build(deps-dev): bump @anthropic-ai/claude-code from 2.1.259 to 2.1.268

[dependabot]

Bumps @anthropic-ai/claude-code from 2.1.259 to 2.1.268.

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.268

What's changed

• Added to the Claude apps gateway: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter
• Added a startup warning for gateways when access_control.allow_cidrs is empty, and a one-time warning the first time a request arrives from a public address
• Added the gatewayInternalNetworks managed setting, letting administrators allow /login to a Claude apps gateway on their organization's own public IPv4 block
• Added claude self-hosted-runner --remove-session-state (default off): delete each session's per-session directories under <base-dir>/_sessions/ when the session ends
• Added configDirectory to the output of claude auth status --json
• Added --json to claude plugin install, uninstall, update, enable and disable, and errorDetails/noteDetails to each row of claude plugin list --json
• Added browser-tab icons for published artifacts, chosen by Claude to match each page
• Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject
• Fixed WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off)
• Fixed a respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted
• Fixed sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high
• Fixed Claude sometimes replying "your message came through empty" after an MCP tool call
• Fixed deny and ask permission rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling
• Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line
• Fixed plugin and marketplace errors showing a token or password from a git source URL
• Fixed /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs
• Fixed prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request
• Fixed entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale
• Fixed a running session silently switching to the organization's default model when another Claude Code process refreshed a stale model-access entry
• Fixed long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans
• Fixed workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused
• Fixed MCP server OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound
• Fixed the conversation summary produced by /compact and auto-compact mangling text that contained $ sequences
• Fixed resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume
• Fixed SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction
• Fixed @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it
• Fixed claude agents: pressing ← again at a natural pace to go back to the agent list no longer gets ignored until you pause for over a second
• Fixed claude agents session delete getting stuck when a worktree can't be removed: the message names the cause and next step, and for a git worktree ctrl+x again deletes the directory anyway
• Fixed background agent and workflow rows in the agents panel expanding to many lines when their text contained line breaks
• Fixed Claude in Slack sessions losing their Slack tools when org managed settings set an MCP allowlist
• Fixed Claude in Chrome asking to allow the host "https" when a navigation URL had a scheme but a host that could not be parsed
• Fixed the spinner wrapping onto several lines when the current task's label is long; the label and the "Next:" task line now stay within one terminal row
• Fixed the /bug and /feedback description field showing no cursor when the terminal's native cursor is enabled
• Fixed Remote Control sessions served by claude remote-control showing a generated name instead of their session title in ListAgents
• Fixed claude plugin validate rejecting plugin paths whose directory name begins with two dots, which the plugin loader accepts
• Fixed plugins silently skipping a default monitors file or root SKILL.md that could not be checked
• Fixed WebFetch's error for localhost and other dotless hostnames to explain why the URL is refused and suggest curl
• Fixed PermissionRequest hooks not firing in --print mode
• Fixed policy-helper warnings not printing on headless (-p) runs
• Fixed /resume listing a /fork background session under its parent's name instead of its own ⑂ fork name
• Fixed /remote-control and other claude.ai-gated commands to suggest /login when signed out instead of showing a Claude for Enterprise migration message
• Fixed CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS not extending SessionEnd hooks that have no per-hook timeout (they were still cancelled after 1.5 seconds)
• Fixed /autofix-pr and other cloud-session commands saying to retry or install the Claude GitHub App when no GitHub account is connected; they now point to /web-setup or the web connect page
• Fixed cloud-session commands such as /teleport and /remote-env to explain when an organization policy turns them off, instead of answering "Unknown command"
• Fixed Bash sandbox instructions over-stating confinement: no unenforced path lists when filesystem isolation is off, and strict mode no longer claims commands can never run unsandboxed
• Improved fullscreen mode: adding or removing a prompt line (Shift+Enter) now repaints as fast as typing a character instead of re-rendering the visible transcript
• Improved --continue / --resume: the conversation appears immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.268

