Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
CredentialsArea: what it touches
New FeaturesKind: in v2.1.251,
New FeaturesSection of the release
What
The credential payload used to start a session is now validated more strictly. It follows a bounded chain of nested credential sources and refuses X.509 certificate and executable-backed sources outright, with named failure reasons instead of generic errors. Always on.
Details
Named verdicts: secret_did_not_decode, unsupported_version, missing_session_ingress_token, missing_api_base_url.
Failures now carry a dedicated shape-error type rather than an untyped throw.
Evidence
an X.509 certificate credential source cannot be excluded from the shell
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
