Under the hood
Publishing copied artifact files can now skip the unverified-copy-source approval check under certain conditions
What
When publishing files that were copied from another artifact, Claude Code normally requires prior approval to read the copy source, and otherwise throws a copy_source_unverified error and records a copies_unpinned telemetry event. There is now an additional condition, checked with a permission function called with copySource: true and action ask, that when true skips both the error and the telemetry event.
Why
The finding doesn't say what triggers this bypass condition in practice, so it's unclear when publishing will now proceed without the usual unverified-copy-source check.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
What specifically triggers the bypass condition, and how it differs from the existing approval check, isn't established by the evidence.