Claude Code 2.1.268

96changes

Add --json to claude plugin install, uninstall, update, enable, and disable.
Change an always-allow rule's save location with arrow keys in VS Code.
Sync /cost and telemetry with gateway-configured pricing rates.
Show resumed conversations immediately instead of waiting on SessionStart hooks.
Fix every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints since 2.1.265.

New features

JSON output for plugin commands

Added --json to claude plugin install, uninstall, update, enable and disable, and errorDetails/noteDetails to each row of claude plugin list --json

[VSCode] Keyboard control for rule save scope

Added Left and Right arrow keys to change where an always-allow permission rule is saved, for keyboard and screen reader users

[VSCode] Focus last message command

Added a "Claude Code: Focus last message" command that moves keyboard focus to the newest message in the conversation, for keyboard and screen reader users

▤ In the docs

Sync spend meter with gateway pricing

Added to the Claude apps gateway: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter

More changes (7) Fewer changes

Warn on open gateway access controls

Added a startup warning for gateways when access_control.allow_cidrs is empty, and a one-time warning the first time a request arrives from a public address

▤ In the docs

Allow gateway login from org IPs

Added the gatewayInternalNetworks managed setting, letting administrators allow /login to a Claude apps gateway on their organization's own public IPv4 block

▤ In the docs

Delete session state on exit

Added claude self-hosted-runner --remove-session-state (default off): delete each session's per-session directories under <base-dir>/_sessions/ when the session ends

▤ In the docs

Show config directory in auth status

Added configDirectory to the output of claude auth status --json

Icons for published artifacts

Added browser-tab icons for published artifacts, chosen by Claude to match each page

[Claude Tag] Link back to admin settings

Added a link from a Slack channel's configure page back to the organization's Claude in Slack admin settings

[Code Review] Explain how to close findings

Added a note under the still-open findings list in follow-up reviews: resolving a finding's thread, not just replying to it, stops later reviews from counting it as open

Improvements

Faster --continue and --resume

Improved --continue / --resume: the conversation appears immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript

Apply plugin toggles without reload

Improved /plugin: installing, enabling or disabling a plugin now takes effect when you close the menu; /reload-plugins is no longer needed afterwards

Gate task-tracking tools by model

Changed the task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) to be offered only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6, Haiku 4.5; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 elsewhere

▤ In the docs

Block unapproved file reads in Cowork

Changed local Cowork sessions set to skip all approvals: the Artifact tool now refuses a local file outside the session's folders, or behind a symlink, instead of reading it without asking

More changes (22) Fewer changes

Faster fullscreen prompt-line edits

Improved fullscreen mode: adding or removing a prompt line (Shift+Enter) now repaints as fast as typing a character instead of re-rendering the visible transcript

Smoother tool-heavy turn rendering

Improved responsiveness during tool-heavy turns by no longer redrawing the transcript for a hidden per-tool-batch reminder

Faster startup with workflow scripts

Improved startup time in projects with .claude/workflows/ scripts: listing them no longer parses each script

Name the rule behind auto mode denials

Improved auto mode denials: the message Claude receives now names the rule that blocked the action and asks Claude to try a safer method and finish unrelated work before stopping to ask you

Keep long Chrome page reads inline

Improved Claude in Chrome: long page reads now stay inline instead of being saved to a file and read back

Detail the MEMORY.md truncation warning

Improved the MEMORY.md truncation warning to say how many lines were cut and where the cut starts

Lead artifact prompts with the question

Improved the terminal permission prompt for artifacts: it now leads with the ask's question

Show editor selections in the footer

Improved the prompt footer: an editor or /diff selection now shows inside the prompt input, and fullscreen mode shows Remote Control status in the header instead of the footer

Explain 1M-context credit activation timing

Improved the "Usage credits required for 1M context" message to say that usage credits turned on mid-session take effect after restarting Claude Code

Deliver gateway system prompts as attachments

Changed the system prompt on Bedrock, Vertex and Foundry to deliver environment, model and settings details as attachments, matching first-party sessions

Stabilize the gateway tool list

Changed Bedrock, Vertex and Foundry sessions to keep the tool list byte-stable across a conversation (late-connecting tools load deferred instead of rewriting it), matching first-party sessions

Show document count in artifact prompts

Changed the artifact data-edit permission prompt in the terminal to a card that shows the document count and who can open the artifact

Separate Artifact from WebFetch rules

Changed plain WebFetch deny and ask rules to no longer apply to Artifact tool reads and updates; use an Artifact rule (or WebFetch(domain:claude.ai)) to block or gate them

