build(deps-dev): bump @anthropic-ai/claude-code from 2.1.259 to 2.1.263

[dependabot]

Bumps @anthropic-ai/claude-code from 2.1.259 to 2.1.263.

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.263

What's changed

• Bug fixes and reliability improvements

v2.1.261

What's changed

• Added an "Organization policy" line to /status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through
• Added bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters
• Added --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line
• Added /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them
• Fixed typed or pasted characters occasionally landing out of order or being dropped during fast input or key repeat
• Fixed /add-dir <subdirectory> printing a false "couldn't be resolved" error when the working directory is on a /net automount
• Fixed the Bedrock setup wizard hanging when AWS or an AWS credential helper never responds (it now times out with a clear error), and its model checks failing behind a TLS-inspecting proxy
• Fixed cloud sessions discarding a plugin synced from claude.ai when managed settings force-enable it in enabledPlugins, then falling back to a marketplace clone that could fail
• Fixed being unable to delete the character immediately before an inline [Image #N] chip in the prompt input
• Fixed resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request
• Fixed Remote Control showing a stale permission mode when a phone, browser, or claude.ai app attaches to a terminal session or after the mode changes in the terminal
• Fixed Remote Control sessions showing as still working (stuck spinner and Stop button) after stopping a turn from a connected phone or browser, or after a local slash command like /clear
• Fixed SDK and cloud sessions ignoring a Stop or interrupt sent just after the first prompt, before the turn had started; the turn now stops instead of running to completion
• Fixed Remote Control uploading a session pulled with /teleport into the connected session, which appeared appended to the original on phone and web
• Fixed Remote Control's inbound event stream failing behind TLS-inspecting corporate proxies on native Windows
• Fixed Remote Control sessions showing the default effort level on claude.ai when the effort comes from settings
• Fixed gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid
• Fixed claude.ai connectors staying absent for the whole session when the startup connector fetch timed out — the CLI now retries in the background
• Fixed sustained high CPU usage when a background agent could not be resumed and its wake-up was retried in a tight loop
• Fixed feature flags gated to a newer version occasionally applying to an older Claude Code version running on the same machine
• Fixed /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup
• Fixed claude -p --resume <file> adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead
• Fixed the terminal progress indicator (iTerm2, Ghostty, ConEmu) showing the session as finished while a background workflow or agent was still running
• Fixed a rare layout glitch where a box could render with the wrong height after its container switched between row and column direction
• Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now gets 403
• Fixed Claude apps gateway telling Claude Desktop to export OpenTelemetry as JSON even when the terminal CLI uses protobuf, so protobuf-only collectors rejected Desktop's data
• Fixed Desktop and web showing a session as busy while it only watches an artifact for updates
• Fixed Claude in Chrome file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude Desktop app
• Fixed SendMessage to an offline Remote Control session on another machine reading as delivered; the result now says delivery is queued until that machine reconnects
• Fixed plugin install hints from CLIs run in background Bash commands: they are now detected, and the raw <claude-code-hint> tag no longer leaks into the conversation
• Fixed in-process agent-team teammates re-sending their first-turn tool and skill announcements on the second turn, which changed the request prefix and missed the prompt cache
• Improved the /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it
• Improved startup on Google Vertex AI when GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes
• Improved streaming performance: already-rendered blocks are no longer re-checked by layout on each update
• Improved the dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts
• Improved handling when the API sends no response headers: the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change
• Changed a Claude apps gateway 403 on the managed settings load (at startup or after /login) to say Claude Code may not be enabled for the organization, instead of advising a new sign-in
• Changed machines whose managed settings pin forceLoginMethod: "gateway" to ignore a leftover API key or claude.ai login and ask for /login; Bedrock, Vertex AI, and Foundry sessions are unaffected
• Changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site: no longer auto-approved unless you asked for it
• Changed the prompt's word-editing keys to match Bash: Ctrl+W deletes back to whitespace, Alt+F and Alt+D stop at word end, punctuation separates words; keybindingFlavor no longer has any effect
• Changed /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests
• [VSCode] Added a "Build a custom style" walkthrough to the Output styles menu that writes a custom output style file and lists it right away

