Confined plugin-eval mode enforces tool grants and skips host lookups
With CLAUDE_CODE_EVAL_CONFINED set, tool calls must match the run's grants, the OS username lookup is skipped and the auto-mode repo-visibility check is off
Group of 3You'll noticeNo documentation foundImprovements
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
ImprovementsKind: in v2.1.309,
ImprovementsSection of the release
What
CLAUDE_CODE_EVAL_CONFINED is an environment variable (a named value set before starting a program) that puts Claude Code into a confined mode for plugin evaluation runs. Setting it now changes three things:
Tool calls (Claude's requests to run a tool such as a shell command) that were not already denied are checked again as if in a mode that never asks. If the run's grants do not allow the call, it is refused with "Plugin eval: the run's grants do not allow this call (allowed_tools in the case, --allow-tools on the command line)". Grants come from allowed_tools in the eval case or --allow-tools on the command line.
Claude Code no longer asks the operating system for your user name. It uses GITHUB_ACTOR, USER or USERNAME if set, and otherwise has no name.
The repository-visibility check used by auto mode returns false straight away, before it reads CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY or the stored repoVisibility setting. That override is therefore ignored in confined runs.
Why
A confined eval run can only use the tools it was granted, and it reads less about the machine it runs on. If you rely on CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY in such runs, it no longer has any effect there.
