What
Certain sensitive messages arriving over the session channel are judged against a device-attestation floor, and a message with no stamp is treated as refused. Below-floor requests are dropped without an answer, below-floor replies are dropped so the original request keeps waiting, and a below-floor settings change has only its forwarded-plugin key removed while the rest applies.
Details
- Guarded message kinds are the tool announcement, hook registration, hook template upload and settings application.
- A below-floor refusal of a call is rebuilt with the target name
unverified-senderand a plain-language reason, so Claude is told the result is unconfirmed rather than being told the call failed. - Whether each family is guarded is decided at runtime by the matching admission checks (
CLAUDE_CODE_DISABLE_HOOK_FORWARDING,CLAUDE_CODE_DISABLE_PLUGIN_FORWARDING, session channel off, hermetic mode); with no judgement available all three are guarded.
Evidence
reported refused \u2014 ${e} \u2014 by a sender this session could not verify; whether anything ran there is not confirmed. Check its effect before re-running it.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.