Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.251 Home All releases ←olderv2.1.250
Claude Code v2.1.251

Publish re-verifies a file's identity after opening it

Under the hood
Useful1 Signal3
Artifacts not in their notes

In confined evaluation runs, publishing re-checks a file's identity before reading it.

CLAUDE_CODE_EVAL_CONFINED
What

In confined evaluation runs, publishing an artifact from a local file now re-opens the file by descriptor and confirms it is not a symlink, has exactly one hard link, and still has the inode and device seen earlier, before reading any bytes. A mismatch throws source_unverified.

Details
  • Closes the window between checking a file and reading it, where the path could be swapped.
  • Only runs when CLAUDE_CODE_EVAL_CONFINED is set; otherwise the file is read directly as before.
Evidence

a.CLAUDE_CODE_EVAL_CONFINED

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.251 →