chore(deps): update dependency @anthropic-ai/claude-code to v2.1.226

[renovate-fullsend]

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-code	2.1.223 → 2.1.226

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.226

Compare Source

• Bug fixes and reliability improvements

v2.1.225

Compare Source

• Added gateway spend-limit support to Claude Code's usage warning; the limit-reached message now names the cap, its reset time, and the operator's message (requires the gateway on 2.1.225)
• Added a workspace trust prompt to claude agents for untrusted directories, matching the behavior of claude
• Fixed a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, breaking headless sessions until restart
• Fixed MCP OAuth servers on macOS intermittently failing with a burst of 401 errors, as if never authenticated, after a keychain read timed out
• Fixed auto mode counting a safety-filter refusal of its own permission check toward the consecutive-block limit; the action is still denied, but the model is now told to move on rather than retry
• Fixed cross-session messages staying parked without a notice or expiry in headless sessions and during startup
• Fixed conversation history breaking on Remote Control session resume after very large conversations were compacted
• Fixed hovering over a session in another project in the agents list changing the directory the next agent starts in
• Fixed claude self-hosted-runner registering and then failing every session when --base-dir cannot be created or written; it now exits at startup with a clear error
• Fixed Claude Code on the web sessions being misreported as stuck, re-sending a growing event backlog on every reconnect
• Improved Remote Control: photos attached from the Claude app are now shown to Claude directly instead of being read from disk with a separate tool call
• [VSCode] Fixed Focus view folding away the latest to-do list, a pending question's context, and settled answers; thinking-only folds show "Thought for Ns" and re-collapse when their turn completes
• SendMessage can now start a conversation with your Remote Control sessions on other machines by name (ListAgents shows them as name [ref]), instead of only replying after they message you first
• SendMessage: a Remote Control recipient you already confirmed is never swapped for a same-named session on this machine when its own list couldn't be checked

v2.1.224

Compare Source

• Added self-hosted environments: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run, on Team and Enterprise plans
• Added archive plugin source: install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning
• Added a cancel-and-confirm step when removing an unavailable paste changes a command's text
• Added ANTHROPIC_BEDROCK_REGION_PREFIX env var for Bedrock to prefer a specific cross-region inference profile over the AWS_REGION-derived one
• Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
• Added sandbox credential-masking options: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing; these need network.tlsTerminate and are honored only from user, managed, or --settings settings
• Added cross-session SendMessage: Claude Code sessions can now message each other, on any of your machines, with ListAgents to discover them (macOS and Linux)
• Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list, rename, fork, delete and /resume no longer cross projects
• Fixed SendMessage reporting "Message sent" when the write to a teammate's inbox had actually failed; failed deliveries are now reported as errors
• Fixed sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") being silently bypassable on Linux and macOS
• Fixed sandbox violation details never appearing in Bash tool results; Claude now sees which file or network access was denied and why
• Fixed MCP tools that connect mid-turn being deferred for tool search without their names announced to the model
• Fixed plugin install records being silently corrupted when the same plugin is installed in multiple projects
• Fixed recalled or restored paste content occasionally attaching wrong data or silently losing text when the paste had aged out or placeholder numbers collided
• Fixed copy-on-select on Wayland sometimes not reaching the clipboard; the two selection writes no longer race
• Fixed the feedback survey's transcript share silently failing on long sessions; a failed share now shows an error instead of a success message
• Fixed Remote Control auto-start intermittently failing with "Remote credentials fetch failed" on a cold start with a stale login token
• Fixed Remote Control and SDK clients showing a blank "(no content)" message after /clear and other output-less commands
• Fixed a Remote Control session recreated after its server session expired uploading prior local conversation history into the new session
• Improved fullscreen mode to keep the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval
• Improved Remote Control: attached web and mobile clients now see compaction progress and the post-compaction boundary instead of a silent pause; /clear resets now propagate to attached clients
• Improved Remote Control: connection failures now show a persistent failure indicator with details and a reconnect shortcut, instead of only an 8-second toast
• Removed the 200-subagent-per-session spawn cap; long-running sessions no longer refuse new agents (concurrency and depth limits still apply)
• Changed managed settings: the approval prompt no longer re-appears after re-login or org switching when the organization's settings are unchanged
• Changed the feedback-survey transcript share: with your consent it now also uploads the last request's model settings — the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large
• Changed the Bash tool description to always note that command output is displayed to the model, not reliably to the user
• Changed recalled paste placeholder numbers to renumber when accepted into the input
• Changed Remote Control to archive the stale server session instead of leaving a dead one listed when a fresh session is minted after compaction or /resume
• [VSCode] Fixed the extension showing Remote Control as connected after the connection failed
• Fixed a session resume silently reconnecting Remote Control after the user turned it off (--resume, SDK hosts, and the VS Code extension)
• [VSCode] Fixed sessions not honoring remoteControlAtStartup when explicitly enabled

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:32 PM UTC · Completed 3:39 PM UTC

Commit: e10d912 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This file is under the images/ protected path. The PR has no linked issue providing authorization for modifying governance/infrastructure files. While this is a Renovate-managed dependency update (@anthropic-ai/claude-code 2.1.223 → 2.1.226) and renovate.json explicitly configures tracking of this ARG via a customManagers regex entry, human approval is always required for changes to protected paths.
  Remediation: A human reviewer should verify the version bump is appropriate and approve the change to this protected file.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] images/sandbox/Containerfile — This file is under the images/ protected path. The PR has no linked issue providing authorization for modifying governance/infrastructure files. While the PR description explains this is a Renovate-managed dependency update (@anthropic-ai/claude-code 2.1.223 → 2.1.224) and renovate.json explicitly configures tracking of this ARG via a customManagers regex entry, human approval is always required for changes to protected paths.
  Remediation: A human reviewer should verify the version bump is appropriate and approve the change to this protected file.

