Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.234 Home All releases ←olderv2.1.233 v2.1.235newer→
Claude Code v2.1.234

Script detection in published pages handles HTML tokenizer edge cases

Under the hood
Useful2 Signal1
Artifacts

Script-tag scanning in published pages was reworked so hand-crafted markup can't slip past.

What

The scanners that look for script tags in artifact pages, both in-page and in the CLI, were reworked as a matching pair so hand-crafted markup can no longer slip past them.

Details
  • A comment-open followed by a script-open, which would leave the HTML tokenizer in an escaped state, is now refused outright.
  • Tag-end scanning walks attributes, so a > inside a quoted attribute value no longer looks like the end of the tag.
  • Whitespace skipping uses only the five ASCII whitespace bytes HTML defines, instead of JavaScript's broader String.trim().
Evidence

KEEP-IN-SYNC: goCp isFrameAssetInjection

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.234 →