• Added to the Claude apps gateway: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter
• Added a startup warning for gateways when access_control.allow_cidrs is empty, and a one-time warning the first time a request arrives from a public address
• Added the gatewayInternalNetworks managed setting, letting administrators allow /login to a Claude apps gateway on their organization's own public IPv4 block
• Added claude self-hosted-runner --remove-session-state (default off): delete each session's per-session directories under <base-dir>/_sessions/ when the session ends
• Added configDirectory to the output of claude auth status --json
• Added --json to claude plugin install, uninstall, update, enable and disable, and errorDetails/noteDetails to each row of claude plugin list --json
• Added browser-tab icons for published artifacts, chosen by Claude to match each page
• Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject
• Fixed WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off)
• Fixed a respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted
• Fixed sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high
• Fixed Claude sometimes replying "your message came through empty" after an MCP tool call
• Fixed deny and ask permission rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling
• Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line
• Fixed plugin and marketplace errors showing a token or password from a git source URL
• Fixed /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs
• Fixed prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request
• Fixed entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale
• Fixed a running session silently switching to the organization's default model when another Claude Code process refreshed a stale model-access entry
• Fixed long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans
• Fixed workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused
• Fixed MCP server OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound
• Fixed the conversation summary produced by /compact and auto-compact mangling text that contained $ sequences
• Fixed resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume
• Fixed SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction
• Fixed @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it
• Fixed claude agents: pressing ← again at a natural pace to go back to the agent list no longer gets ignored until you pause for over a second
• Fixed claude agents session delete getting stuck when a worktree can't be removed: the message names the cause and next step, and for a git worktree ctrl+x again deletes the directory anyway
• Fixed background agent and workflow rows in the agents panel expanding to many lines when their text contained line breaks
• Fixed Claude in Slack sessions losing their Slack tools when org managed settings set an MCP allowlist
• Fixed Claude in Chrome asking to allow the host "https" when a navigation URL had a scheme but a host that could not be parsed
• Fixed the spinner wrapping onto several lines when the current task's label is long; the label and the "Next:" task line now stay within one terminal row
• Fixed the /bug and /feedback description field showing no cursor when the terminal's native cursor is enabled
• Fixed Remote Control sessions served by claude remote-control showing a generated name instead of their session title in ListAgents
• Fixed claude plugin validate rejecting plugin paths whose directory name begins with two dots, which the plugin loader accepts
• Fixed plugins silently skipping a default monitors file or root SKILL.md that could not be checked
• Fixed WebFetch's error for localhost and other dotless hostnames to explain why the URL is refused and suggest curl
• Fixed PermissionRequest hooks not firing in --print mode
• Fixed policy-helper warnings not printing on headless (-p) runs
• Fixed /resume listing a /fork background session under its parent's name instead of its own ⑂ fork name
• Fixed /remote-control and other claude.ai-gated commands to suggest /login when signed out instead of showing a Claude for Enterprise migration message
• Fixed CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS not extending SessionEnd hooks that have no per-hook timeout (they were still cancelled after 1.5 seconds)
• Fixed /autofix-pr and other cloud-session commands saying to retry or install the Claude GitHub App when no GitHub account is connected; they now point to /web-setup or the web connect page
• Fixed cloud-session commands such as /teleport and /remote-env to explain when an organization policy turns them off, instead of answering "Unknown command"
• Fixed Bash sandbox instructions over-stating confinement: no unenforced path lists when filesystem isolation is off, and strict mode no longer claims commands can never run unsandboxed
• Improved fullscreen mode: adding or removing a prompt line (Shift+Enter) now repaints as fast as typing a character instead of re-rendering the visible transcript
• Improved --continue / --resume: the conversation appears immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript
• Improved responsiveness during tool-heavy turns by no longer redrawing the transcript for a hidden per-tool-batch reminder

... (truncated)

Commits

• 536a2e2 chore: Update CHANGELOG.md and feed.xml
• fb63c4a Merge pull request #93244 from anthropics/poteat/mods-telemetry-fixes
• 1297731 mods/diff: backgrounds summary in two lines, as the internal copy has it
• 573ada6 mods/diff: context lines draw on no background, not the cyan background-task ...
• 8939dec mods/diff: the backend probes comment names where a host adds backends
• 2142ece mods/diff: a backend seam, git as the built-in backend
• 1a7c76e mods: API renames in diff, telemetry rows queue and third-party providers sen...
• e62465d Merge pull request #93215 from anthropics/poteat/mods
• d9c456d Add mods: sec-default, diff and telemetry, the hooks-module plugins built int...
• 9cdc2a4 chore: Update CHANGELOG.md and feed.xml
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Routine Dependabot npm devDependency bump (@anthropic-ai/claude-code 2.1.259 → 2.1.268), not an upstream anthropics/claude-code-action SHA bump — package-lock.json is updated consistently everywhere (main package plus all 8 optional platform packages), so no inconsistency there.

