Cloonar/coding-lab

Fork 0

chore(agent-tools): bump the Claude Code pin 2.1.221 → 2.1.222 — worktree-isolation + PreToolUse hook-bypass fixes; compat re-verification [schedule: Daily agent update check] #290

New issue

Open

opened 2026-08-05 04:08:19 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-05 04:08:19 +02:00

Owner

Goal

Move the agent-tools Claude Code pin from 2.1.221 to 2.1.222 (one release, published 2026-08-04T20:37:17Z), re-verifying the compat record first, exactly as containers/agent-tools/versions.env and docs/ops.md § "Agent-tools images" mandate:

BEFORE bumping a version here, re-verify the compat record against the new CLI version FIRST (the compat doc is the checklist), THEN move the version + sha256 together. A bump that skips the re-verification ships an unverified CLI under a pin that claims verification.

This is a one-release bump, and internal/compat/compat.md was fully re-verified against 2.1.221 only yesterday (2026-08-04, via #235/#273 — the first bump whose live gate was actually run). So the baseline is fresh and the diff is small. The re-verification is still the work; the two-line versions.env edit is the trivial part.

Two of 2.1.222's fixes are permission/isolation fixes that land squarely on lab's spawn posture (--permission-mode auto, unattended, per-run injected hooks, sessions running in linked git worktrees). Those are the reason to take this bump, and they are also the two items most likely to change behaviour under us.

Evidence — current state

containers/agent-tools/versions.env:21-22:

CLAUDE_CODE_VERSION=2.1.221
CLAUDE_CODE_SHA256_X64_MUSL=15b068e06eafff9b64583b46cdc065ac18b0d0d13950c2a83c6ee854f301a32f

internal/compat/compat.md:3:

Pinned version: **Claude Code 2.1.221** — bundle extraction + CLI probes +
the **live tmux recipe suite**, 2026-08-04 (see the 2.1.221 re-verification
note below).

Upstream, checked 2026-08-05:

$ curl -s https://registry.npmjs.org/@anthropic-ai/claude-code   # dist-tags
{'stable': '2.1.220', 'latest': '2.1.222', 'next': '2.1.222'}

  2.1.219  2026-07-24T16:11:49Z
  2.1.220  2026-07-24T23:11:21Z
  2.1.221  2026-08-03T22:16:25Z   <- currently pinned
  2.1.222  2026-08-04T20:37:17Z   <- the target

Note the stable dist-tag still lags at 2.1.220. latest is the tag this repo tracks — #273 took 2.1.221 on exactly that basis while stable was already 2.1.220 — so 2.1.222 is the target. If the implementing agent decides the repo should switch to following stable instead, that is a separate decision: say so on this issue rather than silently pinning a different version.

New pin values

CLAUDE_CODE_VERSION=2.1.222
CLAUDE_CODE_SHA256_X64_MUSL=e0b0fb4005e1ac0ebcee136254c638722f1c49e171a23d0843c605d72aac9029

Source — Anthropic's per-version manifest, which is exactly what the versions.env comment names as the authority and what containers/agent-tools/build.sh:62-65 verifies the download against:

$ curl -s https://downloads.claude.ai/claude-code-releases/2.1.222/manifest.json
  "version": "2.1.222",
  "commit":  "fbf49312c28437bf9c2546b9ace3bd7b34eb6ff6",
  "buildDate": "2026-08-04T01:46:04Z",
  "platforms": { "linux-x64-musl": {
      "binary":   "claude",
      "checksum": "e0b0fb4005e1ac0ebcee136254c638722f1c49e171a23d0843c605d72aac9029",
      "size":     284074576 } }

This method was validated before quoting it: the same manifest field for 2.1.221 returns 15b068e0…f301a32f, byte-identical to what versions.env pins today. Re-derive the digest yourself from the downloaded artifact anyway (build.sh does this automatically) — do not trust this issue as the sole source.

The fetch URL build.sh:62-65 uses is unchanged: https://downloads.claude.ai/claude-code-releases/${CLAUDE_CODE_VERSION}/linux-x64-musl/claude.

