ANTHROPIC_UNIX_SOCKET / local tunnel sessions get special-cased auth, policy, and host reporting
Sessions running over a local Unix socket or SSH tunnel now skip normal auth checks, policy-limit disk caching, and report a local host instead of the real API URL
Group of 5You'll noticeNo documentation foundImprovements
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
InternalsArea: what it touches
ImprovementsKind: in v2.1.267,
ImprovementsSection of the release
What
When ANTHROPIC_UNIX_SOCKET is set, authentication checks now short-circuit: a session is considered authed just from CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY being present, skipping the usual base-url/API-key-helper/OAuth-scope checks, and the reported auth type is derived the same simple way instead of probing the keychain or WIF/OAuth state.
Policy-limits configuration can now be loaded lazily after startup if it wasn't already requested at boot, and loading is skipped entirely when there's no reason to fetch it, such as a first-party provider with no ANTHROPIC_UNIX_SOCKET override.
Policy-limits responses are no longer written to or deleted from the on-disk cache under ANTHROPIC_UNIX_SOCKET, and the "would fail closed" 24-hour staleness check no longer applies in this mode.
Status/host reporting now recognizes local SSH-tunnel sessions and reports a local endpoint ("local machine (via claude ssh tunnel)" or a localhost URL) instead of parsing or showing the real API host.
Why
These sessions talk to Anthropic through a local socket or tunnel rather than the normal network path, so the usual credential probing, disk caching, and host-URL reporting don't apply or would be misleading; this makes auth, policy limits, and status reporting behave correctly for that setup.