Title and description (Dependabot's auto-generated changelog summary) are accurate and complete for this change — no update needed.

No draft-conversion signal present (mechanical bot-authored bump, no WIP/incomplete markers) — not applicable regardless, since mark_draft_if_unready is off for this run.

Findings

• 🟠 Should fix [policy] — this bump orphans the allowScripts allowlist entry in package.json (still pinned to 2.1.259), which will cause npm 12's lifecycle-script gate to block @anthropic-ai/claude-code's postinstall script again after merge — silently undoing the fix commit 2d35b3f made for exactly this CLI. See inline comments on package.json.

Requesting changes for the one Should-fix; everything else here is fine.

[github-actions]

🟠 Should fix [policy]

This bump orphans the allowScripts entry at line 43, which pins the postinstall-script allowlist to the old exact version:

"allowScripts": {
  "@anthropic-ai/claude-code@2.1.259": true
}

npm 12's lifecycle-script gate (this repo's own packageManager: npm@12.0.2...) matches allowScripts keys by exact name@version. After this bump, 2.1.268 no longer matches the allowlisted 2.1.259, so @anthropic-ai/claude-code's postinstall script will be silently blocked again on any npm ci/npm install — including in .github/workflows/dependabot.yml's investigate job and every npm ci step in ci.yml.

This field was added deliberately in 2d35b3f specifically so this CLI's postinstall script keeps working under the new npm 12 lifecycle-script gate ("the dependabot investigate job invokes this CLI directly via npx, so the script genuinely needs to run"). This PR's version bump silently undoes that fix.

Suggested change

	"@anthropic-ai/claude-code": "2.1.268",
	"@anthropic-ai/claude-code": "2.1.268",

Please also update line 43:

Suggested change

	"@anthropic-ai/claude-code": "2.1.268",
	"@anthropic-ai/claude-code@2.1.268": true

[github-actions]

Correction to my comment on line 20 above: please disregard both suggestion blocks in that comment — a GitHub suggestion always replaces the exact line(s) the comment is anchored to (line 20), so the second block (showing the allowScripts fix) would incorrectly overwrite the devDependencies version line if applied, and the first is a no-op since line 20 already reads 2.1.268. The allowScripts fix still needs to be applied by hand, since it's outside this diff's hunk and can't be anchored directly:

   "allowScripts": {
-    "@anthropic-ai/claude-code@2.1.259": true
+    "@anthropic-ai/claude-code@2.1.268": true
   }

[github-actions]

Re-reviewed at the same head commit (588e4ad) as the existing github-actions[bot] review, so this isn't a stale-thread situation — no new inline comment added to avoid duplicating the one already on package.json.

Independently re-verified the prior Should-fix finding, and it still stands [policy]: the bump updates devDependencies["@anthropic-ai/claude-code"] to 2.1.268 but leaves allowScripts pinned to the old version key:

"allowScripts": {
  "@anthropic-ai/claude-code@2.1.259": true
}

npm 12's allowScripts gate (introduced in this repo by 2d35b3f, specifically to approve this package's postinstall script) matches on the exact name@version string. Since the key wasn't bumped alongside the dependency, npm ci/npm install will block @anthropic-ai/claude-code@2.1.268's postinstall script — which the Dependabot investigate job relies on (it invokes this CLI directly via npx claude). This needs:

"allowScripts": {
  "@anthropic-ai/claude-code@2.1.268": true
}

Everything else checks out:

• package-lock.json bumps the main package and all 8 optional platform packages (darwin-arm64/x64, linux-arm64, linux-arm64-musl, linux-x64, linux-x64-musl, win32-arm64/x64) consistently to 2.1.268 — no version drift.
• Title/description are Dependabot's standard auto-generated summary and accurately describe the change; no edit needed.
• No draft-conversion signal present (this is a routine, complete dependency bump, not a WIP or stub).

Requesting changes only because the allowScripts key is a hard install-time gate, not a style nit — this diff will make CI's Dependabot investigation step fail on a blocked postinstall script.

[github-actions]

🗜️ Headroom context compression

Metric	Value
Requests proxied	42
Tokens saved	67802
Aggregate savings	1.4% of all tokens sent
Average per-request compression	1.9%