You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
AuthArea: what it touches
Bug FixesKind: in v2.1.269,
Bug FixesSection of the release
What
When Claude Code tries to send a session event (a record of activity in your session) to the server and gets back an HTTP 403 (permission refused) response, it can now, if a related setting is enabled, work out why: whether the device is unattested (not verified) or the session login has gone stale. In either case, it re-signs the event using a device signer and resends it, logging the message "Refused unsigned by a session bound to this machine; resending signed."
Why
This lets session activity get through even when a device-bound session initially rejects it for lacking a valid signature, instead of the event being silently lost.