▤ In the docs

Announce MCP auth needs once

Changed the "N MCP servers need authentication" startup notice to announce each server once instead of at every launch

[VSCode] Apply plugin changes without restart

Changed the Manage plugins dialog to apply installs, enables, disables and uninstalls to open sessions without a restart

[VSCode] Match terminal artifact prompts

Changed some artifact permission prompts to omit the "don't ask again" choice, matching the terminal

[Claude Code on the web] Explain missing routine connectors

Improved routine creation from a conversation: when the new routine has no connectors, Claude now says so and how to add them instead of only confirming it

[Claude Tag] Explain why an action was blocked

Improved how Claude explains a blocked action: it now says whether a permission check, its own decision to confirm first, or missing access stopped it

[Claude Tag] Parallelize read-only lookups

Improved reply speed: Claude now runs several read-only lookups (searching Slack, reading a thread, finding people) at once instead of one after another

[Claude Tag] List short comparisons instead of tables

Improved formatting of comparisons: sentence-length comparisons now come as lists instead of wide tables that scroll sideways, and long table cells wrap

[Claude Tag] Explain cross-org Slack mismatches

Improved the message shown when your Claude account is in a different organization than the Slack workspace: it now explains how to connect the workspace to your org

[Claude Tag] Scope public-channel memory per channel

Changed memory in public channels: each channel now keeps its own notes, and Claude no longer recalls notes it saved in other public channels; workspace notes stay shared

Bug fixes

HTTP 400 errors on third-party endpoints

Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject

Enforce deny rules on symlinked paths

Fixed deny and ask permission rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling

Enforce deny rules with unanalyzable commands

Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line

Fire PermissionRequest hooks headlessly

Fixed PermissionRequest hooks not firing in --print mode

Restrict respawned teammates to trusted folders

Fixed a respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted

More changes (54) Fewer changes

Time out hanging WebFetch requests

Fixed WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off)

Idle-session CPU spikes

Fixed sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high

Empty replies after MCP tool calls

Fixed Claude sometimes replying "your message came through empty" after an MCP tool call

Hide credentials in plugin errors

Fixed plugin and marketplace errors showing a token or password from a git source URL

Hide secrets in MCP diagnostics

Fixed /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs

Prompt caching with excludeDynamicSections

Fixed prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request

Refresh stale model-access denials

Fixed entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale

Stop silent model downgrades mid-session

Fixed a running session silently switching to the organization's default model when another Claude Code process refreshed a stale model-access entry

Correct 1M-context 429 messaging

Fixed long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans

Workload identity token reuse errors

Fixed workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused

MCP OAuth port binding errors

Fixed MCP server OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound

Dollar-sign mangling in compact summaries

Fixed the conversation summary produced by /compact and auto-compact mangling text that contained $ sequences

Keep restored-file order stable on resume

Fixed resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume

Use post-compaction context everywhere

Fixed SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction

Restore suggestions after editing recalled prompts

Fixed @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it

Delayed back navigation in claude agents

Fixed claude agents: pressing ← again at a natural pace to go back to the agent list no longer gets ignored until you pause for over a second

Explain stuck worktree session deletes

Fixed claude agents session delete getting stuck when a worktree can't be removed: the message names the cause and next step, and for a git worktree ctrl+x again deletes the directory anyway

Collapse multi-line agent panel rows

Fixed background agent and workflow rows in the agents panel expanding to many lines when their text contained line breaks

Restore Slack tools under MCP allowlists

Fixed Claude in Slack sessions losing their Slack tools when org managed settings set an MCP allowlist

Chrome host-permission dialog for unparsable hosts

Fixed Claude in Chrome asking to allow the host "https" when a navigation URL had a scheme but a host that could not be parsed

Keep the spinner on one line

Fixed the spinner wrapping onto several lines when the current task's label is long; the label and the "Next:" task line now stay within one terminal row

Show the cursor in bug report fields

Fixed the /bug and /feedback description field showing no cursor when the terminal's native cursor is enabled

Show real names for remote-control sessions

Fixed Remote Control sessions served by claude remote-control showing a generated name instead of their session title in ListAgents

Accept double-dot plugin directory names

Fixed claude plugin validate rejecting plugin paths whose directory name begins with two dots, which the plugin loader accepts

Report unreadable plugin files

Fixed plugins silently skipping a default monitors file or root SKILL.md that could not be checked

Explain WebFetch's localhost refusal

Fixed WebFetch's error for localhost and other dotless hostnames to explain why the URL is refused and suggest curl

Print policy-helper warnings headlessly

Fixed policy-helper warnings not printing on headless (-p) runs

Show fork names in /resume

Fixed /resume listing a /fork background session under its parent's name instead of its own fork name

