chore(deps): update dependency @anthropic-ai/claude-code to v2.1.223

[renovate-fullsend]

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-code	2.1.220 → 2.1.223

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.223

Compare Source

• Added owner wildcard entries ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings for allowing or blocking all marketplace repos under a GitHub org
• Added a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead
• Added a /teleport hint in cloud sessions showing how to continue locally with claude --teleport <session id>
• Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks
• Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
• Fixed workflow scripts being able to use dynamic import() to run code outside the workflow sandbox
• Fixed a permission gap where an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy
• Fixed resuming a session after a mid-session /cd coming back empty
• Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-*
• Fixed modelOverrides keys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented
• Fixed managed settings: server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key
• Fixed sandboxed commands failing to start on Linux when sandbox.filesystem.denyWrite covers the working directory
• Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume
• Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment
• Fixed a rare hang when parsing unusual git push output
• Changed CLAUDE_CODE_DISABLE_1M_CONTEXT to hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K
• Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 to restore the previous behavior
• Changed /review to be an alias of /code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); use /code-review ultra for a deep cloud review
• Changed /code-review with no effort level to reuse the level you typed last; type a level like /code-review high to change it

v2.1.222

Compare Source

• Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type
• Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
• Fixed /usage-credits on Team and Enterprise showing "you've already sent a usage credit request" for members whose earlier request was dismissed, blocking them from sending a new one
• Fixed the startup connectivity check hanging and then failing behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message
• Fixed "Connection closed mid-response" errors being reported on responses that had actually completed
• Fixed /usage overattributing usage to MCP servers: a server's share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it
• Fixed sessions not linking to pull requests created after the branch was pushed, including through the GitHub REST API
• Fixed org-restricted model: opus-style subagent and teammate family aliases dropping to the parent model instead of stepping down to the newest org-allowed model in the family
• Fixed stream idle timeout firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire
• Fixed claude.ai connectors being falsely marked as needing authorization when the session token is invalid — they now show a /login hint instead
• Fixed tool errors not being displayed for tools no longer available locally, for example after an MCP server is removed
• Fixed SendMessage rejecting a long summary — it now truncates instead, so sends no longer fail on a character limit
• Fixed the spinner's effort label in a subagent's transcript view showing the session's effort level instead of the subagent's own effort: setting
• Fixed rare crashes when a file watcher hit a filesystem error or during file-watcher teardown
• Fixed screen readers re-reading the whole input line on every backspace in --ax-screen-reader mode — end-of-line deletions now echo just the deleted characters
• Fixed host model-selection keys not taking precedence over a stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set
• Improved auto mode safety: messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch
• Improved the refusal when Claude tries to invoke a skill with disable-model-invocation: Claude is now told to ask you to run the skill instead of replicating its workflow
• Improved the /diff view, the Remote Control workspace diff, and file-edit diffs in Claude Code on the web sessions to use raw git blob content, ignoring workspace-configured diff drivers and textconv
• Changed Remote Control auto-start so repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer turn it on (they can still turn it off); enable it at user scope via /config
• Removed ultraplan feature

v2.1.221

Compare Source

• [VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command
• Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
• Added warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
• Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models
• Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission
• Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
• Fixed the thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
• Fixed MCP servers from --mcp-config not being connected before the first turn in print mode (-p), which made the model emit tool calls as literal text
• Fixed @​-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
• Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor
• Fixed WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled
• Fixed sandboxed large uploads failing with TLS errors through the sandbox proxy
• Fixed Team and Enterprise spend-limit message incorrectly blaming the org's monthly limit instead of your individual spend limit
• Fixed Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume; falsy values are now honored
• Fixed a rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
• Fixed renaming a session from Claude Code Desktop or claude.ai not updating the CLI's session name; session names from every rename surface are now sanitized
• Fixed plugin- and org-delivered skills named after terminal-only built-ins (e.g. /help, /feedback) being un-invocable in non-interactive sessions
• Fixed the "Plugins changed" notification lingering after plugins were reloaded instead of clearing
• Fixed Vim mode: the yank register now survives dialogs, history search, and the transcript view instead of being silently emptied
• Fixed Vim mode: undoing back to an empty prompt now arms the "press ← again" confirm before returning to the agent view
• Improved tool search on Google Vertex AI: re-enabled for Claude 4.5-generation and newer models
• Improved auto mode: permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending reliably prompts instead of applying the stale result
• Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions
• Improved Stats panel to count cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
• Improved /ultrareview error messages when a repo shares no history with its base: a checkout with no branches is now refused up front with advice to create one, and refusal hints no longer suggest git fetch --unshallow on clones that are already complete
• Improved Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate powershell.exe no longer prompt
• Changed background sessions to commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
• Changed /plugin install to refresh a stale marketplace catalog and retry before reporting a plugin not found
• Changed plugins installed from /plugin to activate immediately when safe, instead of always requiring /reload-plugins
• Changed plugins to accept "." as a skills path, and the root-level SKILL.md validation error now suggests using the plugin root
• Changed /status to show the session kind: interactive, or a background job that is attached or unattended
• Changed emoji autocomplete to accept common alternate shortcodes like :thumbsup:, :thumbsdown:, and :love:
• Changed sessions forked with /fork to create a new worktree of their own instead of working in the original session's checkout
• Changed Claude in Chrome to close the browser tabs it opens once it no longer needs them
• Changed fast mode to report on the stream when usage credits run out mid-session, instead of failing silently
• Changed Monitor: a watch that exits without producing any output now says so instead of reporting "stream ended"
• Changed the Gateway model field validation: non-string values are rejected with a 400 instead of being forwarded
• Removed the repeated "Permission mode changed while the auto-mode classifier call was queued" notice from approval prompts