Security / safety fixes in this release — these DO reach us

The claude binary ships into every container instance (agent-tools:claude-<ver>, ADR-0051) and lab spawns it unattended with --permission-mode auto (compat §1). The permission classifier is therefore the only guard and nobody is watching it — that is the standing reason this repo treats permission fixes as reaching it, recorded in §1 for the 2.1.221 bump.

1. Worktree isolation no longer leaks to the main checkout.

"Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type"

Every lab instance runs with cwd set to a linked git worktree whose .git is a file pointing at the reference repo's bare clone (internal/gitx). Lab does not itself invoke Claude Code's own worktree-isolation feature — but AFK runs spawned with the ultracode option (compat §1, spec.Options) do run multi-agent subagents, and Claude Code's Agent tool takes isolation: "worktree". On 2.1.221 such a subagent could run destructive git against the main checkout; on 2.1.222 it cannot. This is the single best reason to take the bump.

It is also the highest-risk item in the other direction — see the §1/§12 verification note below.

2. PreToolUse auto-allow hooks no longer bypass tool restrictions.

"Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)"

lab injects a PreToolUse hook into every run via a per-run --settings file (compat §9, internal/provider/claudecode/dialogspool.go). Reachability assessment, written down so the next sweep does not re-derive it: lab's own hook cannot be the bypass vector — §9 pins it as purely observational, it exits 0 with no stdout and never emits permissionDecision:"allow" or exit code 2. The fixed bug is about hooks that do auto-allow. So this fix does not close a hole lab opened; it hardens a path lab's hook shares. The reason it still matters here is the inverse: the PreToolUse evaluation path was touched in background agent tasks (summaries, compaction, renames), and §9's dialog capture depends on that hook firing reliably. Re-verify §9 rather than assume.

3. Auto-mode SendMessage now goes through the permission classifier.

"Improved auto mode safety: messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch"

lab spawns --permission-mode auto for unattended runs. Defence in depth on the cross-session dispatch path. No lab-side change expected.

No CVE is claimed for any of these; they are safety/permission fixes, not advisories. Recorded at that weight deliberately.

What changed that touches how this repo uses Claude Code

Each item maps to a numbered section of internal/compat/compat.md. These are hypotheses to verify, not confirmed breaks — none was observed against a live 2.1.222 binary during this investigation.

§1 Spawn argv + §12 no---remote-control arm — the highest-risk item.

The worktree-isolation broadening ("isolation now applies to file edits and Bash in every session type") is the one item that could break us rather than help us. Every lab session's cwd is a linked worktree. If 2.1.222 classifies an ordinary lab session as "worktree-isolated" and starts restricting Bash or file edits against paths outside it, AFK runs that git commit/git push to the bare origin would newly fail or prompt. Verify this first: spawn a real session in a lab-shaped linked worktree and confirm a normal commit + push still runs with no prompt. If it reproduces, this bump is blocked — report the drift here rather than working around it.
"Changed Remote Control auto-start so repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer turn it on (they can still turn it off); enable it at user scope via /config." Expected to be a no-op for lab: --remote-control is passed as an explicit CLI flag (§1, a lab-gated knob, default OFF since #163), never via settings, and the per-run --settings file lab writes carries only hooks + env (§9/§11). Confirm the explicit flag still attaches the bridge (§2 deep-link capture is what would go quiet if not). This repo's committed .claude/settings.local.json is {"enableAllProjectMcpServers": true} — nothing remote-control-related, so nothing to migrate.

§9 Dialog-capture hook contract — see security item 2. Re-confirm: the settings hooks shape still merges additively via --settings, the three payload field names are unchanged, and the observational exit-0 contract still lets the tool proceed. TestCompat_HookPayload_maps guards the payload mapping; the merge semantics and live firing are the by-hand part.

§10 Builtin slash-command catalog — "Removed ultraplan feature".

