received-from-a-peer-session-are-verified-before-use","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Files received from a peer session are verified before use\n\nFiles another session sends you are size- and hash-checked and confined to a staging folder before use.\n\n**What**\n\nWhen another session sends file attachments, they are now checked before Claude sees them: the attachment list is schema-parsed and capped in count, each path must sit inside the transfer staging directory, must be a regular file, and must match the declared size and hash. Verified files are copied into an uploads directory with owner-only permissions. This runs only with peer messaging enabled.\n\n**Details**\n\n- A file that fails any check is logged with a `[peer-file-transfer]` prefix and surfaces as a notice, rather than being attached silently.\n\n**Evidence**\n\n`transfer path is outside the file-transfer spool`\n\n- Area: Cross-Session Messaging\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}