Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
AuthArea: what it touches
Internal ChangesKind: in v2.1.273,
Internal ChangesSection of the release
Unclear The finding doesn't say what this scope value is used for or why part of the logic is currently disabled.
What
New internal functions compute a hashed 'scope' value that identifies the current login. For logins backed by a stored account (or the CLAUDE_CODE_ACCOUNT_UUID source), the scope combines the organization's UUID with a lowercased, hashed, and truncated account UUID. For logins based on an environment variable or file-descriptor auth source, the scope is a hash of the access token instead. A related companion function currently always returns {scope: null, reason: "not_claude_ai_auth"} because the code path that would compute something else is disabled (guarded by a permanently-false condition).
Why
This groups authentication identities into a consistent hashed form, likely for internal tracking or attribution, though the companion function's dead code means one code path currently never produces a real scope.