Checked against the pinned table already: ultraplan is not one of the 33 pinned rows (grep -rn ultraplan over this repo returns zero hits), so the removal needs no commands.go edit. It does mean the 2.1.221 registry's 105-row count should drop — useful as a sanity check that your extractor is reading the new bundle and not a cached one.
Two 2.1.222 items change behaviour behind rows that are pinned and chat-safe, without necessarily moving their description strings — exactly the case §10's 2.1.221 note calls out for /status. Check both by the reverse-grep method §10 mandates (take each pinned string, grep the raw binary for it), not a forward description:"…" regex: /usage ("Fixed /usage overattributing usage to MCP servers") and /diff-adjacent rendering ("Improved the /diff view, the Remote Control workspace diff, and file-edit diffs … to use raw git blob content, ignoring workspace-configured diff drivers and textconv").
Also re-check the three descriptions the 2.1.221 pass just corrected (doctor, feedback, usage-credits) — they were freshly re-pinned yesterday, so any movement here is real drift and not the known pre-existing miss. Remember doctor pins menuDescription, not description.

§5 Transcript location + JSONL schema — "Fixed 'Connection closed mid-response' errors being reported on responses that had actually completed" and "Fixed tool errors not being displayed for tools no longer available locally". Both change what error/result entries land in the rollout JSONL that lab parses as the chat transcript. ParseRollout/ReadChat must keep degrading gracefully on unknown entry shapes. Fixture updates only if the grammar genuinely moved.

§6/§7/§8 Reply, dialog, and interrupt recipes — nothing in the 2.1.222 changelog names the TUI composer, the AskUserQuestion/ExitPlanMode pickers, or key handling. Expected clean. Re-drive the automated suite anyway (it is one command, below) — that is what makes "green" mean "no drift".

Model/effort seam (D14, ADR-0043) — "Fixed org-restricted model: opus-style subagent and teammate family aliases dropping to the parent model instead of stepping down to the newest org-allowed model in the family" and "Fixed the spinner's effort label in a subagent's transcript view showing the session's effort level instead of the subagent's own effort: setting". lab passes --model M / --effort E explicitly (§1) and owns its catalogs provider-side, so no lab change is expected. Note in the compat record if the claude debug-side catalog output moved.

Skills — "Improved the refusal when Claude tries to invoke a skill with disable-model-invocation: Claude is now told to ask you to run the skill instead of replicating its workflow." Three repo-shipped skills set that flag (.claude/skills/zoom-out, setup-matt-pocock-skills, grill-with-docs). Behaviour-only, no lab surface. Noted, not a gate.

Build/CI — no change needed. build.sh's downloads.claude.ai URL and manifest-digest flow are unchanged, and the egress list in docs/ops.md § Agent-tools images still holds.

Scope — files an implementing agent will touch

Path	Change
`containers/agent-tools/versions.env`	`CLAUDE_CODE_VERSION` + `CLAUDE_CODE_SHA256_X64_MUSL`, moved atomically with the compat-record update
`internal/compat/compat.md`	Pin header → 2.1.222; per-section provenance re-dated to what was actually re-verified; every drift found recorded in its own section; add a `2.1.222` note under §10 like the existing 2.1.220/2.1.221 ones
`internal/provider/claudecode/commands.go`	Only if the §10 re-scrape shows drift. `ultraplan` needs no edit — it was never pinned.
`internal/provider/claudecode/*.go` + `testdata/`	Only if re-verification finds real drift. No port change is expected; if you find yourself rewriting the adapter, stop and report here instead

nix/module.nix needs no edit — container.toolsImages derives its default tag from versions.env at eval time (nix/module.nix:197-213, docs/ops.md option table).

Done means

Live compat probes pass against a real 2.1.222 binary, and the -v output shows they RAN (every one carries its own skip-gate; a skipped run is not a pass):
LAB_COMPAT_LIVE=1 go test ./internal/compat/ -run Live -v
Per the §"Live re-verification" instruction, the recipe suite is driven against the outgoing 2.1.221 binary first and then 2.1.222, and the two are diffed — so "green" means "no drift" rather than "green for some other reason". Six tests, zero skips, on both.
§1 worktree posture confirmed live (the blocking check): a session spawned with cwd = a lab-shaped linked worktree still runs git commit and git push to the bare origin under --permission-mode auto with no new prompt or refusal.
§9 confirmed live: the per-run --settings hooks block still merges additively, PreToolUse still fires for AskUserQuestion|ExitPlanMode, the spool still lands, and the observational exit-0 contract still lets the tool proceed.
§10 re-scraped from the sha256-verified 2.1.222 linux-x64-musl artifact using §10's reverse-grep method, A/B'd against 2.1.220/2.1.221 with the same extractor. All 33 pinned rows present, argHints verbatim, doctor's menuDescription re-checked.
§3b credential-refresh trigger re-verified by hand per its recipe (no automated test exists — it rotates a real OAuth family).
go test ./... green (hermetic).
golangci-lint run clean.
Version + sha256 + compat-record land in one commit.
The agent-tools CI gate (path-gated on containers/**) builds the claude image and passes the injection smoke test on the PR — locally reproducible with
containers/agent-tools/build.sh claude && containers/agent-tools/smoke-test.sh claude.
PR body says Closes #<this issue>.

