build(deps-dev): bump @anthropic-ai/claude-code from 2.1.259 to 2.1.276

[dependabot]

Bumps @anthropic-ai/claude-code from 2.1.259 to 2.1.276.

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.276

What's changed

• Fixed every request failing with 400 … Input tag 'advisor_20260301' when ANTHROPIC_BASE_URL points at a proxy or gateway (2.1.275 regression)

v2.1.275

What's changed

• Added the signed-in account to Claude apps gateway sign-in: when the gateway names it, you confirm it before the credential is saved, and /status shows it
• Added a send-now key (ctrl+enter, or ctrl+x ctrl+s) that interrupts the current turn and sends all queued messages at once; sent and queued messages show in gray until the model receives them
• Added a startup warning when a configured otelHeadersHelper fails, so sessions that silently export no telemetry are noticed
• Added syncing of the skills and plugins enabled on your claude.ai account to terminal sessions signed in with it; opt out with syncClaudeAiSkills: false or syncClaudeAiPlugins: false
• Added /plugin install <plugin> --marketplace <source>, which offers to add the marketplace before installing the plugin
• Fixed a restored memory file's age note changing between requests after a compaction or resume, which caused prompt cache misses
• Fixed --forward-subagent-text stream-json and SDK output dropping the messages of subagents spawned by a context: fork skill, and of forked skills invoked by a subagent or another forked skill
• Fixed @-mention file suggestions being buried below MCP resources when using a custom fileSuggestion command or typing @./@./
• Fixed fullscreen mode placing background-task completion notices beneath a long turn's collapsed tool row instead of where they arrived; each notice now closes the open row
• Fixed claude plugin marketplace update deleting a GitHub marketplace's local copy when the fetch failed and the marketplace was named after its repository
• Fixed plugin and marketplace messages, logs and claude plugin marketplace list showing a password or token stored in a git, ssh or marketplace URL
• Fixed a resumed cloud session leaving an unanswered question open in the transcript after a queued message superseded it
• Fixed vim mode placing the cursor one character right after a dot-repeated "!" or a fast-typed "i!" switched a non-empty prompt into shell mode
• Fixed fullscreen mode freezing or blanking for several seconds when scrolling up past a large file diff
• Fixed a stray </ccmemory>-style closing tag occasionally appearing in responses
• Fixed plugin messages, logs and the VS Code plugin dialog showing the wrong server for some git addresses
• Fixed a terminal API Error: 400 on every turn for users behind a network gateway that rewrites API error responses when a beta request header is rejected
• Fixed sandboxed Bash commands on Linux reporting exit code 0 for failed commands when the shell is zsh
• Fixed the Read tool hanging instead of reporting an error when part of a large file could not be decoded under memory pressure
• Fixed --resume, the resume picker preview, resumed background agents and the transcript view failing on a session whose saved history contains a malformed task-reminder or @-file attachment entry
• Fixed a crash when resuming a conversation whose transcript contains a malformed message entry, and a fullscreen crash when such a conversation received new messages while scrolled up
• Fixed sessions failing to resume or start when their saved transcript contains a malformed message content block
• Fixed Grep, Glob and @-file suggestions hanging or running out of memory on searches over the 20MB output cap, and system ripgrep reporting "no matches" instead of an error after a flood of warnings
• Fixed /rewind in a forked or background session restoring a zero-filled or truncated file when the session's file-history backups could not be fully copied
• Fixed fullscreen sessions sometimes exiting with "Claude Code exited after an unrecoverable interface error" when typing fast or holding a key with the slash-command dropdown open
• Fixed background sessions crashing and restarting their worker when a command fed through stdin ran on a machine that had run out of file descriptors
• Fixed a crash at launch when ~/.claude.json holds a malformed mcpNeedsAuthNoticed value
• Fixed --resume and --continue dropping a conversation's earlier thinking when a built-in tool it started with has since been switched off by a server-side flag
• Fixed text selected with the mouse in the fullscreen claude --resume session picker never reaching the clipboard
• Fixed plugin reload previews replacing a running session's extracted plugin files when the plugin was loaded from a --plugin-dir or --plugin-url archive
• Fixed self-hosted runners with --drain-wait-sec losing the final result of a turn that finished during a SIGTERM drain; the runner now waits briefly for the turn to be reported
• Fixed SubagentStop hooks with a specific matcher firing for every stopping subagent whose agent type was empty
• Fixed sandboxed Bash commands being unable to write to project directories named hooks/ or config/
• Fixed Artifact updates failing with "File not found" after a session resumes on another machine or its scratchpad is cleared: the page's last published version is restored
• Fixed /update-config writing Write(path) permission rules, which file permission checks don't match, instead of Edit(path) rules
• Fixed four dead documentation URLs (Pricing, Computer Use, Skills, CLI) in the bundled claude-api skill's live-sources table
• Improved prompt caching for a --system-prompt that contains a __SYSTEM_PROMPT_DYNAMIC_BOUNDARY__ line: the text above it is now cached globally, as the SDK's array form already is
• Improved the /desktop error when Claude Desktop does not open: it now says why and what to do next
• Improved the Artifact tool's publish and read results: they now say who can open the page and what the owner's Share menu offers
• Improved artifact publish results: they name the tab icon sent, warn when the page contains a NUL byte, and retry a flaky fetch of the newer page to merge after a stale publish
• Improved pasted and attached images: they are now saved where Claude can open them as files without a permission prompt, including in Desktop and VS Code
• Improved the Artifact tool's guidance so Claude updates a shared artifact in place when you were given edit access to it, instead of publishing a separate copy

