Claude Code 2.1.268

What changed

Claude Code 2.1.268 shipped on September 10, 2026. It is mostly fixes (59 of them), and the most notable group concerns permission rules and leaked secrets. Deny rules slipping past on symlinked directories or on a line holding a command the permission checker cannot analyze, and error messages showing a git token or a secret resolved from an MCP config, are all closed off. The regression since 2.1.265 that failed every turn on third-party endpoints set through ANTHROPIC_BASE_URL is fixed too. Eleven things are new, centered on Claude apps gateway administration: rate delivery via pricing:, public-address warnings, and the gatewayInternalNetworks setting. Bedrock, Vertex and Foundry sessions now also handle the system prompt and tool list the way first-party sessions do.

New features

• Claude apps gateway: pricing:

  The gateway’s spend meter and a client’s /cost and telemetry could be computed from different rates. With pricing: set in gateway.yaml, signed-in Claude Code clients now receive the same rates through managed settings, so /cost and telemetry match the spend meter.

• Gateway access-control warnings

  An empty access_control.allow_cidrs left the gateway open to any address, with nothing pointing that out. The gateway now prints a startup warning when it is empty, plus a one-time warning the first time a request arrives from a public address.

• The gatewayInternalNetworks managed setting

  Organizations whose own network is a public IPv4 block had no way to allow /login to a Claude apps gateway from it. Administrators can now list that block in gatewayInternalNetworks.

• claude self-hosted-runner --remove-session-state

  Self-hosted runners kept each session’s per-session directories after it ended. With this flag (default off), the per-session directories under <base-dir>/_sessions/ are deleted when the session ends.

• configDirectory in claude auth status --json

  Scripts had to work out the active config directory on their own. claude auth status --json now includes configDirectory.

• --json on claude plugin commands

  Plugin operations were hard to consume from scripts. claude plugin install, uninstall, update, enable and disable now accept --json, and each row of claude plugin list --json gains errorDetails and noteDetails.

• Browser-tab icons for published artifacts

  Published artifacts had no icon to tell their browser tabs apart. Claude now chooses an icon to match each page.

• [VSCode] Left and Right arrow keys to change where an always-allow rule is saved

  Choosing where an always-allow permission rule is saved wasn’t easy from the keyboard. Left and Right arrow keys now change it, for keyboard and screen reader users.

• [VSCode] A “Claude Code: Focus last message” command

  There was no keyboard route to the newest message. This command moves keyboard focus to the newest message in the conversation, for keyboard and screen reader users.

• [Claude Tag] A link back to the organization’s Claude in Slack admin settings

  A Slack channel’s configure page had no way back to the organization-level settings. It now links to the organization’s Claude in Slack admin settings.

• [Code Review] A note under the still-open findings list in follow-up reviews

  Replying to a finding’s thread left it counted as open in later reviews, with no explanation. Follow-up reviews now note that resolving the thread, not just replying to it, stops later reviews from counting it as open.

Key improvements

Speed & UI

• Fullscreen mode: adding or removing a prompt line

  Adding or removing a prompt line with Shift+Enter re-rendered the visible transcript. It now repaints as fast as typing a character.

• --continue / --resume

  The conversation waited for SessionStart hooks before appearing, and the first message re-read the whole transcript. The conversation now appears immediately, and the first message no longer re-reads the whole transcript.

• Responsiveness during tool-heavy turns

  A hidden per-tool-batch reminder triggered a transcript redraw. It no longer does.

• Startup time in projects with .claude/workflows/ scripts

  Listing workflows parsed each script. Listing them no longer does.

• The prompt footer

  An editor or /diff selection showed apart from the prompt input. It now shows inside the prompt input, and fullscreen mode shows Remote Control status in the header instead of the footer.

• The MEMORY.md truncation warning

  The warning said MEMORY.md was cut without saying how much. It now says how many lines were cut and where the cut starts.

• The “N MCP servers need authentication” startup notice

  The notice repeated at every launch. It now announces each server once.

Permissions & auto mode

• Auto mode denials

  When auto mode blocked an action, Claude wasn’t told which rule did it. The message Claude receives now names the rule that blocked the action and asks Claude to try a safer method and finish unrelated work before stopping to ask you.

• The terminal permission prompt for artifacts

  The prompt didn’t put what it was asking up front. It now leads with the ask’s question.

• The artifact data-edit permission prompt in the terminal

  A data edit’s reach was hard to see at a glance. The prompt is now a card that shows the document count and who can open the artifact.

• Local Cowork sessions set to skip all approvals

  The Artifact tool read a local file outside the session’s folders, or behind a symlink, without asking. It now refuses such a file instead.

