Unclear The finding does not say what the extra upload parameter does.
When Claude Code publishes changes to an artifact as a patch (only the changed parts), it can now send a precondition for each file. A precondition is a check saying "only apply this if the file still looks the way I expect."
If the server refuses with a conflict (HTTP status 409) and the reason precondition_failed, Claude Code now works out which files caused it. For each conflicting path it records:
- the expected sha256, a fingerprint of the file contents Claude Code thought was there
- the actual sha256, the fingerprint of what the server really had
The conflicting paths are also reported in usage data as conflict_paths. Upload calls take one extra parameter as well.
A failed publish can now name the exact files that changed underneath it, instead of failing as a whole with no detail. This makes it easier to see which files someone else edited in the meantime.
The finding does not say what the extra upload parameter does.