The hop nobody tests

01Two regressions, one cut

Claude Code v2.1.265 was published at 20:37:31 UTC on 8 September.¹ It carried a long list of fixes and two regressions, and both of them landed on setups where something sits between the CLI and the model.

The first: an undocumented CLAUDE_CODE_USE_GATEWAY variable, previously ignored unless ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN were both set, started forcing Cloud-gateway sign-in on its own. Anyone who had it set alongside an API key, apiKeyHelper, or custom auth headers failed every request with "Not signed in to the Cloud gateway".² v2.1.266 restored the old behaviour at 23:55:14 UTC the same evening — 3 hours 18 minutes after the break shipped.²

The second: the built-in Artifact tool's input_schema gained a pattern on an identifier field using Unicode property escapes — ^(?!__.*__$)[^\p{Cc}\p{Cf}\p{Zl}\p{Zp}"\\./[\]]{1,200}$. Anthropic-compatible endpoints whose JSON-Schema validators implement a stricter regex subset reject the whole request with a 400. The tool list ships on every call, so the first turn of every interactive session failed.³⁴ That fix arrived in v2.1.268 at 20:30:54 UTC on 10 September: 47 hours 53 minutes after 2.1.265, 14.5 times the gateway turnaround.⁴⁵

v2.1.267 went out in between, at 19:58:14 UTC on 9 September, with maxEffortLevel, an effort cap across Bedrock, Vertex and Foundry, and two dozen fixes. The 400 was not among them.⁶

02The clocks are the argument

Put the two repairs side by side and the gap is not about difficulty. The gateway fix was a revert of one variable's precedence. The Artifact fix was a regex in a schema — the reporters had already isolated it to a single pattern and shown that deleting that one line made the identical request succeed.⁷⁸

Nor was it about discovery. The 400 was filed at 01:27:41 UTC on 9 September, four hours and fifty minutes after 2.1.265 shipped and an hour and thirty-two minutes after 2.1.266 shipped.⁷ A second report half an hour later stated in its title that the regression was still present in 2.1.266.⁸ A third, naming z.ai's GLM Anthropic-compatible endpoint and quoting the exact error code, arrived at 08:10 UTC.⁹ From that first report to the fix is 43 hours 3 minutes, and a full release passed through the middle of it.

The reporters did the vendor's triage for it. One bisected two captured request bodies; one replayed requests with individual constraints removed and recorded which shapes returned 200; all three named the escape class.⁷⁸⁹ Those are field reports — we read the issues, not the fix commit, so what the maintainers were doing in those 43 hours is not something we can see.

What the release note does say is that the regression dated to 2.1.265, which means 2.1.266 and 2.1.267 both shipped with it live.⁴

The gateway path was repaired before the third-party path had even been reported.

03Why a valid regex fails on a hop

One reporter makes the mechanical point precisely: the pattern is valid ECMA-262 with the u flag, and Anthropic's own API accepts it, so first-party traffic never sees the failure.⁸ That claim is a field report we could not independently test, but it is consistent with the evidence on both sides — the same build works against Anthropic and fails against z.ai.⁷⁹

If that holds, the mechanism needs no bad actor. A schema author picks a regex construct the reference implementation supports. Continuous integration runs against the reference implementation. Every test passes. The build then ships a wire payload that a second validator, one tier out, refuses. Neither party is testing the pair, and the pair is what the user runs.

This is why a hop degrades differently from a feature. A broken feature fails for the people using that feature. A hop sits under every request: the tool list goes out on every call, so an unusable session is the first symptom, and claude -p against the same backend reportedly kept working because the non-interactive path does not carry that tool.⁷ A partial failure that follows the transport rather than the feature is harder to attribute, which may be part of why one of these two regressions was so much louder inside the vendor than the other.

We have no measurement of how many installs sit behind a third-party compatible endpoint versus a first-party one, and no vendor figure exists that we could find. Any claim that the slower repair reflects a smaller user base would be a guess.

