You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ArtifactsArea: what it touches
ImprovementsKind: in v2.1.271,
ImprovementsSection of the release
What
When uploading or publishing artifact files, Claude Code now checks the on-disk bytes against a sha256 hash (publishSourceSha256 / publishFilesSha256) that was recorded earlier when the content was approved, instead of just re-reading the file fresh each time.
If this hash is already known for the call, the tool skips its usual local validation steps (size limits, empty-file checks, not-a-file checks, etc.) for the upload_asset action.
If the file's current content no longer matches the recorded hash, the call now fails with an error explaining that the file couldn't be verified as the one that was originally admitted, instead of silently uploading or publishing the changed bytes.
Why
This prevents a file from being swapped out between the time its content was approved and the time it's actually uploaded or published, so what gets published is guaranteed to be the exact content that was checked.
