chore(deps): update dependency @anthropic-ai/claude-code to v2.1.258

[renovate-fullsend]

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-code	2.1.252 → 2.1.258

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.258

Compare Source

• Fixed Claude Code failing to launch on macOS 12 (Monterey), a regression introduced in 2.1.255
• Fixed remote and scheduled sessions failing with "user messages must have non-empty content" after a re-sent permission approval could not be applied

v2.1.257

Compare Source

• Added Claude Fable 5.1 (claude-fable-5-1), now the default Fable model — 1M context, $10/$50 per Mtok with $0.25/Mtok cache reads
• Added "Time format" (timeFormat) and timeZone settings: 12-hour, 24-hour, 24-hour UTC, or a strftime pattern for the turn-end clock and transcript-view timestamps
• Added a Containment Escape rule to auto mode so cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved unless your environment marks them expected
• Added CLAUDE_CODE_SUBAGENT_MODEL_FORCE to apply CLAUDE_CODE_SUBAGENT_MODEL (or the main model) to every subagent, ignoring per-spawn and agent-definition model overrides
• Added s in /effort to change effort for the current session only, matching /model
• Added a /doctor warning for stale sandbox mask files left by a killed session
• Added a one-time prompt in auto mode before the first file read outside the working directories, with the option to block such reads (permissions.blockReadsOutsideWorkingDirectories)
• Added support for a gateway-supplied description on discovered /model picker entries (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY); entries without one still read "From gateway"
• Fixed settings in a .claude/ folder created after startup not being picked up until restart
• Fixed sessions dispatched from an agent view opened with ← always starting in the original session's permission mode, overriding the target directory's defaultMode and the agent's permissionMode
• Fixed keybindings.json rebinds of Ctrl+G being ignored in claude agents; its Ctrl+S / Ctrl+T are now rebindable via the new Agents context
• Fixed background sessions failing to start on macOS npm installs during a self-update, and on Windows when a stale daemon lock file pointed at a reused process id
• Fixed the working spinner stopping while a response streams behind a slash-command panel
• Fixed a background session's state.json detail repeating its own dispatch prompt after a scheduled wake-up
• Fixed claude agents keeping a background session you re-prompted buried in Completed after it finished again; Completed now orders by the latest finish
• Fixed claude --bg from a directory that was just deleted reporting "backgrounded" and leaving a crashed session row; it now prints the reason and exits 1
• Fixed Remote Control connecting mid-session re-sending the Bash tool definition, causing a prompt-cache miss
• Fixed a doubly-listed custom Authorization header overriding the configured credential on Bedrock, Mantle, Vertex, and WIF, and the Vertex setup wizard picking up a leftover Anthropic profile from ~/.config/anthropic
• Fixed Claude apps gateway sending stray host Authorization or profile headers to Foundry, Vertex, and Bedrock, and Foundry Entra ID upstreams not starting when ANTHROPIC_FOUNDRY_API_KEY is set
• Fixed a leftover Anthropic API key or auth token being sent alongside your Foundry subscription key in API-key mode
• Fixed /schedule routines whose prompt was saved without a message role and then ran with nothing to do
• Fixed claude agents not saying that a background session is waiting for you to approve a message from another session, or who sent it
• Fixed a prompt stashed with Ctrl+S inside an opened background session being lost when the session went idle or was stopped and then reopened
• Fixed telemetry (OTEL) settings pushed through server-managed settings being ignored on warm starts, including desktop-app Code sessions
• Fixed a teammate permission request being answered twice when the leader's mailbox write was briefly locked
• Fixed a phantom duplicate slash-command row rendering below the in-flight turn while a command's auto-continued response streamed
• Fixed policyHelper timeoutMs and refreshIntervalMs values above the timer maximum (2147483) causing failures or re-runs every millisecond; they are now clamped
• Fixed the token counter freezing or crawling after switching to another subagent's transcript, and made background subagents' and teammates' counters update live while a response streams
• Fixed sandbox network hosts written with a trailing dot (example.com.): a deniedDomains entry didn't block the host inside the sandbox, and "don't ask again" for such a host kept prompting
• Fixed dismissing the Remote Control consent prompt (Esc, or n at claude remote-control) counting as consent, so the next request connected without asking
• Fixed /mcp reconnect and enable still connecting a settings-file MCP server that a managed MCP allow/deny list or strictPluginOnlyCustomization loaded after startup should block
• Fixed claude mcp remove leaving a remote server's stored OAuth credentials behind when strictPluginOnlyCustomization locks MCP to plugin-only servers
• Fixed Remote Control (claude remote-control) sessions started from the Claude app ignoring the selected model and running on the machine's default instead
• Fixed --disallowedTools and session deny rules being dropped after the first settings reload when allowManagedPermissionRulesOnly is enabled
• Fixed --resume listing a backgrounded conversation twice and --continue reopening its stalled pre-background copy; --continue now also opens finished background sessions
• Fixed fullscreen mode not letting you click ! shell command output to expand it
