claude_version tracks `latest`, which runs ~6 releases ahead of the installer's `stable`

[tend-agent]

running-tend's weekly rule for claude_version says track latest, and names npm view @anthropic-ai/claude-code dist-tags.latest as the source. That's been followed consistently. The question is whether it's the channel we want, because the binary it selects runs in every consumer's CI job.

The release bucket publishes two markers, and they are not close together:

$ curl -fsS https://downloads.claude.ai/claude-code-releases/stable
2.1.220
$ curl -fsS https://downloads.claude.ai/claude-code-releases/latest
2.1.226

Six patch releases apart, as of 2026-08-09. 2.1.220 is the pin #918 is currently replacing — that is, stable has only just caught up to the version the previous weekly bump landed. The promotion lag looks to be roughly one weekly bump cycle, so tracking latest means adopters are more or less permanently one cycle ahead of the release Anthropic has promoted.

claude install takes either marker or an exact version, so all three are available to us:

$ claude install --help
Usage: claude install [options] [target]

Install Claude Code native build. Use [target] to specify version (stable,
latest, or specific version)

The pin should stay an exact version either way — reproducibility, and the action's input description already says so. The decision is only which marker we read when picking that number each week.

It genuinely cuts both ways, which is why this is a maintainer call rather than a PR:

• Tracking latest gets fixes sooner, and some have been squarely ours. In the 2.1.221–2.1.226 range alone: 2.1.225 fixed a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token and breaking headless sessions until restart — tend's exact auth shape, in a run that never restarts. 2.1.222 fixed the startup connectivity check hanging behind an HTTPS proxy, and every tend session starts behind mitmdump. Waiting a cycle for stable means adopters sit on those bugs for another week.
• Tracking stable means adopters never run a release Anthropic hasn't promoted. The blast radius is every consumer's job, and a bad release shows up as agent misbehaviour rather than a clean failure — the /code-review waiver scan (skills(running-tend): check the /code-review waiver scan when bumping claude_version #926) is one example of a dependency that breaks silently.

No action needed on #918 either way; it followed the rule as written. Filing this so the choice gets made once rather than re-litigated at each weekly bump. Whichever way it goes, the rule in .claude/skills/running-tend/SKILL.md should name the marker and say why — the current "track latest" reads as a default rather than a decision.

Related: #922, on the codex_version rule having a confirmation step that isn't reachable from CI.

[tend-agent]

Confirmed the numbers today (2026-08-09): bucket stable = 2.1.220, bucket latest = 2.1.226, and the pin on the default branch is still 2.1.220. Both changelog entries cited hold up — 2.1.225's transient-401 fix names CLAUDE_CODE_OAUTH_TOKEN and headless sessions explicitly, and 2.1.222's is "the startup connectivity check hanging and then failing behind an HTTPS proxy". Three things the issue doesn't cover that bear on the choice:

npm carries a stable dist-tag, so the recipe change is one word either way. npm view @anthropic-ai/claude-code dist-tags returns {"stable": "2.1.220", "latest": "2.1.226", "next": "2.1.226"} — it agrees with the download bucket exactly on both markers, so the existing dist-tags.latest line becomes dist-tags.stable and nothing else in the weekly recipe moves. Worth noting latest and next currently point at the same version.

The six-release gap is one un-promoted burst, not a steady one-cycle lag. npm publish times: 2.1.220 shipped 2026-07-24, then nothing for ten days, then 2.1.221–2.1.226 all landed between 2026-08-03 and 2026-08-08. So stable has not promoted anything from the current burst, and "six releases behind" and "the promoted release is two weeks old" are the same single fact rather than two independent ones. A lag estimate drawn from this window will read high; there isn't enough history here to say whether one bump cycle is the steady-state promotion delay.

A stable pin doesn't fully avoid executing an un-promoted build. The install step pipes claude.ai/install.sh with the pin as its target. That script validates the target against stable|latest|X.Y.Z, but then unconditionally downloads the latest binary as its bootstrap installer, runs <bootstrap> install <target> with it, and deletes it. The agent session runs the pinned version, so this only touches the install step — but it does mean "adopters never run a release Anthropic hasn't promoted" is not quite exact under a stable pin.

