{"version":"2.1.251","anchor":"a-confined-evaluation-mode-set-by-claude-code-on-itself","canonical_anchor":"a-confined-evaluation-mode-set-by-claude-code-on-itself","heading":"A confined evaluation mode, set by Claude Code on itself","tier":"internal","area":"Plugin Eval","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/a-confined-evaluation-mode-set-by-claude-code-on-itself","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### A confined evaluation mode, set by Claude Code on itself\n\nA confined evaluation mode exists that Claude Code only sets on its own eval subprocesses.\n\n**What**\n\nA new environment variable, `CLAUDE_CODE_EVAL_CONFINED`, appears 26 times in this build and not at all in the previous one. Claude Code sets it to `1` on subprocesses it spawns for evaluation runs rather than reading it from your settings, so every branch it controls is inert in an ordinary session.\n\n**Details**\n\n- Gates git-source teleport refusals, hard-link checks on files, forced permission denials, and network fetch confinement.\n- Added to the three lists of environment variables preserved when spawning privileged worker and background subprocesses.\n- Set alongside `CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR` on the same spawn.\n\n**Evidence**\n\n`CLAUDE_CODE_EVAL_CONFINED`, `v.CLAUDE_CODE_EVAL_CONFINED = \"1\"`\n\n- Area: Plugin Eval\n- Names: `CLAUDE_CODE_EVAL_CONFINED`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 4\/5"}