Claude Code 2.1.283 keeps new models out until admins say so

Claude Code 2.1.283 adds two managed settings for model access. One pins a team to the exact model versions it has approved, and the other blocks specific models outright. The release notes on GitHub, published September 25, also add a prompt audit for old configuration files, a per-prompt ID for LLM gateways, and a new default permission mode for some sessions.

The model settings are the main change. Most of the long list after them is fixes to plugins, MCP, vim mode and the VS Code extension.

Version-exact allowlists

The new availableModelsMatch setting takes the value "exact". With it, each availableModels entry allows only the model version it names, so a new release stays blocked until someone adds it to the list. deniedModels works from the other side: any model on it is blocked, even when availableModels allows it.

Both extend the allowlist enforcement added in 2.1.175 on June 12. That release added enforceAvailableModels, which makes the allowlist apply to the Default model too. If Default would resolve to a model that isn’t allowed, Claude Code falls back to the first allowed model. The same release stopped user and project settings from widening a managed list. A managed availableModels now replaces lower-precedence entries outright, where earlier versions merged them and a developer could append models of their own. Enforcement only switches on with a non-empty list. availableModels: [] still leaves users the Default model for their tier.

Several fixes in this release touch the same area. /model no longer accepts Sonnet 4.6 or Sonnet 5 with [1m] when the ID carries a date or -v1:0 suffix, in the cases where the plain ID was already refused. The /model picker stops showing a hardcoded Haiku version and price when ANTHROPIC_DEFAULT_HAIKU_MODEL pins a different model. Dynamic workflows started during a model fallback now retry the configured model instead of running every agent on the fallback. The /mcp tool list marks tools your organization has blocked with a warning icon.

One fix applies to managed sandbox settings. Previously, one invalid nested value caused the whole block to be ignored. Now the invalid value fails closed and the rest of the block still applies.

What prompt-audit checks

/doctor prompt-audit, also available as /checkup prompt-audit, scans your CLAUDE.md files, skills, agents and commands for prompting patterns written for older models. Stale paths, stale commands and instruction files that contradict each other come first in the report. Thinking keywords that Claude Code documents are left alone. A related fix: /context now shows MCP server instructions as their own row and counts them toward the total.

For gateway operators

With CLAUDE_CODE_GATEWAY_HINT_HEADERS=1, the gateway hint headers now include x-claude-code-prompt-id. A gateway can use it to group all the requests that serve one user prompt. The Claude apps gateway also gets an opt-in load_test_mode block. In that mode, requests are built and signed but never sent upstream, and clients get a canned reply, so a deployment can be load tested. There is also a new mantle upstream provider for Amazon Bedrock’s Mantle endpoint.

On the observability side, setting OTEL_LOG_TOOL_CONTENT=1 now puts the outputs of MCP tools, WebFetch and WebSearch into the tool.output OpenTelemetry span event. The stream-json system/init event now includes the directory path in plugin_errors entries for --plugin-dir load failures.

Plugins, Windows and cloud sessions

Before this release, among the plugin bugs now fixed:

• claude plugin uninstall could remove a different plugin whose ID differed only in case, together with its options and secrets.
• installed_plugins.json could be rewritten and lose records when it held one this version couldn’t read. Plugin commands now name that record and explain how to recover.
• Plugins with no declared version were silently restored at their source’s newest commit, not the installed one, when their cached files were missing.
• User-installed plugins failed with “cache-miss” after the home or config directory moved, as happens in bind-mounted devcontainers.

On Windows, the PowerShell tool no longer lets cmd /c rd, rmdir, del or erase delete drive roots, the home folder or other folders that Remove-Item refuses. Cloud sessions no longer occasionally redo a finished step, such as posting a duplicate comment or push, after recovering from a server-side restart. In Code Review, a review that hits its time limit with nothing verified now shows as incomplete, isn’t charged and is retried once. The /ultrareview launch dialog now says that reviewing a local branch may upload uncommitted changes to tracked files. The release also reverts 2.1.282’s reservation of the claude-ai name, so skills, commands, workflows and MCP servers’ skills and prompts with that name load again.

Startup is lighter as well. claude -p and Claude Code Remote no longer load the interactive UI. The auto-mode classifier’s rules and the Artifact tool now load on first use. First requests reuse the preconnected API connection.

Auto mode on third-party providers

Interactive sessions on third-party providers, or with telemetry off, now start in auto mode when no permission mode is configured. Setting permissions.defaultMode still overrides this. Later, on October 16, Anthropic’s changelog said claude -p and Agent SDK sessions with no permission mode start in default mode on third-party providers, with telemetry off, or on a fresh install, while --permission-mode auto keeps auto.

Telemetry-off setups get two more fixes in 2.1.283. The weekly Fable limit now appears in /usage and the VS Code usage meters when telemetry is disabled. In September, AGENTS.md support did nothing with telemetry off because it depended on a remote feature flag. And Remote Control, which had been unavailable on paid plans whenever DISABLE_TELEMETRY or DO_NOT_TRACK was set, works with them again.