Out of scope

The codex pin — CODEX_VERSION=0.133.0 → 0.146.0 is tracked on #249 and is a much larger re-verification. Do not fold it in here.
Go module updates — tracked on #250.
The gemini seam (versions.env:28-30) — still deferred to #126.
Any adapter feature work the new version enables. Record what you observe in the compat record, file follow-ups, do not build.
Curating the standing 72-row §10 catalog gap (pre-existing, deliberately left standing — see §10's own note).

Filed by the Daily agent update check schedule, 2026-08-05. Release notes quoted verbatim from anthropics/claude-code CHANGELOG.md § 2.1.222; versions from the npm registry @anthropic-ai/claude-code; digest from downloads.claude.ai/claude-code-releases/2.1.222/manifest.json, with the method validated against the 2.1.221 pin this repo already carries.

## Goal Move the agent-tools **Claude Code** pin from `2.1.221` to **`2.1.222`** (one release, published 2026-08-04T20:37:17Z), re-verifying the compat record first, exactly as `containers/agent-tools/versions.env` and `docs/ops.md § "Agent-tools images"` mandate: > BEFORE bumping a version here, re-verify the compat record against the new CLI version FIRST (the compat doc is the checklist), THEN move the version + sha256 together. A bump that skips the re-verification ships an unverified CLI under a pin that claims verification. This is a **one-release** bump, and `internal/compat/compat.md` was fully re-verified against 2.1.221 only yesterday (2026-08-04, via #235/#273 — the first bump whose live gate was actually run). So the baseline is fresh and the diff is small. **The re-verification is still the work**; the two-line `versions.env` edit is the trivial part. Two of 2.1.222's fixes are permission/isolation fixes that land squarely on lab's spawn posture (`--permission-mode auto`, unattended, per-run injected hooks, sessions running in linked git worktrees). Those are the reason to take this bump, and they are also the two items most likely to *change* behaviour under us. ## Evidence — current state `containers/agent-tools/versions.env:21-22`: ``` CLAUDE_CODE_VERSION=2.1.221 CLAUDE_CODE_SHA256_X64_MUSL=15b068e06eafff9b64583b46cdc065ac18b0d0d13950c2a83c6ee854f301a32f ``` `internal/compat/compat.md:3`: ``` Pinned version: **Claude Code 2.1.221** — bundle extraction + CLI probes + the **live tmux recipe suite**, 2026-08-04 (see the 2.1.221 re-verification note below). ``` Upstream, checked 2026-08-05: ``` $ curl -s https://registry.npmjs.org/@anthropic-ai/claude-code # dist-tags {'stable': '2.1.220', 'latest': '2.1.222', 'next': '2.1.222'} 2.1.219 2026-07-24T16:11:49Z 2.1.220 2026-07-24T23:11:21Z 2.1.221 2026-08-03T22:16:25Z <- currently pinned 2.1.222 2026-08-04T20:37:17Z <- the target ``` Note the `stable` dist-tag still lags at `2.1.220`. **`latest` is the tag this repo tracks** — #273 took `2.1.221` on exactly that basis while `stable` was already `2.1.220` — so `2.1.222` is the target. If the implementing agent decides the repo should switch to following `stable` instead, that is a separate decision: say so on this issue rather than silently pinning a different version. ## New pin values ``` CLAUDE_CODE_VERSION=2.1.222 CLAUDE_CODE_SHA256_X64_MUSL=e0b0fb4005e1ac0ebcee136254c638722f1c49e171a23d0843c605d72aac9029 ``` Source — Anthropic's per-version manifest, which is exactly what the `versions.env` comment names as the authority and what `containers/agent-tools/build.sh:62-65` verifies the download against: ``` $ curl -s https://downloads.claude.ai/claude-code-releases/2.1.222/manifest.json "version": "2.1.222", "commit": "fbf49312c28437bf9c2546b9ace3bd7b34eb6ff6", "buildDate": "2026-08-04T01:46:04Z", "platforms": { "linux-x64-musl": { "binary": "claude", "checksum": "e0b0fb4005e1ac0ebcee136254c638722f1c49e171a23d0843c605d72aac9029", "size": 284074576 } } ``` **This method was validated before quoting it**: the same manifest field for `2.1.221` returns `15b068e0…f301a32f`, byte-identical to what `versions.env` pins today. Re-derive the digest yourself from the downloaded artifact anyway (`build.sh` does this automatically) — do not trust this