Claude Code v2.1.268

What's changed

• Added to the Claude apps gateway: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter
• Added a startup warning for gateways when access_control.allow_cidrs is empty, and a one-time warning the first time a request arrives from a public address
• Added the gatewayInternalNetworks managed setting, letting administrators allow /login to a Claude apps gateway on their organization's own public IPv4 block
• Added claude self-hosted-runner --remove-session-state (default off): delete each session's per-session directories under <base-dir>/_sessions/ when the session ends
• Added configDirectory to the output of claude auth status --json
• Added --json to claude plugin install, uninstall, update, enable and disable, and errorDetails/noteDetails to each row of claude plugin list --json
• Added browser-tab icons for published artifacts, chosen by Claude to match each page
• Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject
• Fixed WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off)
• Fixed a respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted
• Fixed sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high
• Fixed Claude sometimes replying "your message came through empty" after an MCP tool call
• Fixed deny and ask permission rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling
• Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line
• Fixed plugin and marketplace errors showing a token or password from a git source URL
• Fixed /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs
• Fixed prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request
• Fixed entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale
• Fixed a running session silently switching to the organization's default model when another Claude Code process refreshed a stale model-access entry
• Fixed long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans
• Fixed workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused
• Fixed MCP server OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound
• Fixed the conversation summary produced by /compact and auto-compact mangling text that contained $ sequences
• Fixed resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume
• Fixed SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction
• Fixed @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it
• Fixed claude agents: pressing ← again at a natural pace to go back to the agent list no