Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.251entry #366

Claude Code v2.1.251 ·

Publish re-verifies a file's identity after opening it

In confined evaluation runs, publishing re-checks a file's identity before reading it.

Under the hood No documentation found Internal Changes
JSON All of v2.1.251
Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
ArtifactsArea: what it touches
Internal ChangesKind: in v2.1.251,
Internal ChangesSection of the release
What

In confined evaluation runs, publishing an artifact from a local file now re-opens the file by descriptor and confirms it is not a symlink, has exactly one hard link, and still has the inode and device seen earlier, before reading any bytes. A mismatch throws source_unverified.

Details
  • Closes the window between checking a file and reading it, where the path could be swapped.
  • Only runs when CLAUDE_CODE_EVAL_CONFINED is set; otherwise the file is read directly as before.
Evidence

a.CLAUDE_CODE_EVAL_CONFINED

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from
Names in the bundleCLAUDE_CODE_EVAL_CONFINED
How sure we are
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this buildNew in this build: CLAUDE_CODE_EVAL_CONFINED

See this entry in the whole of v2.1.251 →

Feedback