issue as the sole source. The fetch URL `build.sh:62-65` uses is unchanged: `https://downloads.claude.ai/claude-code-releases/${CLAUDE_CODE_VERSION}/linux-x64-musl/claude`. ## Security / safety fixes in this release — these DO reach us The `claude` binary ships into every container instance (`agent-tools:claude-<ver>`, ADR-0051) and lab spawns it **unattended** with `--permission-mode auto` (compat §1). The permission classifier is therefore the only guard and nobody is watching it — that is the standing reason this repo treats permission fixes as reaching it, recorded in §1 for the 2.1.221 bump. **1. Worktree isolation no longer leaks to the main checkout.** > *"Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type"* Every lab instance runs with cwd set to a **linked git worktree** whose `.git` is a file pointing at the reference repo's bare clone (`internal/gitx`). Lab does not itself invoke Claude Code's own worktree-isolation feature — but AFK runs spawned with the `ultracode` option (compat §1, `spec.Options`) do run multi-agent subagents, and Claude Code's Agent tool takes `isolation: "worktree"`. On 2.1.221 such a subagent could run destructive git against the main checkout; on 2.1.222 it cannot. **This is the single best reason to take the bump.** It is also the highest-risk item in the other direction — see the §1/§12 verification note below. **2. PreToolUse auto-allow hooks no longer bypass tool restrictions.** > *"Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)"* lab injects a `PreToolUse` hook into every run via a per-run `--settings` file (compat §9, `internal/provider/claudecode/dialogspool.go`). Reachability assessment, written down so the next sweep does not re-derive it: **lab's own hook cannot be the bypass vector** — §9 pins it as *purely observational*, it exits 0 with no stdout and never emits `permissionDecision:"allow"` or exit code 2. The fixed bug is about hooks that *do* auto-allow. So this fix does not close a hole lab opened; it hardens a path lab's hook shares. The reason it still matters here is the inverse: the PreToolUse evaluation path was touched in background agent tasks (summaries, compaction, renames), and §9's dialog capture depends on that hook firing reliably. Re-verify §9 rather than assume. **3. Auto-mode `SendMessage` now goes through the permission classifier.** > *"Improved auto mode safety: messages sent to other agent sessions via `SendMessage` are now evaluated by the permission classifier before dispatch"* lab spawns `--permission-mode auto` for unattended runs. Defence in depth on the cross-session dispatch path. No lab-side change expected. No CVE is claimed for any of these; they are safety/permission fixes, not advisories. Recorded at that weight deliberately. ## What changed that touches how this repo uses Claude Code Each item maps to a numbered section of `internal/compat/compat.md`. These are **hypotheses to verify**, not confirmed breaks — none was observed against a live 2.1.222 binary during this investigation. **§1 Spawn argv + §12 no-`--remote-control` arm — the highest-risk item.** - The worktree-isolation broadening (*"isolation now applies to file edits and Bash in every session type"*) is the one item that could **break** us rather than help us. Every lab session's cwd is a linked worktree. If 2.1.222 classifies an ordinary lab session as "worktree-isolated" and starts restricting Bash or file edits against paths outside it, AFK runs that `git commit`/`git push` to the bare origin would newly fail or prompt. **Verify this first**: spawn a real session in a lab-shaped linked worktree and confirm a normal commit + push still runs with no prompt. If it reproduces, this bump is blocked — report the drift here rather than working around it. - *"Changed Remote Control auto-start so repo-local settings (`.claude/settings.json` or `.claude/settings.local.json`) can no longer turn it on (they can still turn it off); enable it at user scope via `/config`."