Group of 2 You'll notice
Uploading or publishing an artifact now checks the file's bytes against a previously recorded sha256 hash instead of trusting a fresh read
What
When uploading or publishing artifact files, Claude Code now checks the on-disk bytes against a sha256 hash (publishSourceSha256 / publishFilesSha256) that was recorded earlier when the content was approved, instead of just re-reading the file fresh each time.
- If this hash is already known for the call, the tool skips its usual local validation steps (size limits, empty-file checks, not-a-file checks, etc.) for the
upload_assetaction. - If the file's current content no longer matches the recorded hash, the call now fails with an error explaining that the file couldn't be verified as the one that was originally admitted, instead of silently uploading or publishing the changed bytes.
Why
This prevents a file from being swapped out between the time its content was approved and the time it's actually uploaded or published, so what gets published is guaranteed to be the exact content that was checked.