Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.238 Home All releases ←olderv2.1.237 v2.1.239newer→
Claude Code v2.1.238

Artifact publish pins the source file by content hash

You'll notice
Useful3 Signal3
Artifacts

Approving an artifact publish pins the exact file contents, so changed files are refused.

What

When you approve an artifact publish, the approval now records the file's SHA-256, the resolved publish root and a one-time nonce. If the file changed, the nonce no longer matches, or the publish root moved between approval and execution, the publish is refused rather than going ahead with different content.

Details
  • The pin also carries the root spelling and base, and publish records which tool call it consumed.
  • Refusals report source_unverified.
  • Telemetry adds artifact_publish_resume with a carried flag.
  • Reachable on any publish that has a tool call id.
Evidence

"source_unverified"

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.238 →