Release archive

Claude Code v2.1.285: claude --desktop, an allowedProviders Managed Setting, and Time Limits for Background Shell Commands

Claude Code v2.1.285 adds claude --desktop, claude plugin configure and an allowedProviders managed setting, stops background shell commands after a time limit, and uses 1M context behind custom base URLs.

September 29, 2026 • 10 min read • By ClaudeWorld

Claude Code v2.1.285 is a large release. It adds claude --desktop, a claude plugin configure command and an allowedProviders managed setting, puts a time limit on background shell commands, and lets sessions behind a custom ANTHROPIC_BASE_URL use the 1M context window of models that have one. Beyond that, it brings a long list of fixes and changes for subagents, the Artifact tool, /ultrareview uploads, MCP, plugins and the VS Code extension.

What’s New

Open the desktop app with claude --desktop

claude --desktop opens the Claude desktop app on the current directory, or on a session with --continue / --resume <id>.

Plugin configuration from the command line

claude plugin configure <plugin> shows a plugin’s options and which are unset, or saves new values read from stdin with --values-stdin. claude plugin install --config also accepts <server>.<key>=<value>, so a bundled .mcpb MCP server’s own settings can be set at install time and it starts without a visit to /plugin → Configure.

allowedProviders managed setting

The new allowedProviders managed setting limits which API providers a machine may use: the Anthropic API, a custom endpoint, Bedrock, Mantle, Vertex AI, Foundry, Claude Platform on AWS, or a Cloud gateway.

New environment variables

CLAUDE_CODE_DISABLE_WEB_FETCH turns off the WebFetch tool, and CLAUDE_CODE_NONSTREAMING_TIMEOUT_RETRIES caps re-sends of a non-streaming fallback request that timed out.

Time limits for background shell commands

Background Bash and PowerShell commands now stop after a time limit, set by their timeout with run_in_background (default 30 minutes, maximum 2 hours). Claude is notified when one is stopped.

1M context behind a custom ANTHROPIC_BASE_URL

Sessions behind a custom ANTHROPIC_BASE_URL now use the 1M context window of models that have one (Opus 4.7+, Sonnet 5+, Fable). If your gateway stops at 200K, run /autocompact 200k.

Auto mode default reaches claude -p and the Python Agent SDK

claude -p and Python Agent SDK sessions on third-party providers or with telemetry off now start in auto mode when no permission mode is configured, like interactive sessions; --permission-mode still overrides it. The one-time offer to make auto mode your default permission mode now also appears on third-party providers and with telemetry off when your user settings default to another mode.

Resume a session running in the background

/resume and claude --resume on a session that is running in the background now open that session instead of refusing, and a prompt given with claude --resume <id> "prompt" is sent to it as its next turn.

Fixes and Improvements

  • Sandbox: Project settings can no longer widen or turn off an admin-required sandbox, replace the proxy behind a managed deny list, extend a strict allowlist, or reopen managed read-denies.
  • PowerShell: The PowerShell tool’s permission check no longer skips deny and ask rules, and caches that failure for later checks, when its command parser fails to start (for example when the machine is out of memory).
  • Artifact tool: An Artifact allow rule (“don’t ask again”) no longer lets the tool publish a file outside the working directories without asking; add the file’s folder with --add-dir for the rule to cover it.
  • Redaction: Redacted logs and transcripts no longer show part of a URL password that contains @, or all of it when the URL writes its @ as %40.
  • WebFetch and policy: Team and Enterprise sessions, and sessions whose sign-in plan Claude Code can’t determine, now withhold WebFetch until the organization policy loads if it couldn’t be loaded at startup. Sessions that authenticate with ANTHROPIC_AUTH_TOKEN against the Anthropic API now load the organization’s policy.
  • Windows: Project and local settings env no longer set ALLUSERSPROFILE, SystemDrive or the CommonProgramFiles variables; set them in user or managed settings instead.
  • Subagents: Fork subagents now run under their parent’s permission mode, keeping the session’s plan mode or dontAsk mode, and cannot exit plan mode.
  • Subagents: Background subagents in auto mode no longer prompt a second, redundant reply after each report, and a subagent’s run now ends as soon as it hands its report back to its caller.
  • Hooks: Synchronous hooks no longer hang Claude Code while a background process the hook started (for example some-daemon &) keeps its output open; the hook now finishes shortly after its own process exits.
  • Retries: A failing API request is no longer retried up to 21 times when streaming keeps failing, because the non-streaming fallback now shares the request’s retry budget. Responses blocked by the API’s output content filter now show the filter’s error right away instead of being re-sent and retried.
  • Resume and compaction: Compacting or resuming a session no longer fails, opens without its history, or crashes when the saved transcript holds a compaction marker or loop wakeup entry with missing or malformed fields.
  • Sign-in: Fixed sign-in that could wait forever after the browser showed success.
  • Background sessions: A reply sent from claude agents to a background session that is waiting on a permission prompt no longer sometimes approves the pending command.
  • MCP: The MCP server name widgets is now reserved in cloud sessions and on self-hosted runners; your own server under it, or a close spelling such as widgets_, no longer loads, so rename it.
  • MCP CLI: claude mcp list now lists WebSocket (ws) MCP servers with their URL and health status, and claude mcp get hides the command, arguments and environment values of stdio MCP servers provided by plugins (variable names are still shown).
  • Bedrock and Vertex AI: Sessions now switch to an older available model of the same tier, instead of failing, when an admin removes access to the default model.
  • /ultrareview: On macOS and Linux, uploading a local repository now requires git 2.31 or newer and checkouts made with --separate-git-dir are refused, and uploads no longer include uncommitted changes to credential files whose name has a colon before the extension, such as server:8443.key.
  • VS Code: File Read, Write and Edit calls no longer stall for ten minutes and then get skipped when the editor stops responding to the extension’s automatic save. Manage plugins gains a plugin options form, and a new on-demand diagnostics tool lets Claude read the Problems panel’s current errors and warnings at any time.
  • Claude Tag: Members on an Enterprise plan Standard or Usage-Based Chat seat who also have Cowork can now send Claude direct messages; a seat that includes Claude Code is no longer required.

This release contains 136 changes in total; see the full changelog for the complete list.

How to Update

  1. Check your installed version: claude --version
  2. Update in place: claude update
  3. If your gateway behind a custom ANTHROPIC_BASE_URL stops at 200K, run /autocompact 200k. Rename any MCP server called widgets that you use in cloud sessions or on self-hosted runners, and on Windows move ALLUSERSPROFILE, SystemDrive or CommonProgramFiles values from project or local env into user or managed settings.