Claude Code 2.1.268 makes /cost match gateway rates

Anthropic has released Claude Code 2.1.268, in which a pricing: block set in gateway.yaml now reaches signed-in Claude Code clients through managed settings, so /cost and telemetry report the same rates as the gateway's spend meter. The change sits alongside the rest of the release in the notes published on Github.

At a glance

• Administrators get a new gatewayInternalNetworks managed setting that opens /login to a Claude apps gateway on an organization's own public IPv4 block, alongside startup warnings for gateways whose access_control.allow_cidrs list is empty.
• Every turn had been failing with HTTP 400 on third-party Anthropic-compatible endpoints since 2.1.265, caused by a regex in the Artifact tool's input schema that those endpoints reject; the release fixes it.
• WebFetch no longer hangs on a server that keeps a response open: a fetch now fails after 300 seconds, and CLAUDE_CODE_WEBFETCH_DEADLINE_MS overrides that deadline, with 0 turning it off.

The pricing hand-off reads as an accounting fix more than a feature: a gateway that meters spend centrally is of limited use when the client in front of it reports different numbers, and reconciliation work falls on whoever runs the deployment. The CIDR warnings point the same way, nudging operators away from gateways that accept traffic from anywhere. Both changes likely matter most to organizations that put Claude Code behind their own infrastructure rather than to individual users.

Gateways warn at startup when access_control.allow_cidrs is empty

Gateways now warn at startup when access_control.allow_cidrs is empty, and again the first time a request arrives from a public address, a warning issued once rather than on every launch. The new gatewayInternalNetworks managed setting lets administrators permit /login to a Claude apps gateway on their organization's own public IPv4 block.

claude self-hosted-runner gains --remove-session-state, off by default, which deletes each session's per-session directories under <base-dir>/_sessions/ when the session ends. claude auth status --json now reports configDirectory, and claude plugin install, uninstall, update, enable and disable accept --json; claude plugin list --json adds errorDetails and noteDetails to each row.

The /plugin menu now applies installs, enables and disables when it closes, with no /reload-plugins step afterwards. The startup notice that N MCP servers need authentication announces each server once instead of at every launch. Published artifacts also get browser-tab icons, chosen by Claude to match each page.

A regex in the Artifact tool's schema broke every turn on third-party endpoints since 2.1.265

Third-party Anthropic-compatible endpoints reached through ANTHROPIC_BASE_URL had rejected a regex in the Artifact tool's input schema, and every turn returned HTTP 400 from 2.1.265 onward. The release restores those endpoints. WebFetch stops waiting on a server that holds a response open without finishing, failing at 300 seconds unless CLAUDE_CODE_WEBFETCH_DEADLINE_MS says otherwise.

Two sources of sustained high CPU usage are gone: a busy loop in long-running idle sessions that pinned a core, and rapid terminal focus reports during a session recap. Claude also stops replying that a message came through empty after an MCP tool call.

Entitled users were told a model was restricted after a restart or in the Desktop Code tab when a cached model-access denial went stale; a running session could also switch to the organization's default model when another Claude Code process refreshed that entry. Long-context 429s on Fable models now show the 1M-context message on Pro and Team plans instead of the usage-credits consent prompt.

Deny rules missed paths under symlinked /etc, /tmp, /var and /bin

Deny and ask rules on symlinked directories (/etc, /tmp and /var on macOS, /bin on Linux) did not apply when a path was given by its real location, and Bash commands ignored deny rules written with a symlinked spelling. A Read or Edit deny rule could also be skipped when an env -C, eval or similar command the permission checker cannot analyze sat on the same line.

Plugin and marketplace errors had shown a token or password taken from a git source URL, and /mcp and /plugin server details, claude mcp list and get, and MCP login errors printed secrets resolved from ${VAR} placeholders in MCP configs. Both are fixed in 2.1.268.

In local Cowork sessions set to skip all approvals, the Artifact tool now refuses a local file outside the session's folders or behind a symlink. Plain WebFetch deny and ask rules no longer cover Artifact reads and updates; an Artifact rule or WebFetch(domain:claude.ai) gates them instead.

Fixes outside the terminal client. In the VS Code extension, sessions honour CLAUDE_CONFIG_DIR set through settings, the WSL install prompt stops appearing on machines without WSL, and two additions target keyboard and screen reader users: arrow keys choose where an always-allow rule is saved, and a new command focuses the newest message.

On the web, cloud sessions running longer than about six hours had silently lost files saved to persisted session folders; saves now hold for up to a day. In Slack, each public channel keeps its own notes, while workspace notes stay shared.