* Expected to be a no-op for lab: `--remote-control` is passed as an explicit **CLI flag** (§1, a lab-gated knob, default OFF since #163), never via settings, and the per-run `--settings` file lab writes carries only `hooks` + `env` (§9/§11). Confirm the explicit flag still attaches the bridge (§2 deep-link capture is what would go quiet if not). This repo's committed `.claude/settings.local.json` is `{"enableAllProjectMcpServers": true}` — nothing remote-control-related, so nothing to migrate. **§9 Dialog-capture hook contract** — see security item 2. Re-confirm: the settings `hooks` shape still merges additively via `--settings`, the three payload field names are unchanged, and the observational exit-0 contract still lets the tool proceed. `TestCompat_HookPayload_maps` guards the payload mapping; the merge semantics and live firing are the by-hand part. **§10 Builtin slash-command catalog** — *"Removed ultraplan feature"*. - Checked against the pinned table already: `ultraplan` is **not** one of the 33 pinned rows (`grep -rn ultraplan` over this repo returns zero hits), so the removal needs **no** `commands.go` edit. It does mean the 2.1.221 registry's 105-row count should drop — useful as a sanity check that your extractor is reading the new bundle and not a cached one. - Two 2.1.222 items change *behaviour* behind rows that are pinned and chat-safe, without necessarily moving their description strings — exactly the case §10's 2.1.221 note calls out for `/status`. Check both **by the reverse-grep method** §10 mandates (take each pinned string, grep the raw binary for it), not a forward `description:"…"` regex: `/usage` (*"Fixed `/usage` overattributing usage to MCP servers"*) and `/diff`-adjacent rendering (*"Improved the `/diff` view, the Remote Control workspace diff, and file-edit diffs … to use raw git blob content, ignoring workspace-configured diff drivers and textconv"*). - Also re-check the three descriptions the 2.1.221 pass just corrected (`doctor`, `feedback`, `usage-credits`) — they were freshly re-pinned yesterday, so any movement here is real drift and not the known pre-existing miss. Remember `doctor` pins `menuDescription`, not `description`. **§5 Transcript location + JSONL schema** — *"Fixed 'Connection closed mid-response' errors being reported on responses that had actually completed"* and *"Fixed tool errors not being displayed for tools no longer available locally"*. Both change what error/result entries land in the rollout JSONL that lab parses as the chat transcript. `ParseRollout`/`ReadChat` must keep degrading gracefully on unknown entry shapes. Fixture updates only if the grammar genuinely moved. **§6/§7/§8 Reply, dialog, and interrupt recipes** — nothing in the 2.1.222 changelog names the TUI composer, the `AskUserQuestion`/`ExitPlanMode` pickers, or key handling. Expected clean. Re-drive the automated suite anyway (it is one command, below) — that is what makes "green" mean "no drift". **Model/effort seam (D14, ADR-0043)** — *"Fixed org-restricted `model: opus`-style subagent and teammate family aliases dropping to the parent model instead of stepping down to the newest org-allowed model in the family"* and *"Fixed the spinner's effort label in a subagent's transcript view showing the session's effort level instead of the subagent's own `effort:` setting"*. lab passes `--model M` / `--effort E` explicitly (§1) and owns its catalogs provider-side, so no lab change is expected. Note in the compat record if the `claude debug`-side catalog output moved. **Skills** — *"Improved the refusal when Claude tries to invoke a skill with `disable-model-invocation`: Claude is now told to ask you to run the skill instead of replicating its workflow."* Three repo-shipped skills set that flag (`.claude/skills/zoom-out`, `setup-matt-pocock-skills`, `grill-with-docs`). Behaviour-only, no lab surface. Noted, not a gate. **Build/CI** — no change needed. `build.sh`'s `downloads.claude.ai` URL and manifest-digest flow are unchanged, and the egress list in `docs/ops.md § Agent-tools images` still holds. ## Scope — files an implementing agent will touch | Path | Change | |---|---| | `containers/agent-tools/versions.env` | `CLAUDE_CODE_VERSION` + `CLAUDE_CODE_SHA256_X64_MUSL`, moved **atomically with the compat-record update** | | `internal/compat/compat.md` | Pin header → 2.1.222; per-section provenance re-dated to what was actually re-verified; every drift found recorded in its own section; add a `2.1.222` note under §10 like the existing 2.1.220/2.1.221 ones | | `internal/provider/claudecode/commands.go` | Only if the §10 re-scrape shows drift. **`ultraplan` needs no edit — it was never pinned.