Claude Code v2.1.268: Gateway Pricing Sync, Plugin JSON Output, and a WebFetch Deadline

Claude Code v2.1.268 is a large release with 96 changelog entries. Its main themes are administration of the Claude apps gateway, machine-readable output for plugin commands, permission and secret-handling fixes, and long lists of VS Code and Claude Tag fixes. It also fixes every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints, a problem present since 2.1.265.

What’s New

Claude apps gateway pricing and network controls

With pricing: set in gateway.yaml, signed-in Claude Code clients now receive the same rates through managed settings, so /cost and telemetry match the gateway’s spend meter. Gateways also print a startup warning when access_control.allow_cidrs is empty, plus a one-time warning the first time a request arrives from a public address. The new gatewayInternalNetworks managed setting lets administrators allow /login to a Claude apps gateway on their organization’s own public IPv4 block.

JSON output for plugin and auth commands

claude plugin install, uninstall, update, enable and disable now accept --json, and each row of claude plugin list --json gains errorDetails and noteDetails. The output of claude auth status --json now also includes configDirectory.

Self-hosted runner session cleanup

claude self-hosted-runner --remove-session-state deletes each session’s per-session directories under <base-dir>/_sessions/ when the session ends. The option is off by default.

WebFetch deadline

WebFetch no longer hangs indefinitely on a server that keeps the response open without finishing: a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline; a value of 0 turns it off.

Task-tracking tools limited to listed models

The task-tracking tools (TaskCreate/Get/Update/List and TodoWrite) are now offered only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6 and Haiku 4.5. To use them with other models, set CLAUDE_CODE_ENABLE_TODO_TOOLS=1.

Permission rules for the Artifact tool

Plain WebFetch deny and ask rules no longer apply to Artifact tool reads and updates; use an Artifact rule (or WebFetch(domain:claude.ai)) to block or gate them. In local Cowork sessions set to skip all approvals, the Artifact tool now refuses a local file outside the session’s folders, or behind a symlink, instead of reading it without asking. Published artifacts also get browser-tab icons, chosen by Claude to match each page.

Faster resume and no more plugin reloads

--continue and --resume now show the conversation immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript. In /plugin, installing, enabling or disabling a plugin takes effect when you close the menu, so /reload-plugins is no longer needed afterwards.

Bedrock, Vertex and Foundry match first-party sessions

On Bedrock, Vertex and Foundry, the system prompt now delivers environment, model and settings details as attachments, and the tool list stays byte-stable across a conversation (late-connecting tools load deferred instead of rewriting it), matching first-party sessions.

Fixes and Improvements

Third-party endpoints: Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265, caused by a regex in the Artifact tool’s input schema that those endpoints reject.
Permissions: Deny and ask rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) now apply when a path is given by its real location, and Bash commands no longer ignore deny rules written on a symlinked path spelling. A Read or Edit deny rule now also applies when an env -C, eval or similar command the permission checker cannot analyze is on the same line.
Secrets: Plugin and marketplace errors no longer show a token or password from a git source URL, and /mcp and /plugin server details, claude mcp list/get and MCP login errors no longer show secrets resolved from ${VAR} placeholders in MCP configs.
Untrusted folders: A respawned in-process teammate no longer picks up tools or a system prompt from a same-named agent file in a folder you have not trusted.
CPU usage: A busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high.
Model access: Entitled users are no longer told a model is restricted because of a stale cached model-access denial, and a running session no longer silently switches to the organization’s default model when another Claude Code process refreshes a stale model-access entry. Long-context 429s on Fable models now show the 1M-context message on Pro and Team plans instead of the usage-credits consent prompt.
SDK: Prompt caching and extended thinking no longer break mid-session for SDK sessions using excludeDynamicSections, and SDK prompt suggestions, side questions and /rename no longer send the conversation from before a compaction.
Compaction: The summary produced by /compact and auto-compact no longer mangles text containing $ sequences.
Authentication: Workload identity federation via a profile (as claude-code-action configures it) no longer fails mid-run with 401 … jti reused, and MCP server OAuth sign-in no longer fails with “No available ports for OAuth redirect” when the local callback port range can’t be bound.
Hooks: PermissionRequest hooks now fire in --print mode, and CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS now extends SessionEnd hooks that have no per-hook timeout (they were previously cancelled after 1.5 seconds).
Agents view: In claude agents, pressing ← again at a natural pace to return to the agent list is no longer ignored, and deleting a session whose worktree can’t be removed now names the cause and next step; for a git worktree, ctrl+x again deletes the directory anyway.
Responsiveness: In fullscreen mode, adding or removing a prompt line (Shift+Enter) now repaints as fast as typing a character; tool-heavy turns no longer redraw the transcript for a hidden per-tool-batch reminder; and startup is faster in projects with .claude/workflows/ scripts.
Auto mode: When an action is denied, the message Claude receives now names the rule that blocked it and asks Claude to try a safer method and finish unrelated work before stopping to ask you.
VS Code: Fixed the session list, settings toggles and chat tabs when CLAUDE_CONFIG_DIR is set in a settings file or the environmentVariables setting; resuming from the session list now honors claudeCode.preferredLocation: "sidebar"; and the Manage plugins dialog applies changes to open sessions without a restart. Keyboard and screen reader users get Left and Right arrow keys to choose where an always-allow rule is saved, plus a “Claude Code: Focus last message” command.
Claude Code on the web: Cloud sessions running longer than about six hours no longer silently lose files saved to persisted session folders; saves now persist for up to a day.
Claude Tag: Each public channel now keeps its own memory notes, and Claude no longer recalls notes saved in other public channels (workspace notes stay shared). Claude also runs several read-only lookups at once for faster replies, and explains whether a permission check, its own decision to confirm first, or missing access stopped an action.
Code Review: Reviews no longer end as incomplete when one of the agents verifying a finding fails midway, and no longer ignore a directory’s CLAUDE.md conventions when the PR edits a root file that only shares a name with a file that CLAUDE.md lists.

This release contains 96 changes in total; see the full changelog for the complete list.

How to Update

Check your installed version: claude --version
Update in place: claude update
Review your permission rules: plain WebFetch deny and ask rules no longer cover Artifact tool reads and updates, so add an Artifact rule (or WebFetch(domain:claude.ai)) if you relied on them. If you use the task-tracking tools on a model outside the listed ones, set CLAUDE_CODE_ENABLE_TODO_TOOLS=1.