One day after 2.1.267, here’s 2.1.268. This time the new stuff isn’t in the terminal — it’s in the accounting.
The gateway does the math
If you run a Claude apps gateway, you can now set pricing: in gateway.yaml. Signed-in Claude Code clients receive the same rates through managed settings, which means /cost and telemetry finally show what the spend meter shows. Before this, each side counted on its own.
Two warnings were added that should have been there all along. On startup, the gateway complains when access_control.allow_cidrs is empty. And the first time a request arrives from a public address, you get a one-time notice. An open gateway used to sit there quietly.
There’s also a new gatewayInternalNetworks managed setting, which lets admins permit /login against a gateway sitting in the organization’s own public IPv4 block. Niche until you happen to run a network like that.
The bug that broke third-party endpoints
Since 2.1.265, every single turn against Anthropic-compatible third-party endpoints (ANTHROPIC_BASE_URL) failed with HTTP 400. The cause was a regex in the Artifact tool’s input schema that those endpoints reject. Claude Code was unusable there for three releases. Fixed now.
Same category: WebFetch hung forever when a server held the response open and never finished it. A fetch now fails after 300 seconds, CLAUDE_CODE_WEBFETCH_DEADLINE_MS moves the deadline, and 0 turns it off. There was also a busy loop that pinned a CPU core in long-running idle sessions until you closed the window.
Five places where secrets leaked
This is the block I find most interesting:
- Plugin and marketplace errors displayed the token or password from a git source URL.
/mcp,/plugin,claude mcp listandget, plus MCP login errors, displayed values resolved from${VAR}placeholders in MCP configs.- Deny and ask rules on symlinked directories (
/etc,/tmp,/varon macOS,/binon Linux) didn’t apply when a path was given by its real location. The reverse also held: Bash commands ignored deny rules written against the symlinked spelling. - A Read or Edit deny rule didn’t apply when an
env -C,evalor similarly opaque command sat on the same line. - A respawned in-process teammate picked up tools and a system prompt from a same-named agent file in a folder you never trusted.
Four of those are permission bypasses, two are plaintext secrets. If you run Claude Code with MCP servers behind environment variables, go look through your logs for things that shouldn’t be sitting there.
The todo tools are being switched off
The entry that’s easy to miss: TaskCreate, TaskGet, TaskUpdate, TaskList and TodoWrite are now offered only on Claude 3.x, Opus 4.0 through 4.7, Sonnet 4.0 through 4.6, and Haiku 4.5. Everywhere else you need CLAUDE_CODE_ENABLE_TODO_TOOLS=1.
The reading is fairly obvious: newer models plan well enough on their own that an explicit task list in the tool block only costs space and cache. Older ones keep it. If you have scripts or hooks listening for todo output, set the variable.
Small stuff
Published artifacts now get a browser-tab icon that Claude picks to match the page. claude auth status --json includes configDirectory. claude plugin install, uninstall, update, enable and disable all take --json. Auto mode denials now name the rule that blocked the action and ask Claude to finish the unrelated work before stopping to ask you. In public Slack channels, each channel keeps its own notes instead of Claude recalling notes from other public channels.
For Cowork: local sessions set to skip all approvals no longer read a local file through the Artifact tool if it sits outside the session’s folders or behind a symlink. They used to just read it.
Reading it
Two releases of cache cleanup, now one of permission cleanup. That looks like someone working methodically through a list, and in this codebase that’s good news. But the HTTP 400 bug shows how fast a project like this breaks at the edges: one regex in a tool that has nothing to do with third-party endpoints, and for three days nothing runs there at all.
Sources: Claude Code release v2.1.268, Claude Code changelog