[clubanderson]

Part of #8419

Automated pin bump: claude 2.1.322 -> 2.1.323 in src/Dockerfile and src/Dockerfile.contributor.

Provenance

Every value below was resolved by src/scripts/cli-pin-bump.sh in run https://github.com/hivecommons/hive/actions/runs/43371821632; digests are computed from the downloaded artifacts and cross-checked against the vendor-published digest where one exists (never copied from a page).

VERSION=2.1.323

Smoke (before this PR was opened)

src/Dockerfile built for linux/amd64 with the new pin; inside the image:

$ claude --version
2.1.323 (Claude Code)
$ claude --help
Usage: claude [options] [command] [prompt]

Claude Code - starts an interactive session by default, use -p/--print for
non-interactive output

Arguments:
  prompt                                Your prompt

Options:
  --add-dir <directories...>            Additional directories to allow tool
                                        access to
  --agent <agent>                       Agent for the current session. Overrides
                                        the 'agent' setting.
  --agents <json-or-file>               JSON object defining custom agents, or
                                        with --print the path to a file that
                                        holds one (e.g. '{"reviewer":
                                        {"description": "Reviews code",
                                        "prompt": "You are a code reviewer"}}')
  --allow-dangerously-skip-permissions  Enable bypassing all permission checks
                                        as an option, without it being enabled
                                        by default. Recommended only for
                                        sandboxes with no internet access.
  --allowedTools, --allowed-tools <tools...>
      Comma or space-separated list of tool names to allow (e.g. "Bash(git *)
      Edit")
  --append-system-prompt <prompt>       Append a system prompt to the default
                                        system prompt
  --autocompact <auto|tokens>           Auto-compact window size (auto, or
                                        100k–1M tokens)
  --ax-screen-reader                    Render screen-reader friendly output
                                        (flat text, no decorative borders or
                                        animations).
  --bg, --background                    Start the session in the background and
                                        return immediately. Prints the id that
                                        `claude attach`, `logs`, `stop` and `rm`
                                        take; `claude agents` lists them. With
                                        --resume <session-id>, continues that
                                        session in the background under the same
                                        ID, or starts a copy and says so when
                                        the session is already running

Model lists (not automated)

::warning::claudePinnedCLIModels has no 'version pinned in src/Dockerfile (X' comment to check
::warning::codex static list comment says 0.166.0 but src/Dockerfile pins 0.167.0
2 model-list drift finding(s) against the CLI pins; also review static/index.html and src/pkg/tokens/pricing.go by hand.

• Allowlists and static fallbacks in src/pkg/dashboard/cli_models*.go match the new pin's model set, and their "matches CLI version" comments name it
• static/index.html model options updated
• src/pkg/tokens/pricing.go has prices for any new model

The docker workflow on this PR builds both images for linux/amd64 and linux/arm64 (every hash-verified layer runs sha256sum -c / sha512sum -c), and the backend smoke's pinned lane picks the new CLI up on its next run. See src/docs/cli-pins.md.

Opened by .github/workflows/cli-pin-bump.yml.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#18064	🌱 images: bump omp 18.19.0 -> 18.20.0	same files	src/Dockerfile src/Dockerfile.contributor
#18062	🌱 images: bump codex 0.167.0 -> 0.168.0	same files	src/Dockerfile src/Dockerfile.contributor

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• coverage

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

Evidence bundle `#18065072d67b` sha256:672958a6d4460be5185c86665cc93c906e5a063d165f7db030dd8c2f7d7fb0a3 — download from the dashboard or `hivectl review evidence #18065`.

[hivecommons-hive]

b7df860

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head b7df860b9dfe) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • src/Dockerfile
  • src/Dockerfile.contributor

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Diff is correct; the red checks are inherited from v5, not from this PR.

The change is the pin ARGs in src/Dockerfile and src/Dockerfile.contributor only, and the docker (*) build jobs that consume them (running sha256sum -c on the downloaded artifacts) are green on both arches.

test (rest 3/4) → test → coverage fail on TestReopenedClaimPersistsAcrossLoad (src/pkg/github/prclaims_reopen_test.go:235), which has failed on every hourly run of v5@88f6c9c since 2026-11-13 03:31Z: the fixture date (prclaims_reopen_test.go:18, 2026-10-14) aged past settledClaimRetention (prclaims.go:92, 30d) and the test reloads via the wall-clock LoadClaimLedger, so loadClaimLedgerAt (prclaims.go:1273-1277) drops the claim. Full mechanism and a one-line test fix are in my comment on #18062; this PR goes green once that lands on v5. Nothing to change here.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

test (rest 3/4) is red on the v5 baseline itself (pkg/github.TestReopenedClaimPersistsAcrossLoad, a fixture-date time bomb), not caused by this PR — tracked as shared incident #18067, fix in #18066. Deferring this PR until the baseline is green; it needs no change of its own for that check.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88