Suggest /login for signed-out cloud commands

Fixed /remote-control and other claude.ai-gated commands to suggest /login when signed out instead of showing a Claude for Enterprise migration message

Honor SessionEnd hook timeout overrides

Fixed CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS not extending SessionEnd hooks that have no per-hook timeout (they were still cancelled after 1.5 seconds)

Point unlinked users to web setup

Fixed /autofix-pr and other cloud-session commands saying to retry or install the Claude GitHub App when no GitHub account is connected; they now point to /web-setup or the web connect page

Explain policy-disabled cloud commands

Fixed cloud-session commands such as /teleport and /remote-env to explain when an organization policy turns them off, instead of answering "Unknown command"

Correct Bash sandbox confinement claims

Fixed Bash sandbox instructions over-stating confinement: no unenforced path lists when filesystem isolation is off, and strict mode no longer claims commands can never run unsandboxed

[VSCode] CLAUDE_CONFIG_DIR from settings files

Fixed the session list, settings toggles, and chat tabs when CLAUDE_CONFIG_DIR is set in a settings file or the environmentVariables setting

[VSCode] Keep the model pill visible

Fixed the model pill, model picker and command menu going blank in open tabs for a few seconds after a login, logout or account switch

[VSCode] Keep Auto in the mode picker

Fixed Auto disappearing from the mode picker in new-tab or just-reloaded conversations when a project or local setting overrides the model named in ~/.claude/settings.json

[VSCode] Keep session names after reload

Fixed session names reverting to the last prompt after a window reload when a SessionStart hook is configured

[VSCode] Avoid waiting on other tabs' process

Fixed the footer's model pill and Remote Control pill waiting for the new tab's Claude process to start when another tab in the window is already up

[VSCode] Reuse the running Claude process

Fixed a second Claude process running through its full startup when a session tab's launch arrived more than half a second after its config read

[VSCode] Honor sidebar location on resume

Fixed resuming a session from the session list ignoring claudeCode.preferredLocation: "sidebar" (it always opened a panel), and programmatic opens resetting that setting to "panel"

[VSCode] Windows WSL prompts and diagnostics

Fixed Windows issues: the WSL install prompt no longer appears on machines without WSL installed, and IDE diagnostics are now returned correctly for Windows files when WSL is installed

[VSCode] Save custom styles where the CLI reads

Fixed the custom style builder saving a User level style in a folder the CLI does not read when CLAUDE_CONFIG_DIR is set through settings

[Claude Code on the web] Keep long-session files

Fixed cloud sessions running longer than about six hours silently losing files saved to persisted session folders; saves now persist for up to a day

[Claude Code on the web] Effort-cap resume errors

Fixed "Invalid effort level" errors when a routine resumes a session, or a session starts with no set effort, in orgs where an admin caps a model's effort

[Claude Tag] Add retry for failed settings sections

Fixed the admin settings page hanging on a loading skeleton or going blank after a transient load failure; a section that fails to load now shows a Retry button

[Claude Tag] Keep settings after workspace moves

Fixed a Slack Enterprise Grid channel losing its Claude settings (repository, environment, access) after a Slack admin moved it to another workspace

[Claude Tag] Contradictory restart notices

Fixed @Claude !restart in a thread with its own session sometimes also posting a contradictory "this thread is handled by the channel session" notice

[Claude Tag] Render angle-bracket links

Fixed Markdown links whose URL is wrapped in angle brackets showing as literal bracket text in Slack instead of a clickable link

[Claude Tag] Answer guest top-level mentions

Fixed a workspace guest's top-level @mention in a channel where guests may use Claude sometimes getting a "your Slack account isn't connected" reply instead of an answer

[Claude Tag] Delay refresh until the channel is quiet

Fixed a channel's long-running session being replaced with a fresh one mid-conversation; the scheduled refresh now waits until the channel and its threads are quiet

[Claude Tag] Send channel-settings outcomes once

Fixed channel-settings cards clicked more than once telling the proposing session the change was refused after it had already applied; the outcome is now sent once

[Code Review] Replace failed verification agents

Fixed reviews sometimes ending as incomplete when one of the agents verifying a finding failed midway; the review now replaces that agent and reaches a verdict

[Code Review] Skip posting to draft PRs

Fixed a push-triggered review that was queued behind a running review still posting after the pull request had been converted to draft

[Code Review] Match root files to CLAUDE.md rules

Fixed reviews ignoring a directory's CLAUDE.md conventions when the PR edited a root file (e.g. README.md) that only shares a name with a file that CLAUDE.md lists