build(deps-dev): bump @anthropic-ai/claude-code from 2.1.259 to 2.1.267

[dependabot]

Bumps @anthropic-ai/claude-code from 2.1.259 to 2.1.267.

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.267

What's changed

• Added maxEffortLevel setting (top-level or per model under modelSettings): caps the effort level on every provider, including Bedrock, Vertex and Foundry; users can still pick a lower level
• Added --system-prompt-snapshot off to render the system prompt fresh on every request instead of reusing the conversation's recorded prompt (for iterating on prompt text)
• Fixed Cowork scheduled tasks in the cloud failing at startup for organizations whose managed settings require sandboxing
• Fixed /context and other local command output rendering blank on mobile clients
• Fixed shift+enter and option+backspace not working after reconnecting to a tmux or ssh session inside an agent view
• Fixed the dim last-prompt header not appearing at the top of the conversation when scrolling up in fullscreen mode
• Fixed Workflow agent() calls with large output schemas being refused in auto mode instead of being checked by the safety classifier
• Fixed a case where a marketplace entry path containing a backslash could bypass the containment check for fetched marketplaces on macOS and Linux
• Fixed expired AWS or Google Cloud credentials under a host app such as Claude Desktop retrying ten times with a generic "request failed" before the re-authenticate error appeared
• Fixed resuming a session after /compact or another slash command ran via -p --resume: a spurious "Continue from where you left off." turn is no longer inserted
• Fixed resuming a large session (transcript over 5 MB): parallel tool calls and their hook output are no longer dropped from the reloaded conversation
• Fixed managed allowedHttpHookUrls, httpHookAllowedEnvVars and allowedChannelPlugins to admit nothing, not everything, when unreadable
• Fixed /login on machines whose managed settings require Claude apps gateway sign-in: Esc now closes the dialog instead of doing nothing
• Fixed artifact publishes cut off by a dropped connection mid-upload: they now retry once when Claude Code can tell the upload never completed, instead of reporting an unknown outcome
• Fixed effort: frontmatter on custom commands, skills, and subagents being ignored on models whose default effort is still pinned (Opus 4.7, Opus 4.8, Fable 5)
• Fixed artifact publish failing with an unhelpful error when the page file isn't valid UTF-8 or contains a replacement character (U+FFFD); the error now names the line and column to fix
• Fixed claude agents @ directory menu not listing repositories created after the session started
• Fixed Remote Control clients that join a Claude Desktop or VS Code session showing a stale permission mode until it was changed again
• Fixed claude remote-control exiting and dropping every attached session when its server credential expires (about 30 days after start); the host now re-registers and keeps going
• Fixed the usage-limit warning flickering on and off during a session when requests for different models or modes report different limit windows
• Fixed earlier reasoning being dropped when an MCP server re-sends, or a built-in tool re-renders, a tool the model already loaded
• Fixed a tool that disappears mid-conversation, from a disconnected MCP server or an upgrade, rewriting the tool list and discarding earlier thinking
• Fixed a background worker forked from a conversation adding EnterWorktree to the conversation's tool block mid-session, which broke prompt-cache reuse
• Fixed mid-session MCP and plugin tools being added to the tool list in sessions without ToolSearch, which broke prompt-cache reuse; supported models now receive them as deferred definitions
• Fixed switching models with /model re-sending every tool definition (a prompt-cache miss); commit and PR attribution text now arrives as a conversation note that updates on model changes
• Fixed resumed sessions rewriting the inline tool set when an MCP connector reconnects at a different moment than before
• Fixed resumed sessions re-rendering tool descriptions instead of replaying the recorded ones when the first turn ran a tool
• Fixed prompt-cache misses and dropped extended thinking when a claude.ai connector's tools change between a session and its resume
• Fixed resumed sessions rewriting earlier MCP tool announcements (and dropping extended thinking) before their connectors reconnect
• Fixed a prompt-cache break when a print-mode (-p) conversation is resumed interactively: the system prompt prefix no longer changes
• Improved the /diff panel: it no longer flashes "0 files changed" and a spinner before settling, and its empty state is centered in the panel
• Improved the Bash tool's description guidance so Claude describes what a command does in plain words instead of echoing the command
• Improved sandbox guidance so Claude suggests /copy when clipboard commands such as pbcopy fail inside the sandbox
• Improved --resume first-render time for sessions with many Bash tool calls
• Improved prompt input responsiveness: keystrokes no longer occasionally wait a frame behind spinner or streaming repaints
• Improved prompt-cache stability: subagents and sessions started with --system-prompt or --append-system-prompt now record the system prompt and tool definitions once instead of re-rendering them
• Improved Artifact tool publish errors: when a publish is refused, the message now says why and what to do about it
• Self-hosted runner: Changed --use-anthropic-git-proxy to be reported to the server at registration and to print a warning for each session that still clones through the legacy git proxy
• Gateway: Changed forward_user_identity upstreams to return a 429 as-is to a developer whose email was forwarded, instead of failing over to the next upstream, so the proxy's per-user limits hold
• [VSCode] Fixed the extension host hanging at 100% CPU when forking, editing an earlier message, or rewinding in a conversation whose saved transcript contains a cyclic parent link
• [VSCode] Fixed pasting a screenshot on WSL2/WSLg inserting raw image bytes into the chat input; the image is now attached when the clipboard provides it, otherwise the paste is ignored
• [VSCode] Fixed chat diff blocks always rendering with a dark editor theme; they now follow the active VS Code color theme, including high contrast
• [VSCode] Fixed mixed right-to-left and English text rendering in the wrong order while typing in the message input
• [VSCode] Fixed accepting an edit in the diff view on a file with Windows (CRLF) line endings failing with "String not found in file"
• [VSCode] Fixed @-mentions dropping files whose paths contain spaces
• [VSCode] Fixed the sessions list view failing to load in windows connected over Remote-SSH when the workspace folder exists only on the remote host
• [VSCode] Fixed runaway ripgrep processes when viewing files in large or symlink-heavy workspaces