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:53 PM UTC · Completed 4:01 PM UTC
Commit: 39dcdb0 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected images/ path. The change is an automated Renovate patch bump of @anthropic-ai/claude-code from 2.1.220 to 2.1.223, explicitly configured via a customManagers regex entry in renovate.json. However, the PR has no linked issue providing explicit authorization for modifying infrastructure files. Human approval is always required for protected-path changes.
  Remediation: A human reviewer should verify the version bump is intentional and approve the change to this protected path.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies images/sandbox/Containerfile, which is under the protected images/ path. The change is an automated Renovate patch bump of @anthropic-ai/claude-code from 2.1.220 to 2.1.222, explicitly configured via a customManagers regex entry in renovate.json. However, the PR has no linked issue providing explicit authorization for modifying infrastructure files. Human approval is always required for protected-path changes.
  Remediation: A human reviewer should verify the version bump is intentional and approve the change to this protected path.

---

Labels: PR updates a dependency version in the sandbox Containerfile

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:19 AM UTC · Completed 4:27 AM UTC
Commit: 75383b0 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:04 AM UTC · Completed 8:18 AM UTC
Commit: 75383b0 · View workflow run →

[fullsend-ai-retro]

Retro: PR #5940 — Renovate bot claude-code version bump

Timeline

PR #5940 was a single-line Renovate bot update bumping @anthropic-ai/claude-code from 2.1.220 to 2.1.223 in images/sandbox/Containerfile. The full agent cascade:

1. 2026-08-05 15:52 — Renovate opens the PR (1 addition, 1 deletion)
2. 2026-08-05 15:53 — First review dispatched (run 31022541441)
3. 2026-08-05 16:01 — Review agent posts CHANGES_REQUESTED with a High-severity [protected-path] finding on images/sandbox/Containerfile, noting human approval is required
4. 2026-08-05 16:01 — Fix agent dispatched (run 31023235942) — exits in ~15s via guard ("Human-authored PR without fullsend-fix label")
5. 2026-08-06 04:18 — Renovate rebases the branch, triggering a synchronize event
6. 2026-08-06 04:19 — Second review dispatched (run 31070895518)
7. 2026-08-06 04:27 — Review agent posts the identical [protected-path] finding again
8. 2026-08-06 04:28 — Second fix agent dispatched (run 31071321839) — exits in ~10s via the same guard
9. 2026-08-06 07:55 — Human (rh-hemartin) approves with no comments
10. 2026-08-06 08:02 — PR merged by Renovate bot
11. 2026-08-06 08:02 — Retro dispatched

What went well

• The review agent correctly identified the protected path and deferred to human judgment — this is the intended behavior for images/ changes.
• The fix agent guards worked: both fix runs exited in 10-15 seconds without invoking the LLM, preventing significant token waste.
• All 21 CI checks passed. The human approved and the PR merged successfully.

What could go better

This single-line version bump triggered 5 agent runs (2 reviews, 2 fix attempts, 1 retro) plus 5 dispatch jobs — a cascade of automation for a change that only needed a human to click Approve. Each step in the cascade is already tracked by existing issues:

Protected-path noise on bot dependency PRs:

• #2588 — downgrade protected-path severity for bot-authored dependency PRs
• #3910 — expand protected-path agent-approval exemption for single-ARG version bumps in Dockerfiles (matches this exact case)
• #4387 — conditional protected-path exceptions for trusted bot version-only bumps

Redundant re-review after Renovate rebase:

• #4596 — avoid full re-reviews when Renovate rebases without content changes
• #4401 — detect rebase-only force-pushes and skip re-review

Duplicate inline comments across review rounds:

• #5007 — deduplicate inline review comments across force-push re-reviews
• #2794 — identical protected-path comments on every workflow run

Fix agent dispatched on unfixable findings:

• #5811 — skip fix dispatch at routing level for human-authored PRs without fullsend-fix label (already triaged as medium priority with component/dispatch)
• #1068 — review agent should not file CHANGES_REQUESTED for governance-only findings the fix agent cannot resolve

Skip all agent stages for bot dependency PRs:

• #5360 — skip review and retro stages for bot-authored dependency update PRs
• #5817 — consolidation meta-issue for 22+ overlapping skip proposals

Fix agent bot-detection:

• #5536 — fix agent eligibility check misidentifies bot-authored PRs as human-authored (the guard exited for the wrong reason: it classified this Renovate PR as "human-authored" rather than bot-authored)

Pattern confirmation

This is not an isolated case. Checking the 5 most recent merged Renovate PRs confirms the pattern: every Renovate PR touching images/ paths (PRs #5940, #5905, #5921) received [protected-path] CHANGES_REQUESTED, while those touching non-protected paths (#5963, #5878) were approved cleanly. PR #5618 (tirith) accumulated 12 review runs on a single Renovate branch.

No new proposals

All improvement opportunities identified in this retro are already tracked by existing open issues. The highest-impact single change would be implementing #5360 (skip review/retro for bot dependency PRs), which would eliminate the entire cascade. Alternatively, #3910 (exempt single-ARG version bumps from protected-path) would convert the review verdict from CHANGES_REQUESTED to APPROVED, preventing the fix dispatch chain while preserving the review signal.