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.263

• Bug fixes and reliability improvements

2.1.261

• Added an "Organization policy" line to /status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through
• Added bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters
• Added --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line
• Added /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them
• Fixed typed or pasted characters occasionally landing out of order or being dropped during fast input or key repeat
• Fixed /add-dir <subdirectory> printing a false "couldn't be resolved" error when the working directory is on a /net automount
• Fixed the Bedrock setup wizard hanging when AWS or an AWS credential helper never responds (it now times out with a clear error), and its model checks failing behind a TLS-inspecting proxy
• Fixed cloud sessions discarding a plugin synced from claude.ai when managed settings force-enable it in enabledPlugins, then falling back to a marketplace clone that could fail
• Fixed being unable to delete the character immediately before an inline [Image #N] chip in the prompt input
• Fixed resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request
• Fixed Remote Control showing a stale permission mode when a phone, browser, or claude.ai app attaches to a terminal session or after the mode changes in the terminal
• Fixed Remote Control sessions showing as still working (stuck spinner and Stop button) after stopping a turn from a connected phone or browser, or after a local slash command like /clear
• Fixed SDK and cloud sessions ignoring a Stop or interrupt sent just after the first prompt, before the turn had started; the turn now stops instead of running to completion
• Fixed Remote Control uploading a session pulled with /teleport into the connected session, which appeared appended to the original on phone and web
• Fixed Remote Control's inbound event stream failing behind TLS-inspecting corporate proxies on native Windows
• Fixed Remote Control sessions showing the default effort level on claude.ai when the effort comes from settings
• Fixed gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid
• Fixed claude.ai connectors staying absent for the whole session when the startup connector fetch timed out — the CLI now retries in the background
• Fixed sustained high CPU usage when a background agent could not be resumed and its wake-up was retried in a tight loop
• Fixed feature flags gated to a newer version occasionally applying to an older Claude Code version running on the same machine
• Fixed /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup
• Fixed claude -p --resume <file> adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead
• Fixed the terminal progress indicator (iTerm2, Ghostty, ConEmu) showing the session as finished while a background workflow or agent was still running
• Fixed a rare layout glitch where a box could render with the wrong height after its container switched between row and column direction
• Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now gets 403
• Fixed Claude apps gateway telling Claude Desktop to export OpenTelemetry as JSON even when the terminal CLI uses protobuf, so protobuf-only collectors rejected Desktop's data
• Fixed Desktop and web showing a session as busy while it only watches an artifact for updates
• Fixed Claude in Chrome file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude Desktop app
• Fixed SendMessage to an offline Remote Control session on another machine reading as delivered; the result now says delivery is queued until that machine reconnects
• Fixed plugin install hints from CLIs run in background Bash commands: they are now detected, and the raw <claude-code-hint> tag no longer leaks into the conversation
• Fixed in-process agent-team teammates re-sending their first-turn tool and skill announcements on the second turn, which changed the request prefix and missed the prompt cache
• Improved the /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it
• Improved startup on Google Vertex AI when GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes
• Improved streaming performance: already-rendered blocks are no longer re-checked by layout on each update
• Improved the dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts
• Improved handling when the API sends no response headers: the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change
• Changed a Claude apps gateway 403 on the managed settings load (at startup or after /login) to say Claude Code may not be enabled for the organization, instead of advising a new sign-in
• Changed machines whose managed settings pin forceLoginMethod: "gateway" to ignore a leftover API key or claude.ai login and ask for /login; Bedrock, Vertex AI, and Foundry sessions are unaffected
• Changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site: no longer auto-approved unless you asked for it
• Changed the prompt's word-editing keys to match Bash: Ctrl+W deletes back to whitespace, Alt+F and Alt+D stop at word end, punctuation separates words; keybindingFlavor no longer has any effect
• Changed /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests
• [VSCode] Added a "Build a custom style" walkthrough to the Output styles menu that writes a custom output style file and lists it right away
• [VSCode] Added an Add server form and a Remove action to the MCP servers dialog, so MCP servers can be added and removed without leaving the IDE
• [VSCode] Added a hollow ring in the session list for sessions open in a terminal, another VS Code window, or Claude Desktop, so they no longer look closed

... (truncated)

Commits

• ab9b2cf chore: Update CHANGELOG.md and feed.xml
• d7dbd9a chore: Update CHANGELOG.md and feed.xml
• b3f0e50 chore: Update CHANGELOG.md and feed.xml
• ee2a058 Merge pull request #91894 from williamqian12/frontend-design-skill-update
• dbdd79c Update /frontend-design SKILL.md
• See full diff in compare view

[github-actions]

Reviewed the full diff — a routine, mechanical devDependency bump of @anthropic-ai/claude-code (2.1.259 → 2.1.263) in package.json, with a matching, consistent version/integrity-hash update in package-lock.json for the package and all eight of its platform-specific optionalDependencies.