• WebFetch rules and the Artifact tool

  Plain WebFetch deny and ask rules also applied to Artifact tool reads and updates. They no longer do; use an Artifact rule (or WebFetch(domain:claude.ai)) to block or gate them.

Models & providers

• The “Usage credits required for 1M context” message

  Usage credits turned on mid-session don’t take effect right away, and the message didn’t say so. It now says they take effect after restarting Claude Code.

• Bedrock, Vertex and Foundry: system prompt

  These sessions delivered environment, model and settings details differently from first-party sessions. The system prompt now delivers them as attachments, matching first-party sessions.

• Bedrock, Vertex and Foundry: tool list

  A late-connecting tool rewrote the tool list mid-conversation. Sessions now keep the tool list byte-stable across a conversation, and late-connecting tools load deferred, matching first-party sessions.

• Task-tracking tools

  The task-tracking tools were offered on every model. They (TaskCreate/Get/Update/List, TodoWrite) are now offered only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6 and Haiku 4.5; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 elsewhere.

Plugins & Claude in Chrome

• /plugin

  Installing, enabling or disabling a plugin needed a /reload-plugins afterwards. It now takes effect when you close the menu.

• Claude in Chrome: long page reads

  Long page reads were saved to a file and read back. They now stay inline.

[VSCode]

• The Manage plugins dialog

  Plugin changes needed a restart to reach open sessions. Installs, enables, disables and uninstalls now apply to open sessions without a restart.

• Artifact permission prompts

  Some artifact permission prompts offered a “don’t ask again” choice the terminal doesn’t. They now omit the “don’t ask again” choice, matching the terminal.

[Claude Code on the web]

• Routine creation from a conversation

  When the new routine had no connectors, Claude only confirmed it was created. Claude now says it has no connectors and how to add them.

[Claude Tag]

• Explaining a blocked action

  When Claude couldn’t do something, the reason wasn’t distinguished. Claude now says whether a permission check, its own decision to confirm first, or missing access stopped it.

• Reply speed

  Read-only lookups (searching Slack, reading a thread, finding people) ran one after another. Claude now runs several at once.

• Formatting of comparisons

  Sentence-length comparisons came as wide tables that scroll sideways. They now come as lists, and long table cells wrap.

• Accounts in a different organization than the Slack workspace

  It was unclear why Claude couldn’t be used when the two organizations differed. The message now explains how to connect the workspace to your org.

• Memory in public channels

  Notes Claude saved in one public channel could be recalled in others. Each channel now keeps its own notes, and Claude no longer recalls notes it saved in other public channels; workspace notes stay shared.

Bug fixes

Third-party endpoints & model access

• Every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool’s input schema that those endpoints reject.
• Entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale.
• A running session silently switching to the organization’s default model when another Claude Code process refreshed a stale model-access entry.
• Long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans.
• Workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused.

Permissions & security

• A respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted.
• Deny and ask rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling.
• A Read or Edit deny rule not applying when an env -C, eval or similar command the permission checker cannot analyze was on the same line.
• Plugin and marketplace errors showing a token or password from a git source URL.
• /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs.
• Bash sandbox instructions over-stating confinement: no unenforced path lists when filesystem isolation is off, and strict mode no longer claims commands can never run unsandboxed.

Tools & performance

• WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off).
• WebFetch’s error for localhost and other dotless hostnames now explains why the URL is refused and suggests curl.
• Sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high.
• Claude sometimes replying “your message came through empty” after an MCP tool call.
• MCP server OAuth sign-in failing with “No available ports for OAuth redirect” when the local callback port range can’t be bound.

Compaction & resuming

• The conversation summary produced by /compact and auto-compact mangling text that contained $ sequences.
• Resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume.
• SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction.
• Prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request.
• /resume listing a /fork background session under its parent’s name instead of its own ⑂ fork name.

Input & UI

• @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it.
• claude agents: pressing ← again at a natural pace to go back to the agent list no longer gets ignored until you pause for over a second.
• claude agents session delete getting stuck when a worktree can’t be removed: the message names the cause and next step, and for a git worktree ctrl+x again deletes the directory anyway.
• Background agent and workflow rows in the agents panel expanding to many lines when their text contained line breaks.
• The spinner wrapping onto several lines when the current task’s label is long; the label and the “Next:” task line now stay within one terminal row.
• The /bug and /feedback description field showing no cursor when the terminal’s native cursor is enabled.

Commands & messages

• /remote-control and other claude.ai-gated commands now suggest /login when signed out instead of showing a Claude for Enterprise migration message.
• /autofix-pr and other cloud-session commands saying to retry or install the Claude GitHub App when no GitHub account is connected; they now point to /web-setup or the web connect page.
• Cloud-session commands such as /teleport and /remote-env now explain when an organization policy turns them off, instead of answering “Unknown command”.
• Remote Control sessions served by claude remote-control showing a generated name instead of their session title in ListAgents.