• Fixed background sessions left running an older Claude Code binary piling up across auto-updates instead of being retired
• Fixed claude agents --json briefly switching the terminal to raw mode and undoing another program's terminal settings on exit
• Fixed Proactive output style sessions busy-looping with filler messages and repeated log reads instead of idling while a background command or Monitor they started is still running
• Fixed subagents stopping when a response was cut off mid-stream by a computer sleep, dropped connection, or server error; they now automatically continue instead of ending with an incomplete response
• Fixed ← doing nothing in the /btw panel inside a claude agents session: it now returns to the agents list (even mid-answer), and the panel comes back when you reopen the session
• Fixed sessions with an advisor model set missing the prompt cache on background requests (compaction, /recap, prompt suggestions) and re-sending the full conversation uncached each time
• Fixed claude -p exiting about 5 seconds after its final result while a Monitor the model armed was still running; it now waits for the watch to fire or time out
• Fixed a permissions.ask rule being skipped in auto mode when the matching command ran inside a compound command or subshell, letting it run without the confirmation prompt
• Fixed plugins being able to read files outside their own directory through a declared command, agent, skill, hooks or other component path that is a symlink; such paths are now refused with an error
• Fixed /add-dir rejecting a directory inside the current working directory; it now loads that directory's skills, commands, and agents like --add-dir does at startup
• Fixed the main agent not being told when you resume a subagent you had stopped from its transcript view
• Fixed a crash when pasting ANSI-colored text (e.g. a CI log) into dialogs like /feedback
• Fixed claude mcp add/remove hanging or exhausting memory when the project's .mcp.json is a FIFO or a device-file symlink; it now fails fast with an actionable message
• Fixed unbounded memory growth when non-JSONL data is piped into claude -p --input-format stream-json; it now fails fast with a clear error
• Fixed backgrounding a turn (← or Ctrl+B) while a subagent or other tool was running occasionally making the background session treat that tool as rejected instead of re-running it
• Fixed Bash Read()/Edit() deny rules not applying to < file redirects and reader commands like tac and egrep; a deny rule on any argument or redirect target now refuses the command
• Fixed resuming or messaging a subagent whose transcript had grown past 5 MB (for example after reading many images) failing with "No transcript found"
• Fixed worktree-isolated sessions refusing Bash loops, $VAR reads, "$(…)" and heredocs that never touch git as "too complex to verify that it stays inside the worktree"
• Fixed /model and /effort showing a prompt-cache warning after rewinding a conversation back to empty
• Fixed prompt-cache misses on every turn in long screenshot-heavy sessions once images exceeded the per-request size cap
• Fixed the Edit permission prompt's diff view rendering emoji and multi-code-point characters with incorrect widths
• Fixed WebSocket MCP server connection failures being logged as "[object ErrorEvent]" instead of the underlying error
• Fixed background sessions failing to open with "Couldn't start the background service" while another Claude Code process was downloading an npm update; the start now waits for it
• Fixed background commands that detach from their shell (for example under timeout or setsid) surviving a task stop or Claude Code exit
• Fixed Claude not being told when you stop a background command from the tasks panel or a connected client
• Fixed stopping a background subagent leaving its monitors running
• Fixed sandboxed git commands in a linked worktree losing write access to the repository's common .git directory after cd into a subdirectory
• Fixed Bedrock and Bedrock Mantle requests going silent during long hidden-thinking phases on Opus 4.7 and later, which let idle timeouts cut the connection; the stream now carries progress events
• Fixed launching Claude Code after a Claude apps gateway expired or revoked your session: it now says the session ended and offers /login instead of reporting a network error
• Fixed cloud sessions losing git/GitHub credentials for the rest of the session when the session's network proxy failed to start at launch; it now retries in the background and recovers
• Fixed leftover cc-daemon-* folders in the system temp directory after an interrupted background daemon start; the cleanupPeriodDays retention sweep now removes them
• Fixed Bash permission checks auto-approving certain [[ ]] conditionals that zsh parses differently from bash; these commands now prompt for approval
• Fixed the managed-settings approval prompt showing the generic warning instead of its telemetry wording when the settings also turn detailed tracing or raw API body logging off, or trace export on
• Fixed agent-team teammates in tmux/iTerm2 panes sometimes staying open after acknowledging a shutdown request
• Fixed the keyless Console sign-in ("Sign in with your Console account") not applying your organization's server-managed settings, and /status not showing the Organization for that sign-in
• Improved rendering performance: less re-render work per turn in long conversations, streaming no longer slows down as the reply grows, and background-agent updates no longer re-render the whole screen
• Improved prompt input responsiveness by reducing per-keystroke rendering work
• Improved policy helper diagnostics — refresh failures now show in /status, declining the managed-settings dialog prints why Claude Code exited, and helper timeouts are reported as timeouts
