Session-channel messages from unverified senders are dropped, and untrusted settings changes get their plugin key stripped.
What's wrong with this entry?
Certain sensitive messages arriving over the session channel are judged against a device-attestation floor, and a message with no stamp is treated as refused. Below-floor requests are dropped without an answer, below-floor replies are dropped so the original request keeps waiting, and a below-floor settings change has only its forwarded-plugin key removed while the rest applies.
- Guarded message kinds are the tool announcement, hook registration, hook template upload and settings application.
- A below-floor refusal of a call is rebuilt with the target name
unverified-senderand a plain-language reason, so Claude is told the result is unconfirmed rather than being told the call failed. - Whether each family is guarded is decided at runtime by the matching admission checks (
CLAUDE_CODE_DISABLE_HOOK_FORWARDING,CLAUDE_CODE_DISABLE_PLUGIN_FORWARDING, session channel off, hermetic mode); with no judgement available all three are guarded.
reported refused \u2014 ${e} \u2014 by a sender this session could not verify; whether anything ran there is not confirmed. Check its effect before re-running it.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.