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.267

• Added maxEffortLevel setting (top-level or per model under modelSettings): caps the effort level on every provider, including Bedrock, Vertex and Foundry; users can still pick a lower level
• Added --system-prompt-snapshot off to render the system prompt fresh on every request instead of reusing the conversation's recorded prompt (for iterating on prompt text)
• Fixed Cowork scheduled tasks in the cloud failing at startup for organizations whose managed settings require sandboxing
• Fixed /context and other local command output rendering blank on mobile clients
• Fixed shift+enter and option+backspace not working after reconnecting to a tmux or ssh session inside an agent view
• Fixed the dim last-prompt header not appearing at the top of the conversation when scrolling up in fullscreen mode
• Fixed Workflow agent() calls with large output schemas being refused in auto mode instead of being checked by the safety classifier
• Fixed a case where a marketplace entry path containing a backslash could bypass the containment check for fetched marketplaces on macOS and Linux
• Fixed expired AWS or Google Cloud credentials under a host app such as Claude Desktop retrying ten times with a generic "request failed" before the re-authenticate error appeared
• Fixed resuming a session after /compact or another slash command ran via -p --resume: a spurious "Continue from where you left off." turn is no longer inserted
• Fixed resuming a large session (transcript over 5 MB): parallel tool calls and their hook output are no longer dropped from the reloaded conversation
• Fixed managed allowedHttpHookUrls, httpHookAllowedEnvVars and allowedChannelPlugins to admit nothing, not everything, when unreadable
• Fixed /login on machines whose managed settings require Claude apps gateway sign-in: Esc now closes the dialog instead of doing nothing
• Fixed artifact publishes cut off by a dropped connection mid-upload: they now retry once when Claude Code can tell the upload never completed, instead of reporting an unknown outcome
• Fixed effort: frontmatter on custom commands, skills, and subagents being ignored on models whose default effort is still pinned (Opus 4.7, Opus 4.8, Fable 5)
• Fixed artifact publish failing with an unhelpful error when the page file isn't valid UTF-8 or contains a replacement character (U+FFFD); the error now names the line and column to fix
• Fixed claude agents @ directory menu not listing repositories created after the session started
• Fixed Remote Control clients that join a Claude Desktop or VS Code session showing a stale permission mode until it was changed again
• Fixed claude remote-control exiting and dropping every attached session when its server credential expires (about 30 days after start); the host now re-registers and keeps going
• Fixed the usage-limit warning flickering on and off during a session when requests for different models or modes report different limit windows
• Fixed earlier reasoning being dropped when an MCP server re-sends, or a built-in tool re-renders, a tool the model already loaded
• Fixed a tool that disappears mid-conversation, from a disconnected MCP server or an upgrade, rewriting the tool list and discarding earlier thinking
• Fixed a background worker forked from a conversation adding EnterWorktree to the conversation's tool block mid-session, which broke prompt-cache reuse
• Fixed mid-session MCP and plugin tools being added to the tool list in sessions without ToolSearch, which broke prompt-cache reuse; supported models now receive them as deferred definitions
• Fixed switching models with /model re-sending every tool definition (a prompt-cache miss); commit and PR attribution text now arrives as a conversation note that updates on model changes
• Fixed resumed sessions rewriting the inline tool set when an MCP connector reconnects at a different moment than before
• Fixed resumed sessions re-rendering tool descriptions instead of replaying the recorded ones when the first turn ran a tool
• Fixed prompt-cache misses and dropped extended thinking when a claude.ai connector's tools change between a session and its resume
• Fixed resumed sessions rewriting earlier MCP tool announcements (and dropping extended thinking) before their connectors reconnect
• Fixed a prompt-cache break when a print-mode (-p) conversation is resumed interactively: the system prompt prefix no longer changes
• Improved the /diff panel: it no longer flashes "0 files changed" and a spinner before settling, and its empty state is centered in the panel
• Improved the Bash tool's description guidance so Claude describes what a command does in plain words instead of echoing the command
• Improved sandbox guidance so Claude suggests /copy when clipboard commands such as pbcopy fail inside the sandbox
• Improved --resume first-render time for sessions with many Bash tool calls
• Improved prompt input responsiveness: keystrokes no longer occasionally wait a frame behind spinner or streaming repaints
• Improved prompt-cache stability: subagents and sessions started with --system-prompt or --append-system-prompt now record the system prompt and tool definitions once instead of re-rendering them
• Improved Artifact tool publish errors: when a publish is refused, the message now says why and what to do about it
• Self-hosted runner: Changed --use-anthropic-git-proxy to be reported to the server at registration and to print a warning for each session that still clones through the legacy git proxy
• Gateway: Changed forward_user_identity upstreams to return a 429 as-is to a developer whose email was forwarded, instead of failing over to the next upstream, so the proxy's per-user limits hold
• [VSCode] Fixed the extension host hanging at 100% CPU when forking, editing an earlier message, or rewinding in a conversation whose saved transcript contains a cyclic parent link
• [VSCode] Fixed pasting a screenshot on WSL2/WSLg inserting raw image bytes into the chat input; the image is now attached when the clipboard provides it, otherwise the paste is ignored
• [VSCode] Fixed chat diff blocks always rendering with a dark editor theme; they now follow the active VS Code color theme, including high contrast
• [VSCode] Fixed mixed right-to-left and English text rendering in the wrong order while typing in the message input
• [VSCode] Fixed accepting an edit in the diff view on a file with Windows (CRLF) line endings failing with "String not found in file"
• [VSCode] Fixed @-mentions dropping files whose paths contain spaces
• [VSCode] Fixed the sessions list view failing to load in windows connected over Remote-SSH when the workspace folder exists only on the remote host
• [VSCode] Fixed runaway ripgrep processes when viewing files in large or symlink-heavy workspaces
• [Claude Code on the web] Fixed GitHub Enterprise Server sessions showing your GitHub account as disconnected once its token expired; PR and issue operations now refresh it automatically