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.276

• Fixed every request failing with 400 … Input tag 'advisor_20260301' when ANTHROPIC_BASE_URL points at a proxy or gateway (2.1.275 regression)

2.1.275

• Added the signed-in account to Claude apps gateway sign-in: when the gateway names it, you confirm it before the credential is saved, and /status shows it
• Added a send-now key (ctrl+enter, or ctrl+x ctrl+s) that interrupts the current turn and sends all queued messages at once; sent and queued messages show in gray until the model receives them
• Added a startup warning when a configured otelHeadersHelper fails, so sessions that silently export no telemetry are noticed
• Added syncing of the skills and plugins enabled on your claude.ai account to terminal sessions signed in with it; opt out with syncClaudeAiSkills: false or syncClaudeAiPlugins: false
• Added /plugin install <plugin> --marketplace <source>, which offers to add the marketplace before installing the plugin
• Fixed a restored memory file's age note changing between requests after a compaction or resume, which caused prompt cache misses
• Fixed --forward-subagent-text stream-json and SDK output dropping the messages of subagents spawned by a context: fork skill, and of forked skills invoked by a subagent or another forked skill
• Fixed @-mention file suggestions being buried below MCP resources when using a custom fileSuggestion command or typing @./@./
• Fixed fullscreen mode placing background-task completion notices beneath a long turn's collapsed tool row instead of where they arrived; each notice now closes the open row
• Fixed claude plugin marketplace update deleting a GitHub marketplace's local copy when the fetch failed and the marketplace was named after its repository
• Fixed plugin and marketplace messages, logs and claude plugin marketplace list showing a password or token stored in a git, ssh or marketplace URL
• Fixed a resumed cloud session leaving an unanswered question open in the transcript after a queued message superseded it
• Fixed vim mode placing the cursor one character right after a dot-repeated "!" or a fast-typed "i!" switched a non-empty prompt into shell mode
• Fixed fullscreen mode freezing or blanking for several seconds when scrolling up past a large file diff
• Fixed a stray </ccmemory>-style closing tag occasionally appearing in responses
• Fixed plugin messages, logs and the VS Code plugin dialog showing the wrong server for some git addresses
• Fixed a terminal API Error: 400 on every turn for users behind a network gateway that rewrites API error responses when a beta request header is rejected
• Fixed sandboxed Bash commands on Linux reporting exit code 0 for failed commands when the shell is zsh
• Fixed the Read tool hanging instead of reporting an error when part of a large file could not be decoded under memory pressure
• Fixed --resume, the resume picker preview, resumed background agents and the transcript view failing on a session whose saved history contains a malformed task-reminder or @-file attachment entry
• Fixed a crash when resuming a conversation whose transcript contains a malformed message entry, and a fullscreen crash when such a conversation received new messages while scrolled up
• Fixed sessions failing to resume or start when their saved transcript contains a malformed message content block
• Fixed Grep, Glob and @-file suggestions hanging or running out of memory on searches over the 20MB output cap, and system ripgrep reporting "no matches" instead of an error after a flood of warnings
• Fixed /rewind in a forked or background session restoring a zero-filled or truncated file when the session's file-history backups could not be fully copied
• Fixed fullscreen sessions sometimes exiting with "Claude Code exited after an unrecoverable interface error" when typing fast or holding a key with the slash-command dropdown open
• Fixed background sessions crashing and restarting their worker when a command fed through stdin ran on a machine that had run out of file descriptors
