Claude Code 2.1.268 makes /cost match gateway rates

Claude Code 2.1.268 lets a Claude apps gateway hand its own prices to the clients that sign in through it, so the numbers in /cost and in telemetry now come from the same rates the gateway’s spend meter uses. The same release, dated September 10 in Anthropic’s release notes on GitHub, fixes a regression that had made every turn fail with HTTP 400 on third-party Anthropic-compatible endpoints since 2.1.265, which came out two days earlier.

Most of the notes are fixes. Below are the changes that affect how gateways, proxies and permission rules behave, followed by the two changes that may require you to edit your config.

Pricing that matches the meter

It all goes through gateway.yaml. Set a pricing: block there and signed-in Claude Code clients receive those rates through managed settings, the channel administrators already use to push policy to clients. The notes give the purpose directly: /cost and telemetry should match the spend meter.

Two more gateway changes deal with exposure. A gateway now warns at startup when access_control.allow_cidrs is empty, and it warns once, the first time a request arrives from a public address. Meanwhile the new gatewayInternalNetworks managed setting lets administrators allow /login to a gateway on their organization’s own public IPv4 block. That covers companies whose internal traffic doesn’t come from private ranges. Together these changes seem aimed at gateways that can be reached from outside a private network, either on purpose or by accident.

The gateway has been getting steady work. In 2.1.265, on September 8, Claude Desktop and Cowork began sending user.email and user.groups in the telemetry they route through a Claude apps gateway, matching terminal sessions. With this release the cost side catches up too. For scripted setups, claude auth status --json now also reports configDirectory.

What broke on third-party endpoints?

Anyone pointing ANTHROPIC_BASE_URL at an Anthropic-compatible proxy or third-party endpoint after updating to 2.1.265 got an HTTP 400 on every turn. The cause was just one regex in the Artifact tool’s input schema, which those endpoints reject. Claude Code sends every tool’s schema with each request, so a single pattern the endpoint didn’t accept was enough to break the whole session.

Bedrock, Vertex and Foundry users get two changes that match how first-party sessions already work. Environment, model and settings details now arrive as attachments instead of being written into the system prompt. And the tool list stays byte-stable across a conversation: tools that connect late load deferred instead of rewriting the list. Prompt caching reuses a request prefix only when it is identical byte for byte, so a tool list that changes partway through a session means paying for the whole prefix again. Cache reuse broke the same way before: 2.1.265 fixed resumed subagents and agent teammates that changed their tool list or moved hook context and preloaded skills out of the prompt prefix.

SDK sessions using excludeDynamicSections had a similar problem. Prompt caching and extended thinking broke mid-session because the first message was re-rendered on every request. It now isn’t.

A few account and model fixes matter to teams more than to individual users:

• A running session could silently switch to the organization’s default model when another Claude Code process refreshed a stale model-access entry.
• Users with access were told a model was restricted after a restart, or in the Desktop Code tab, because of a stale cached denial.
• Long-context 429s on Fable models showed the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans. The usage-credits message for 1M context now also says that credits turned on mid-session take effect only after you restart Claude Code.
• Workload identity federation set up through a profile, as claude-code-action configures it, could fail mid-run with 401 … jti reused when several processes shared the profile.

Permission rules and leaked secrets

Several fixes close gaps where a rule you wrote didn’t apply. Deny and ask rules on symlinked directories (/etc, /tmp and /var on macOS, /bin on Linux) were skipped when a path was given by its real location. Bash commands, in turn, ignored deny rules written with the symlinked spelling. A Read or Edit deny rule also failed when the same line held env -C, eval or a similar command the permission checker can’t analyze.

A respawned in-process teammate could pick up tools or a system prompt from a same-named agent file in a folder you hadn’t trusted. In local Cowork sessions set to skip all approvals, the Artifact tool now refuses a local file that sits outside the session’s folders or behind a symlink. Before, it read such a file without asking.

Secrets were leaking into output in two places. Plugin and marketplace errors could show a token or password from a git source URL. And /mcp, /plugin server details, claude mcp list and get, and MCP login errors displayed values resolved from ${VAR} placeholders in MCP configs. The Bash sandbox instructions given to Claude also claimed more confinement than they enforced. They no longer list unenforced paths when filesystem isolation is off, and strict mode no longer claims that commands can never run unsandboxed.

In auto mode, a denial now tells Claude which rule blocked the action. It also asks Claude to try a safer method and to finish unrelated work before stopping to ask you.

Hooks, WebFetch and automation

WebFetch used to hang indefinitely on a server that kept the response open without finishing. A fetch now fails after 300 seconds. CLAUDE_CODE_WEBFETCH_DEADLINE_MS overrides the deadline, and 0 turns it off. The error for localhost and other dotless hostnames now explains why the URL is refused and suggests curl.

Hooks had their own bugs. PermissionRequest hooks didn’t fire in --print mode. CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS didn’t extend SessionEnd hooks that had no per-hook timeout, so they were still cancelled after 1.5 seconds. Policy-helper warnings didn’t print on headless -p runs.

For CI and fleet setups, claude self-hosted-runner --remove-session-state (off by default) deletes each session’s directories under <base-dir>/_sessions/ when the session ends. claude plugin install, uninstall, update, enable and disable now accept --json, and each row of claude plugin list --json carries errorDetails and noteDetails. Interactively, installing, enabling or disabling a plugin in /plugin takes effect when you close the menu, with no /reload-plugins needed.

Smaller fixes, from CPU to Slack

• A busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high.
• --continue and --resume show the conversation immediately instead of waiting for SessionStart hooks.
• Claude no longer sometimes replies “your message came through empty” after an MCP tool call.
• /compact and auto-compact no longer mangle text containing $ sequences.
• On Claude Code on the web, cloud sessions running longer than about six hours silently lost files saved to persisted session folders. Those saves now persist for up to a day.
• In Claude in Slack, each public channel now keeps its own memory notes, and Claude no longer recalls notes saved in other public channels. Workspace notes stay shared.
• Code Review no longer ends incomplete when one of the agents verifying a finding fails midway. It replaces that agent and reaches a verdict.
• The VS Code extension fixes a run of issues with CLAUDE_CONFIG_DIR set through settings, and adds keyboard and screen-reader controls for permission rules and message focus.

Two rules to revisit

Plain WebFetch deny and ask rules no longer apply to the Artifact tool’s reads and updates. If you blocked or gated artifacts that way, you now need an Artifact rule, or WebFetch(domain:claude.ai), to keep the same effect.

The task-tracking tools (TaskCreate, TaskGet, TaskUpdate, TaskList and TodoWrite) are now offered only on Claude 3.x, Opus 4.0 to 4.7, Sonnet 4.0 to 4.6 and Haiku 4.5. If a workflow depends on them with any other model, set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to bring them back.