• Improved /code-review --comment to post findings on GitLab merge requests via glab mr note instead of reporting the target as unsupported
• Improved notifications: an MCP elicitation or permission ask queued under another dialog now sends its idle desktop notification at the same delay as a visible ask
• Improved verbose/transcript output: async hook completion notices that arrive together now appear on one line instead of one line per hook
• Improved claude self-hosted-runner --configure-git to also enable git push negotiation, so the first push of a new branch from a stale clone uploads only the new commits instead of the whole tree
• Improved liveness reporting to SDK hosts while a response is held open by gateway keep-alives, so long waits under a raised CLAUDE_STREAM_IDLE_TIMEOUT_MS are not mistaken for a hung session
• Improved MCP connection and OAuth debug/error logs so credentials carried in a server's URL or request headers are redacted
• Improved /fork to keep the original conversation's prompt cache in the new background session: its worktree briefing now arrives as a message instead of a system-prompt change
• Improved emoji autocomplete to accept the remaining GitHub/Slack shortcode aliases (:satisfied:, :telephone:, :collision:, …)
• Changed --effort to lift a new model's default-effort hold for that session only rather than permanently; an effort picked on claude.ai for a Remote Control session now applies during the hold
• Changed a policyHelper in MDM or managed-settings.json shadowed at launch by cached server-managed settings to run (or exit) as soon as the fetch reports them removed, not at the next launch
• Changed managedSourcesBehavior: "merge" to take sandbox.credentials.awsPairs and sandbox.ripgrep whole from the highest managed source that sets them instead of combining the sources' values
• Changed gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1) to run even when CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC is set, since it only queries your gateway
• Changed claude --resume <session-id> --bg to continue that session under its own ID when nothing is running it, instead of silently starting a copy; a copy is now announced
• Changed /btw history browsing from ←/→ to Shift+←/Shift+→ (or [/]), stepping through your recent side questions and back to the live answer
• Changed defaultMode: "bypassPermissions" in .claude/settings.json or .claude/settings.local.json to be ignored, like "auto"; set it in user or managed settings, or pass --permission-mode
• Changed fable and best in Claude apps gateway sessions to keep resolving to Fable 5 for now, since gateways not yet configured for Fable 5.1 reject it; pick Fable 5.1 in /model to use it
• Changed --add-dir, /add-dir, and additionalDirectories to refuse network paths (UNC shares, /net/<host> automounts) with a message before touching them; on Windows use a mapped drive letter
• Changed Claude apps gateway sign-in and token refresh requests to verify the gateway's pinned TLS certificate, as the managed settings fetch already does
• Changed Cowork and claude.ai cloud sessions: reading an artifact that isn't yours now always asks you first, even in auto mode
• Removed the Ctrl+E command explanation on Bash and PowerShell permission prompts
• [VSCode] Added collapsible ACCOUNT & USAGE and SESSION MANAGER section headers to the session list panel, with the account email, the usage meter, and a View details link opening the usage dialog
• [VSCode] Added a model pill to the input footer that shows the current model and opens the model picker, with an Effort row and a "More models" page
• [VSCode] Added a collapse toggle to the Ungrouped section of the session list
• [VSCode] Added output style selection to the command menu, including custom styles
• [VSCode] Fixed third-party provider deployments (Bedrock, Vertex, and others) still showing claude.ai-only features (remote sessions, dictation, usage) and calling claude.ai with a leftover login
• [VSCode] Fixed the session list panel's usage meter staying blank after the panel loads; it now shows the last known usage immediately
• [VSCode] Fixed the "Enable Remote Control for all sessions" toggle so turning it on or off applies to sessions that are already open, not only to new ones
• [VSCode] Fixed screen reader announcements: a control character before a fence or heading no longer drops visible lines from speech, and bold markers spanning a heading are no longer mis-paired
• [VSCode] Changed the action menu to list slash commands in a filterable "Slash commands" dialog instead of inline; picking one runs it; the MCP servers dialog gained the same filter box
• [VSCode] Changed "Delete session" to "Archive session": archived sessions move to a collapsible "Archived sessions" group at the bottom of the list with an Unarchive action

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:30 AM UTC · Completed 3:39 AM UTC

Commit: 9cf0c9b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.40

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Small dependency version bump (1 file, 2 lines) by bot author with one protected path (images/), but high recent churn and multi-author contention in the Containerfile offset by minimal change surface area.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This PR modifies a file under the protected paths images/ and Containerfile. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes, regardless of whether the change is a routine dependency bump.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] protected-path

This PR modifies images/sandbox/Containerfile, which is under the protected paths images/ and Containerfile. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.