Claude Code v2.1.268: Fixes HTTP 400 on Third-Party Endpoints, WebFetch Hangs, and Secret Leaks

Claude Code v2.1.268 is out, and it's mostly a bug-fix release with a few gateway and plugin additions. The headline item for anyone not pointing at Anthropic's own API: every request on third-party Anthropic-compatible endpoints was failing with HTTP 400 since v2.1.265.

The HTTP 400 regression

If you're running Claude Code against a proxy or self-hosted endpoint via ANTHROPIC_BASE_URL, every turn has been failing since 2.1.265. The cause: a regex in the Artifact tool's input schema that those endpoints reject. If you skipped 2.1.265–2.1.267, upgrading here is the fix.

WebFetch no longer hangs forever

WebFetch would hang indefinitely on a server that kept the response open without finishing. Fetches now fail after 300 seconds. Override with an env var:

CLAUDE_CODE_WEBFETCH_DEADLINE_MS=<ms>   # 0 turns the deadline off

Gateway additions

• pricing: in gateway.yaml now propagates to signed-in Claude Code clients via managed settings, so /cost and telemetry line up with the spend meter.
• Startup warning when access_control.allow_cidrs is empty, plus a one-time warning the first time a request arrives from a public address.
• New gatewayInternalNetworks managed setting lets admins allow /login to a Claude apps gateway on their org's own public IPv4 block.

Secrets no longer leak in errors

• Plugin and marketplace errors no longer print a token or password from a git source URL.
• /mcp, /plugin server details, claude mcp list/get, and MCP login errors no longer display secrets resolved from ${VAR} placeholders in MCP configs.

Permission and tooling fixes

• Deny/ask rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) were not applying when a path was given by its real location. Bash commands also ignored deny rules written on a symlinked path spelling.
• Read/Edit deny rules were skipped when env -C, eval, or a similar unanalyzable command sat on the same line.
• A respawned in-process teammate could pick up tools or a system prompt from a same-named agent file in an untrusted folder.

Session and CPU fixes

• A busy loop in long-running idle sessions no longer pins a CPU core; rapid terminal focus reports during a session recap no longer keep CPU high.
• SDK sessions using excludeDynamicSections no longer break prompt caching and extended thinking mid-session — the first message isn't re-rendered each request.
• /compact and auto-compact summaries no longer mangle text containing $ sequences.
• Restored-file notes from a /compact-ended conversation now load in the same order on every resume.

JSON output and runner flags

• --json added to claude plugin install, uninstall, update, enable, disable, with errorDetails/noteDetails per row of claude plugin list --json.
• configDirectory added to claude auth status --json.
• claude self-hosted-runner --remove-session-state (default off) deletes per-session directories under <base-dir>/_sessions/ when a session ends.

Also fixed: MCP OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound, workload identity federation via a profile failing mid-run with 401 … jti reused, and stale model-access denials telling entitled users a model is restricted.