New hashing helper computes an auth-identity 'scope' for accounts and tokens
New internal functions compute a hashed 'scope' value that identifies the current login. For logins backed by a stored account (or the CLAUDE_CODE_ACCOUNT_UUID source), the scope combines the organization's UUID with a lowercased, hashed, and truncated account UUID. For logins based on an environment variable or file-descriptor auth source, the scope is a hash of the access token instead. A related companion function currently always returns {scope: null, reason: "not_claude_ai_auth"} because the code path that would compute something else is disabled (guarded by a permanently-false condition).
This groups authentication identities into a consistent hashed form, likely for internal tracking or attribution, though the companion function's dead code means one code path currently never produces a real scope.
The finding doesn't say what this scope value is used for or why part of the logic is currently disabled.