No dedup hits: #922 is the sibling codex_version rule question and #926 the waiver-scan check, neither overlapping this decision, and #918 is still open at 2.1.226.

Commands and sources

$ curl -fsS https://downloads.claude.ai/claude-code-releases/stable   # 2.1.220
$ curl -fsS https://downloads.claude.ai/claude-code-releases/latest   # 2.1.226
$ npm view @anthropic-ai/claude-code dist-tags --json
{ "stable": "2.1.220", "latest": "2.1.226", "next": "2.1.226" }

Publish times (npm view @anthropic-ai/claude-code time):

version	published
2.1.219	2026-07-24
2.1.220	2026-07-24
2.1.221	2026-08-03
2.1.222	2026-08-04
2.1.223	2026-08-05
2.1.224	2026-08-07
2.1.225	2026-08-07
2.1.226	2026-08-08

install.sh (fetched 2026-08-09, 217 lines) — target validation, bootstrap fetch, and hand-off:

TARGET="$1"  # Optional target parameter
if [[ -n "$TARGET" ]] && [[ ! "$TARGET" =~ ^(stable|latest|[0-9]+\.[0-9]+\.[0-9]+(-[^[:space:]]+)?)$ ]]; then
    echo "Usage: $0 [stable|latest|VERSION]" >&2
...
# Always download latest version (which has the most up-to-date installer)
version=$(download_file "$DOWNLOAD_BASE_URL/latest")
...
"$binary_path" install ${TARGET:+"$TARGET"} || install_code=$?
rm -f "$binary_path"

Changelog lines verified against anthropics/claude-code CHANGELOG.md:

• 2.1.225 — "Fixed a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, breaking headless sessions until restart"
• 2.1.222 — "Fixed the startup connectivity check hanging and then failing behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message"
• 2.1.226 — "Bug fixes and reliability improvements" (no detail published)

[max-sixty]

yes we do want this

[tend-agent]

Taking that as: stay on latest — the current channel is intentional, not an unexamined default. #959 writes that into the weekly rule so the next bump doesn't re-open it. Say the word if you meant the opposite and I'll flip the PR to stable.

The pin itself doesn't move — still an exact version, still picked with npm view @anthropic-ai/claude-code dist-tags.latest. Only the rule's wording changes, from "track latest" to naming the marker and the reason.

Two things worth recording, both re-verified today rather than carried over from above:

• stable has promoted since this was filed — it's 2.1.222 now, not 2.1.220, against latest 2.1.229. So the six-release gap was a real promotion lag rather than a one-off frozen burst, which is the reading that favours staying on latest.
• stable wouldn't have kept un-promoted code out of the job anyway: install.sh always downloads the latest build as its bootstrap installer before handing off to the pinned target. That argument for stable was weaker than the issue gave it credit for.

Verification

$ curl -fsS https://downloads.claude.ai/claude-code-releases/stable   # 2.1.222
$ curl -fsS https://downloads.claude.ai/claude-code-releases/latest   # 2.1.229
$ npm view @anthropic-ai/claude-code dist-tags --json
{ "stable": "2.1.222", "next": "2.1.229", "latest": "2.1.229" }

install.sh (fetched today, 217 lines) — validates the target, then bootstraps from latest regardless:

if [[ -n "$TARGET" ]] && [[ ! "$TARGET" =~ ^(stable|latest|[0-9]+\.[0-9]+\.[0-9]+(-[^[:space:]]+)?)$ ]]; then
...
# Always download latest version (which has the most up-to-date installer)
version=$(download_file "$DOWNLOAD_BASE_URL/latest")
...
"$binary_path" install ${TARGET:+"$TARGET"} || install_code=$?

Both cited changelog entries still match anthropics/claude-code CHANGELOG.md — 2.1.225's transient-401 fix names CLAUDE_CODE_OAUTH_TOKEN and headless sessions, 2.1.222's names the connectivity check behind an HTTPS proxy.

The sibling codex_version question in #922 is untouched by this.