{"version":"2.1.309","anchor":"eval-confined-mode-skips-os-username-lookup","canonical_anchor":"plugin-eval-tool-calls-enforced-against-allowed-tools-a","heading":"Confined plugin-eval mode enforces tool grants and skips host lookups","tier":"notice","area":"Elsewhere","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309\/e\/eval-confined-mode-skips-os-username-lookup","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309","markdown":"### Confined plugin-eval mode enforces tool grants and skips host lookups\n\nWith CLAUDE_CODE_EVAL_CONFINED set, tool calls must match the run's grants, the OS username lookup is skipped and the auto-mode repo-visibility check is off\n\n**What**\n\n`CLAUDE_CODE_EVAL_CONFINED` is an environment variable (a named value set before starting a program) that puts Claude Code into a confined mode for plugin evaluation runs. Setting it now changes three things:\n\n- Tool calls (Claude's requests to run a tool such as a shell command) that were not already denied are checked again as if in a mode that never asks. If the run's grants do not allow the call, it is refused with \"Plugin eval: the run's grants do not allow this call (allowed_tools in the case, --allow-tools on the command line)\". Grants come from `allowed_tools` in the eval case or `--allow-tools` on the command line.\n\n- Claude Code no longer asks the operating system for your user name. It uses `GITHUB_ACTOR`, `USER` or `USERNAME` if set, and otherwise has no name.\n\n- The repository-visibility check used by auto mode returns false straight away, before it reads `CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY` or the stored repoVisibility setting. That override is therefore ignored in confined runs.\n\n**Why**\n\nA confined eval run can only use the tools it was granted, and it reads less about the machine it runs on. If you rely on `CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY` in such runs, it no longer has any effect there.\n\n- Area: Elsewhere\n- Names: `CLAUDE_CODE_EVAL_CONFINED`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}