Claude Code 2.1.233 splits proxy spend by user

Anthropic has shipped Claude Code 2.1.233 with an opt-in apps gateway setting, forward_user_identity, that sends the signed-in user's identity as request headers on Anthropic upstreams so a proxy behind the gateway can attribute spend per user, according to release notes published on Github.

At a glance

• Teams routing Claude Code through a shared proxy get one undifferentiated bill; the setting is off by default and is configured on Anthropic upstreams inside the apps gateway.
• On Linux, Bash tool commands can run under a cgroup memory cap set through CLAUDE_CODE_TOOL_MEMORY_LIMIT, an opt-in control that keeps a runaway build from stalling the session.
• GitLab merge request URLs now work with the --worktree flag and in the claude agents view, where merge requests render as !N, and the WebFetch URL cache TTL becomes configurable.

Why it matters Where one gateway fronts shared credentials for a whole team, the invoice arrives as a single line and internal chargeback is guesswork. Moving identity into request headers appears to shift that accounting to the proxy layer, which is where access control already sits in most deployments. The Linux memory cap reads as a step in the same direction, toward setups that have to keep running through someone else's build.

Gateway 400 and 413 errors from Vertex, Foundry and AWS upstreams now carry the upstream's own message

The apps gateway also changes how upstream failures surface: 400 and 413 responses from Vertex, Foundry and Claude Platform on AWS upstreams now carry the upstream's own message. According to the release notes, that also fixes a bug with auto-compact on the apps gateway.

Session start for claude self-hosted-runner is faster: the session branch is created without rewriting the working tree, and two server round trips that previously blocked the agent's launch have been removed. Print mode gains a diagnostic line, [claude-code:unrecognized_model], written to stderr when a request goes out for a model ID Claude Code does not recognize; modelOverrides silences it.

The command claude plugin validate now checks a bare .claude/skills directory and reports SKILL.md files whose frontmatter fails to parse. In screen reader mode the /effort selector renders as a numbered list with a typed-number prompt, and hint and dialog text is no longer clipped.

The NT \??\ device prefix bypassed UNC path validation on Windows

Windows paths spelled with the NT \??\ device prefix bypassed UNC path validation, and the release closes what Anthropic describes as an NTLM credential-leak vector. Separately, idle sessions on Linux sometimes kept one CPU core at 100 percent when sandboxing was enabled; that has been fixed.

The release also fixes cloud sessions occasionally being marked as lost when the environment shut down while Claude was waiting on a permission prompt, and Notification hooks not firing for permission prompts under Claude Desktop or VS Code. MCP v2 connections endlessly reopened the subscriptions/listen stream against servers that terminate long-held streams on a fixed timeout, such as serverless hosts; that loop is gone.

Bundled skill aliases such as /checkup and /review reported "Unknown command" in -p mode or with plugins and MCP loaded when a user or project skill shadowed the bundled skill. Skill and command argument substitution has been tightened so argument values are not re-expanded as template markers.

Todo tools are unavailable on Opus 4.8, Sonnet 5, Fable 5 and Mythos 5

Todo and task tracking tools, TaskCreate, TaskGet, TaskUpdate, TaskList and TodoWrite, are no longer available on Opus 4.8, Sonnet 5, Fable 5, Mythos 5 and newer models; CLAUDE_CODE_ENABLE_TODO_TOOLS=1 brings them back. On Windows, auto mode had begun stopping repeatedly for manual approval on ordinary cd <dir> && <command> > file Bash commands, a regression introduced in 2.1.232 and fixed here.

Anthropic has also reverted two 2.1.232 Bash permission changes: one covering Cygwin-style symlinks on Windows, the other covering input redirections written as < file. According to the release notes, a narrower version will return in a later release of Claude Code.

The WebFetch session URL cache TTL is now configurable through CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS, with the default unchanged at 15 minutes. The GitHub app setup tip no longer appears in repositories whose origin remote sits on gitlab.com or bitbucket.org, while the enterprise marketplace tip now covers non-GitHub internal git hosts.

What's next Anthropic says a narrower version of the two reverted Bash permission changes will return in a later release of Claude Code, without naming a version or a date. What that narrower version will cover for Cygwin-style symlinks and for input redirections is not spelled out, so the shape of the eventual permission rules remains open until it ships.