** | | `internal/provider/claudecode/*.go` + `testdata/` | Only if re-verification finds real drift. **No port change is expected**; if you find yourself rewriting the adapter, stop and report here instead | `nix/module.nix` needs **no** edit — `container.toolsImages` derives its default tag from `versions.env` at eval time (`nix/module.nix:197-213`, `docs/ops.md` option table). ## Done means - [ ] Live compat probes pass against a real 2.1.222 binary, and the `-v` output shows they **RAN** (every one carries its own skip-gate; a skipped run is not a pass): `LAB_COMPAT_LIVE=1 go test ./internal/compat/ -run Live -v` - [ ] Per the §"Live re-verification" instruction, the recipe suite is driven against the **outgoing 2.1.221** binary first and then 2.1.222, and the two are diffed — so "green" means "no drift" rather than "green for some other reason". Six tests, zero skips, on both. - [ ] **§1 worktree posture confirmed live** (the blocking check): a session spawned with cwd = a lab-shaped linked worktree still runs `git commit` and `git push` to the bare origin under `--permission-mode auto` with no new prompt or refusal. - [ ] §9 confirmed live: the per-run `--settings` hooks block still merges additively, `PreToolUse` still fires for `AskUserQuestion|ExitPlanMode`, the spool still lands, and the observational exit-0 contract still lets the tool proceed. - [ ] §10 re-scraped from the sha256-verified 2.1.222 linux-x64-musl artifact using §10's **reverse-grep** method, A/B'd against 2.1.220/2.1.221 with the same extractor. All 33 pinned rows present, argHints verbatim, `doctor`'s `menuDescription` re-checked. - [ ] §3b credential-refresh trigger re-verified by hand per its recipe (no automated test exists — it rotates a real OAuth family). - [ ] `go test ./...` green (hermetic). - [ ] `golangci-lint run` clean. - [ ] Version + sha256 + compat-record land in **one** commit. - [ ] The agent-tools CI gate (path-gated on `containers/**`) builds the claude image and passes the injection smoke test on the PR — locally reproducible with `containers/agent-tools/build.sh claude && containers/agent-tools/smoke-test.sh claude`. - [ ] PR body says `Closes #<this issue>`. ## Out of scope - The **codex** pin — `CODEX_VERSION=0.133.0` → `0.146.0` is tracked on **#249** and is a much larger re-verification. Do not fold it in here. - Go module updates — tracked on **#250**. - The gemini seam (`versions.env:28-30`) — still deferred to **#126**. - Any adapter feature work the new version enables. Record what you observe in the compat record, file follow-ups, do not build. - Curating the standing 72-row §10 catalog gap (pre-existing, deliberately left standing — see §10's own note). --- *Filed by the Daily agent update check schedule, 2026-08-05. Release notes quoted verbatim from `anthropics/claude-code` `CHANGELOG.md` § 2.1.222; versions from the npm registry `@anthropic-ai/claude-code`; digest from `downloads.claude.ai/claude-code-releases/2.1.222/manifest.json`, with the method validated against the 2.1.221 pin this repo already carries.*

dominik.polakovics added the

ready-for-agent

label

2026-08-05 04:08:19 +02:00

dominik.polakovics referenced this issue

2026-08-05 04:08:41 +02:00

chore(agent-tools): bump the codex pin 0.133.0 → 0.146.0 — Tier-2 compat re-verification first (13 stable releases of drift) [schedule: Daily agent update check] #249

dominik.polakovics referenced this issue

2026-08-05 04:09:12 +02:00

chore(deps): Go modules — sqlite 1.56.0 (corruption fix) + libc 1.74.4 lockstep, goose 3.27.3 unblocked, advisories GO-2026-5970 + GO-2025-3553 [schedule: Daily agent update check] #250

dominik.polakovics referenced this issue from a commit

2026-08-05 05:03:16 +02:00