Plugins

• claude plugin validate rejecting plugin paths whose directory name begins with two dots, which the plugin loader accepts.
• Plugins silently skipping a default monitors file or root SKILL.md that could not be checked.

Hooks & headless runs

• PermissionRequest hooks not firing in --print mode.
• Policy-helper warnings not printing on headless (-p) runs.
• CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS not extending SessionEnd hooks that have no per-hook timeout (they were still cancelled after 1.5 seconds).

Claude in Slack & Claude in Chrome

• Claude in Slack sessions losing their Slack tools when org managed settings set an MCP allowlist.
• Claude in Chrome asking to allow the host “https” when a navigation URL had a scheme but a host that could not be parsed.

[VSCode]

• The session list, settings toggles, and chat tabs when CLAUDE_CONFIG_DIR is set in a settings file or the environmentVariables setting.
• The model pill, model picker and command menu going blank in open tabs for a few seconds after a login, logout or account switch.
• Auto disappearing from the mode picker in new-tab or just-reloaded conversations when a project or local setting overrides the model named in ~/.claude/settings.json.
• Session names reverting to the last prompt after a window reload when a SessionStart hook is configured.
• The footer’s model pill and Remote Control pill waiting for the new tab’s Claude process to start when another tab in the window is already up.
• A second Claude process running through its full startup when a session tab’s launch arrived more than half a second after its config read.
• Resuming a session from the session list ignoring claudeCode.preferredLocation: "sidebar" (it always opened a panel), and programmatic opens resetting that setting to “panel”.
• Windows issues: the WSL install prompt no longer appears on machines without WSL installed, and IDE diagnostics are now returned correctly for Windows files when WSL is installed.
• The custom style builder saving a User level style in a folder the CLI does not read when CLAUDE_CONFIG_DIR is set through settings.

[Claude Code on the web]

• Cloud sessions running longer than about six hours silently losing files saved to persisted session folders; saves now persist for up to a day.
• “Invalid effort level” errors when a routine resumes a session, or a session starts with no set effort, in orgs where an admin caps a model’s effort.

[Claude Tag]

• The admin settings page hanging on a loading skeleton or going blank after a transient load failure; a section that fails to load now shows a Retry button.
• A Slack Enterprise Grid channel losing its Claude settings (repository, environment, access) after a Slack admin moved it to another workspace.
• @Claude !restart in a thread with its own session sometimes also posting a contradictory “this thread is handled by the channel session” notice.
• Markdown links whose URL is wrapped in angle brackets showing as literal bracket text in Slack instead of a clickable link.
• A workspace guest’s top-level @mention getting a “your Slack account isn’t connected” reply instead of an answer, in a channel where guests may use Claude.
• A channel’s long-running session being replaced with a fresh one mid-conversation; the scheduled refresh now waits until the channel and its threads are quiet.
• Channel-settings cards clicked more than once telling the proposing session the change was refused after it had already applied; the outcome is now sent once.

[Code Review]

• Reviews sometimes ending as incomplete when one of the agents verifying a finding failed midway; the review now replaces that agent and reaches a verdict.
• A push-triggered review that was queued behind a running review still posting after the pull request had been converted to draft.
• Reviews ignoring a directory’s CLAUDE.md conventions when the PR edited a root file (e.g. README.md) that only shares a name with a file that CLAUDE.md lists.

Notes

• The task-tracking tools are now offered only on older models — TaskCreate/Get/Update/List and TodoWrite are offered only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6 and Haiku 4.5. Set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to keep them on other models.
• Plain WebFetch rules no longer gate the Artifact tool — if you relied on WebFetch deny or ask rules to block artifact reads and updates, add an Artifact rule (or WebFetch(domain:claude.ai)) to keep the same effect.
• Deny rules on symlinked directories now apply by real location — rules on /etc, /tmp, /var (macOS) or /bin (Linux) now also catch paths given by their real location, so commands that used to pass may now be blocked.
• WebFetch now has a 300-second deadline — override it with CLAUDE_CODE_WEBFETCH_DEADLINE_MS; 0 turns it off.
• Upgrade if you use a third-party endpoint via ANTHROPIC_BASE_URL — every turn failing with HTTP 400 since 2.1.265 is fixed in this release.
• /plugin changes take effect when you close the menu — /reload-plugins is no longer needed after installing, enabling or disabling a plugin.
• claude self-hosted-runner --remove-session-state is off by default — pass it explicitly to delete per-session directories when each session ends.