• Fixed a crash at launch when ~/.claude.json holds a malformed mcpNeedsAuthNoticed value
• Fixed --resume and --continue dropping a conversation's earlier thinking when a built-in tool it started with has since been switched off by a server-side flag
• Fixed text selected with the mouse in the fullscreen claude --resume session picker never reaching the clipboard
• Fixed plugin reload previews replacing a running session's extracted plugin files when the plugin was loaded from a --plugin-dir or --plugin-url archive
• Fixed self-hosted runners with --drain-wait-sec losing the final result of a turn that finished during a SIGTERM drain; the runner now waits briefly for the turn to be reported
• Fixed SubagentStop hooks with a specific matcher firing for every stopping subagent whose agent type was empty
• Fixed sandboxed Bash commands being unable to write to project directories named hooks/ or config/
• Fixed Artifact updates failing with "File not found" after a session resumes on another machine or its scratchpad is cleared: the page's last published version is restored
• Fixed /update-config writing Write(path) permission rules, which file permission checks don't match, instead of Edit(path) rules
• Fixed four dead documentation URLs (Pricing, Computer Use, Skills, CLI) in the bundled claude-api skill's live-sources table
• Improved prompt caching for a --system-prompt that contains a __SYSTEM_PROMPT_DYNAMIC_BOUNDARY__ line: the text above it is now cached globally, as the SDK's array form already is
• Improved the /desktop error when Claude Desktop does not open: it now says why and what to do next
• Improved the Artifact tool's publish and read results: they now say who can open the page and what the owner's Share menu offers
• Improved artifact publish results: they name the tab icon sent, warn when the page contains a NUL byte, and retry a flaky fetch of the newer page to merge after a stale publish
• Improved pasted and attached images: they are now saved where Claude can open them as files without a permission prompt, including in Desktop and VS Code
• Improved the Artifact tool's guidance so Claude updates a shared artifact in place when you were given edit access to it, instead of publishing a separate copy
• Improved plan-usage reads: editor windows and non-interactive sessions on one machine now share a read made in the last minute instead of each calling the usage endpoint
• Improved the ListPlugins tool description so Claude knows it lists plugins enabled on your claude.ai account, not plugins installed locally with /plugin

... (truncated)

Commits

• 31a3b00 chore: Update CHANGELOG.md and feed.xml
• 3803596 chore: Update CHANGELOG.md and feed.xml
• 68ac8bb chore: Update CHANGELOG.md and feed.xml
• 744fb6a diff: the prompt hint reads the viewport's layout through a type that may lac...
• b782847 diff: the first edit opens the pane only where the layout docks it (#94653)
• 7dd0636 diff: run git when the built-in panel would, never at the session's start (#9...
• aad35ba chore: Update CHANGELOG.md and feed.xml
• f96c3b4 chore: Update CHANGELOG.md and feed.xml
• f2ccbe2 chore: Update CHANGELOG.md and feed.xml
• f4ceeec Merge pull request #94184 from anthropics/poteat/diff-parity-2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Nothing blocking. This is a mechanical Dependabot devDependency bump of @anthropic-ai/claude-code (2.1.259 → 2.1.276) with matching package-lock.json updates — only these two files change, no behavioural code touched. This is the npm-tracked CLI pin the investigate job itself uses (see CLAUDE.md's "Automated upstream bumps" section), not the pinned anthropics/claude-code-action SHA, so no action.yml adaptation is expected here. Title and description are Dependabot's own accurate, complete content — nothing to rewrite.

[github-actions]

🗜️ Headroom context compression

Metric	Value
Requests proxied	12
Tokens saved	31521
Aggregate savings	3.2% of all tokens sent
Average per-request compression	4.5%

[dependabot]

Superseded by #105.