No behavioural change to review: this bumps the npm-tracked CLI used only by the investigate job's own npx claude step, not the SHA-pinned anthropics/claude-code-action GitHub Action action.yml calls — so per this repository's own Dependabot pipeline, no action.yml adaptation is expected here, and none is present. That's correct, not a gap.

The lockfile's newly-added root-level "engines" block matches a field already present in package.json on main before this PR — npm syncing the lockfile to an existing declaration, not a new constraint introduced by this change.

No prior reviews or inline comments exist on this PR to reconcile with. Nothing further to raise — approving.

[github-actions]

Reviewed independently and confirm: this is a clean, mechanical @anthropic-ai/claude-code devDependency bump (2.1.259 → 2.1.263).

• Only package.json (+1/-1) and package-lock.json (+39/-36) change; action.yml is untouched, as expected — this bumps the npm-tracked CLI used by the investigate job's own npx claude invocation, not the SHA-pinned anthropics/claude-code-action dependency, which is a separate release cadence per this repository's own CLAUDE.md.
• The lockfile bump correctly updates all eight platform-specific optionalDependencies (darwin/linux/win32, arm64/x64, plus musl variants) with matching resolved/integrity entries.
• The new "engines" block in package-lock.json mirrors a constraint already present in package.json on main (added by earlier commits a27b95a and 92886b8) — npm syncing the lockfile, not a new constraint introduced by this PR.

No findings — nothing to flag as policy or stack-default, and no title/description correction needed (the Dependabot-generated title and body are already accurate and complete).

Note for transparency: this exact commit (22255fc5) already carries a prior APPROVED review from this bot reaching the same conclusion with no inline comments. This review is an independent re-verification of that same commit, not a re-review of a new push, so no stale-thread or stale-review handling applies.

[github-actions]

❌ Claude's run did not complete (outcome: failure). View job run

[github-actions]

Independently verified — this is a clean, mechanical devDependency bump of @anthropic-ai/claude-code (2.1.259 → 2.1.263), scoped to package.json (+1/-1) and package-lock.json (+36/-36).

• All 9 affected entries (the root package plus its 8 platform-specific optionalDependencies) update version, resolved, and integrity consistently; no stray 2.1.259 references remain in the lockfile.
• action.yml's pinned anthropics/claude-code-action SHA is untouched, correctly — this bump tracks the npm-published CLI used by the investigate job's own npx claude step, not the SHA-pinned upstream Action, per this repository's own CLAUDE.md.
• Dependabot's title/description are already complete and accurate; no correction needed.

No findings — nothing to raise.

Note for transparency: two prior APPROVED reviews already exist on this exact same commit (9f681aa), not an earlier one — this is a duplicate run rather than a re-review of a new push, so the stale-review-dismissal flow doesn't apply here (consistent with what the second prior review already noted).

[github-actions]

Clean, mechanical devDependency bump — no findings.

What changed: @anthropic-ai/claude-code 2.1.259 → 2.1.263 in package.json and package-lock.json only.

Verified independently:

• All 9 package-lock.json entries (root devDependencies + 8 platform-specific optionalDependencies: darwin-arm64/x64, linux-arm64/arm64-musl/x64/x64-musl, win32-arm64/x64) update version, resolved, and integrity consistently to 2.1.263.
• No stray 2.1.259 references remain anywhere in the updated lockfile.
• action.yml is untouched by this diff — correct per this repo's convention, since the npm-tracked CLI dependency (used only by the investigate job's npx claude step) is separate from the SHA-pinned anthropics/claude-code-action Action dependency.
• The engines block in package.json is unrelated to and unchanged by this diff.
• No inline review comments exist on this PR.

Re-run note: This run is on the same head commit (9f681aa) as three prior APPROVED reviews from this bot — not a new push, so there is nothing stale to dismiss or resolve.

PR title and description are accurate and complete; no correction needed.

[github-actions]

🗜️ Headroom context compression

Metric	Value
Requests proxied	18
Tokens saved	61221
Aggregate savings	3.1% of all tokens sent
Average per-request compression	4.2%