... (truncated)

Commits

• 9cdc2a4 chore: Update CHANGELOG.md and feed.xml
• 347b38e chore: Update CHANGELOG.md and feed.xml
• 8e02f6d chore: Update CHANGELOG.md and feed.xml
• ab9b2cf chore: Update CHANGELOG.md and feed.xml
• d7dbd9a chore: Update CHANGELOG.md and feed.xml
• b3f0e50 chore: Update CHANGELOG.md and feed.xml
• ee2a058 Merge pull request #91894 from williamqian12/frontend-design-skill-update
• dbdd79c Update /frontend-design SKILL.md
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Straightforward dependency bump (@anthropic-ai/claude-code 2.1.259 → 2.1.267), correctly typed build(deps-dev): for a patch-level release. package-lock.json is fully and consistently updated across the root entry and all 8 platform-specific optional-dependency entries — no stray 2.1.259 references left anywhere in the lockfile.

One finding to fix before merge: package.json's allowScripts entry (line 43) is still pinned to the old version string "@anthropic-ai/claude-code@2.1.259", so this bump silently orphans the lifecycle-script approval that npm 12's install gate requires — see the inline comment for why that specifically matters in this repo.

Nothing else to flag: no other open PR touches this dependency, the PR title/description are Dependabot's own accurate standard template, and this is a first review of this PR so there are no prior threads or verdicts to reconcile.

[github-actions]

This run's head commit (0271908) is identical to the one already reviewed by this bot (review submitted 2026-09-17T15:01:57Z, state CHANGES_REQUESTED) — no new commit has landed since, so this is not treated as a fresh review and no new inline comments are being added to avoid duplicating that one.

I re-verified the prior review's single finding rather than assuming it still holds:

[policy] Should fix — package.json's allowScripts entry is stale for this bump. Line 20 correctly bumps the @anthropic-ai/claude-code devDependency to 2.1.267, but the allowScripts map (line ~43) still reads "@anthropic-ai/claude-code@2.1.259": true and was not updated alongside it.

I confirmed this is a real, load-bearing project mechanism rather than a hallucinated or inert field: @lavamoat/allow-scripts is not installed in this lockfile, but commit 2d35b3f ("build(deps): adopt @exadev/eslint-config and bump to npm 12.0.2") introduced both the npm@12.0.2 packageManager pin and this allowScripts map in the same change, with a commit message stating explicitly that npm 12's own lifecycle-script gate blocks unapproved postinstall scripts by default, and that the entry exists specifically so @anthropic-ai/claude-code's postinstall script keeps running. The gate is keyed by exact name@version, so leaving the old version pinned here means the approval will not match once this bump lands, and .github/workflows/dependabot.yml's own "Investigate and adapt" job invokes this exact CLI via npx claude after npm ci — the job that reviews bumps like this one depends on the script this stale entry would leave unapproved.

Net: the prior CHANGES_REQUESTED review remains accurate and is the operative one for this commit — package.json line ~43 needs "@anthropic-ai/claude-code@2.1.267": true before this merges. No new findings from this pass. PR title/description (Dependabot's standard template) remain accurate and need no change.

[github-actions]

🗜️ Headroom context compression

Metric	Value
Requests proxied	50
Tokens saved	251044
Aggregate savings	4.1% of all tokens sent
Average per-request compression	5.4%