What probably matters to youSection of the release
What
Before an approved upload is read, the path is re-resolved and opened refusing symlinks, then re-checked against the identity recorded at approval, so a file cannot be substituted after you approve it. Available only where asset actions are enabled by CLAUDE_CODE_ARTIFACT_ASSETS.
Details
The file is re-stated through the open handle and its device, inode, size and nanosecond mtime compared with the approved values, with a further check of the open file's own path entry.
Separate refusals cover network paths, non-regular files, empty files, volumes with no usable inode identity, files reached through a symlink, and files with more than one hard link.
Read permission rules are evaluated on the resolved path, so a symlink cannot be used to send out a file you have denied.
Evidence
upload_asset reads only local files
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