---

Labels: PR is a Renovate dependency update modifying the sandbox container image

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:44 AM UTC · Completed 3:51 AM UTC

Commit: 2d46e25 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] protected-path

This file is under the images/ protected path. The PR has no linked issue providing authorization for modifying governance/infrastructure files. While this is a Renovate-managed dependency update (@anthropic-ai/claude-code 2.1.223 → 2.1.226) and renovate.json explicitly configures tracking of this ARG via a customManagers regex entry, human approval is always required for changes to protected paths.

Suggested fix: A human reviewer should verify the version bump is appropriate and approve the change to this protected file.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:23 PM UTC · Completed 3:34 PM UTC

Commit: 2d46e25 · View workflow run →

[fullsend-ai-retro]

Retro: PR #6011 — Renovate @anthropic-ai/claude-code bump

PR #6011 was a single-line Renovate dependency bump (@anthropic-ai/claude-code 2.1.223 → 2.1.226) in images/sandbox/Containerfile. It generated 13 workflow runs (7 source-repo, 2 review, 4 fix, 1 retro) for a change that merged with zero human review.

Timeline

1. Aug 7 15:30 — Renovate opens PR, fullsend.yaml dispatches review.
2. Aug 7 15:38 — Review agent posts CHANGES_REQUESTED with a single [high] protected-path finding on images/sandbox/Containerfile. No code issues found.
3. Aug 7 15:39–15:46 — Fix agent dispatched twice (run 31193703111, run 31194303910). Both fail immediately at the eligibility gate ("Human-authored PR without fullsend-fix label").
4. Aug 8 03:43 — Renovate pushes updated commit (version bumped to 2.1.226). Second review dispatched.
5. Aug 8 03:51 — Review agent posts identical CHANGES_REQUESTED with the same [protected-path] finding.
6. Aug 8 03:51–04:01 — Fix agent dispatched twice more (run 31238131444, run 31238497071). Both fail at the same eligibility gate.
7. Aug 8 15:21 — PR merged by Renovate automerge with no human review, bypassing the CHANGES_REQUESTED status.

Analysis

This PR illustrates a well-documented pattern where protected-path governance findings on bot dependency PRs generate noise without enforcing governance. The review agent’s CHANGES_REQUESTED accomplished nothing: it couldn’t block Renovate’s automerge, and the fix agent was dispatched 4 times only to be rejected at the eligibility gate each time. The review agent also ran a second full review after Renovate rebased, producing identical findings on an unchanged diff.

A notable classification inconsistency exists: the dispatch layer treats Renovate as a bot-authored PR (dispatching fix unconditionally on CHANGES_REQUESTED), but the fix workflow’s eligibility check classifies Renovate as human-authored (rejecting without fullsend-fix label). This mismatch is the direct cause of the 4 wasted fix dispatches.

Existing issue coverage

All findings map to existing open issues. No new proposals are warranted.

• Review agent should use COMMENT instead of CHANGES_REQUESTED for governance-only findings on bot PRs #5369 — PR chore(deps): update dependency @anthropic-ai/claude-code to v2.1.226 #6011 provides fresh evidence: CHANGES_REQUESTED for a governance-only [protected-path] finding on a Renovate bot PR, which Renovate then bypassed at merge. Using COMMENT instead would have avoided both the fix dispatch chain and the misleading merge-block signal.
• Review agent should not file CHANGES_REQUESTED for governance-only findings that the fix agent cannot resolve #1068 — Same pattern as the original report (PR fix(dispatch): restore /fs- prefix on slash commands #1063): governance-only findings trigger CHANGES_REQUESTED that the fix agent cannot resolve.
• Skip fix dispatch at routing level for human-authored PRs without fullsend-fix label #5811 — PR chore(deps): update dependency @anthropic-ai/claude-code to v2.1.226 #6011 confirms the dispatch-level gap: 4 fix runs dispatched and immediately rejected at the eligibility gate, wasting CI runner time. The dispatch-vs-eligibility classification mismatch (Renovate = bot at dispatch, human at eligibility) is a specific instance of the routing-level check gap described in this issue.
• Review agent: downgrade protected-path severity for bot-authored dependency update PRs #2588 — The review agent’s own findings acknowledged this is a Renovate-managed dependency update, yet still rated [protected-path] as high severity. Downgrading severity for bot dependency PRs would have prevented the CHANGES_REQUESTED verdict.
• Review agent should avoid full re-reviews when Renovate rebases without content changes #4596 — The second review (Aug 8 03:51) produced identical findings to the first (Aug 7 15:38) on a content-unchanged Renovate rebase, confirming the re-review redundancy pattern.
• Define fix agent auto-triggering strategy with debounce to prevent redundant processing #5937 — The 4 fix dispatches across two review cycles (2 per cycle) show the lack of debounce in fix auto-triggering.