04The documentation already concedes the point

The gateway page states the position without hedging: any gateway exposing a supported API format works, and "Anthropic doesn't endorse, maintain, or audit third-party gateway products".¹⁰ It goes further: "Claude Code adds capabilities with each release, and a gateway that doesn't forward them breaks the corresponding features, so the gateway product needs to be kept updated as Claude Code evolves."¹⁰

Read as policy, that sentence is fair and clearly signposted. Read as an operational forecast, it describes exactly what happened this week — with one amendment. The break did not come from a gateway failing to forward a new capability. It came from a new capability's schema shape, and no gateway update could have absorbed it, because the rejection was the intermediary's validator doing its declared job.

The enterprise deployment page lists five separate base-URL variables for routing to a gateway, one per provider, alongside corporate-proxy configuration.¹¹ That is a substantial supported surface. v2.1.269, published 19:17:55 UTC on 11 September, added CLAUDE_CODE_GATEWAY_MODEL_DISCOVERY_TIMEOUT_MS to extend the gateway /v1/models discovery timeout past its 3-second default.⁵ The hop is being invested in and widened, which enlarges a contract that neither end tests jointly.

05Three other projects spent the week narrowing hops on purpose

On 7 September the MCP Python SDK shipped 2.2.0 and, on the maintenance line, 1.30.0. HTTP clients now follow a redirect only within the endpoint's origin; anything else fails. Stateful Streamable HTTP sessions close after 30 minutes idle, capped at 10 000 per server. And on the legacy OAuth path, authorization-server metadata whose issuer is not the server's own origin is rejected.¹²¹³

On 8 September gemini-cli 0.59.0 landed two fixes of the same family: SSRF prevention in MCP OAuth metadata discovery and authentication, and fail-closed workspace trust that filters mcpServers in restricted mode.¹⁴

On 10 September ADK Python 2.9.0 restricted its GCS tools to local paths under local_file_root and made them refuse local file access entirely when that setting is absent — judged by where a path resolves, not how it is spelled.¹⁵

These are deliberate tightenings, not accidents, and treating them as the same event as a regression would be sloppy. What they share with it is the location. Every one of them is a maintainer deciding that an indirect path — a redirect to another origin, an issuer that is not the server, a file path outside a declared root — is where the trouble comes from, and closing it by default. The industry is converging on the view that a hop is a liability. The repair clocks above suggest it is also a lower support priority.

06Our own two mornings

On 9 September this desk printed USE_IT and told readers to pin Claude Code ≥2.1.266.¹⁶ On 10 September it printed USE_IT and said pin ≥2.1.267.¹⁷ For anyone running ANTHROPIC_BASE_URL against a third-party compatible endpoint, both of those builds failed every turn, and we sent those readers into the failure twice.

The 9 September issue's window ran to 06:00 UTC that morning. The first two reports were filed at 01:27 and 01:57 UTC — inside it. The issue's own source note records that the community layer came from digests and that the Hacker News sweep returned nothing; the vendor's issue tracker was not a layer at all.¹⁶ Sourcing verdicts from release notes means inheriting the release notes' blind spots, and a regression a vendor has not yet acknowledged is invisible to a desk that only reads what the vendor published.

The narrower lesson is about the verdict, not the sweep. A pin stated as one number is a claim about every configuration. When a release note says a fix applies to gateway and proxy setups, the honest verdict names the paths it does not cover.

07What this week did not settle

Two regressions from one vendor in one cut is not a rate. It is a pair of measurements with a large gap, and the gap is what we are reporting; a trend would need months of release-to-fix intervals split by path, which we have not built.

The 3.3-hour turnaround also deserves its weight. A same-evening revert of a regression is a responsive maintenance operation, and 47.9 hours to fix a schema incompatibility is not negligence by any ordinary standard. The argument is comparative and narrow: two failures, same cut, same class of user-visible outcome, one repaired 14.5 times faster than the other.

There is a real case that the strict validator is the non-conforming party. If the pattern is valid ECMA-262 as reported, an endpoint advertising Anthropic compatibility and then refusing a valid regex has shipped an incomplete implementation.⁸ That argument wins on standards and loses on outcomes: the user who upgraded on Tuesday had no working session either way, and 2.1.268 chose to change the schema rather than wait for every downstream validator to catch up.⁴

Finally, all three issues were still open when we read them on 12 September, with no close timestamp, despite 2.1.268 stating the fix.⁷⁸⁹ An open issue after a shipped fix is ordinary tracker hygiene and we draw nothing from it — but it does mean a reader searching the tracker on Monday will find three open reports of a bug that has been fixed for two days.