Claude Code v2.1.268 Major Updates - Task Management Tool Model-Specific Availability and Permission Rules Security Fix

This is Ishikawa from the Cloud Business Division. Claude Code v2.1.268 (released 2026-09-10) has been released. This is a release with many changes at 96 items, with changes spanning not only the CLI itself but also various platforms. Despite the volume, there are few new features, and it feels like a release centered on fixes and improvements. Today, I tried out the new plugin --json.

The previous update article is here.

https://dev.classmethod.jp/articles/20260910-cc-updates-v2-1-267/

Update Summary

v2.1.268 includes 96 changes. Counting the CHANGELOG entries, there are 59 Fixed, 16 Improved, 11 Added, and 10 Changed. Of these, 63 affect the CLI itself, with the remainder split between 13 for the VSCode extension, 13 for Claude Tag (Claude in Slack), 4 for Code Review, and 3 for Claude Code on the web.

Notable Updates

plugin commands now support --json

--json has been added to claude plugin install / uninstall / update / enable / disable. Additionally, errorDetails and noteDetails have been added to each line of claude plugin list --json output.

For those who manage plugins from CI or distribution scripts, this means you can stop parsing human-facing messages.

Regression causing HTTP 400 on every turn with compatible endpoints fixed

A problem where every turn would result in HTTP 400 with third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265 has been fixed. The cause was that these endpoints were rejecting regular expressions contained in the Artifact tool's input schema.

If you were using a custom proxy or compatible endpoint and things stopped working since 2.1.265, this is worth prioritizing for an upgrade.

High CPU usage fixed

A problem where a busy loop was occupying a CPU core in long-idle sessions, and a problem where CPU remained high when terminal focus notifications arrived consecutively during session recap, have both been fixed.

This fix will be more impactful for those who tend to leave sessions open and idle.

300-second timeout added for WebFetch infinite wait

A problem where WebFetch would wait indefinitely for servers that kept responses open without finishing has been fixed, and it will now fail after 300 seconds. The timeout can be overridden with CLAUDE_CODE_WEBFETCH_DEADLINE_MS, and setting it to 0 disables it.

If you are running automated processes that include WebFetch, it would be wise to plan retries with the assumption that they may be cut off at 300 seconds.

Permission rule loopholes fixed

Three fixes were made around permissions.

• Rules for deny / ask on symlinked directories (macOS's /etc, /tmp, /var, Linux's /bin) were not being applied when specified with the real path. Also, Bash commands written with the symlink-side spelling were ignoring deny rules.
• Cases where deny rules for Read and Edit were not being applied when commands like env -C or eval that the permission checker cannot parse were on the same line.
• A problem where a restarted in-process teammate was loading tools and system prompts from an agent file of the same name in an untrusted folder.

Environments using permissions deny / ask for operational constraints may have had paths where rules were not working as intended, so upgrading is worth prioritizing.

Secret exposure from error messages fixed

A problem where plugin and marketplace errors were displaying tokens and passwords contained in git source URLs has been fixed. Additionally, a problem where /mcp and /plugin server details, claude mcp list / get, and MCP login errors were displaying secrets resolved from ${VAR} placeholders in MCP configuration has also been fixed.

In environments that pass credentials through git URLs with authentication or ${VAR} secrets, it would be worth checking places where previous output may remain.

Trying out plugin --json

I confirmed which subcommands got --json and what claude plugin list --json actually outputs. All of these are read-only commands.

% claude plugin install --help
:
  --json                Print one machine-readable result line on stdout instead
                        of the human message (same exit codes; a
                        marketplace-declared command is still shown and must be
                        confirmed — pass -y when not interactive)
:

Prints a machine-readable result on stdout instead of the human-facing message (exit codes are the same; marketplace-declared commands are still shown and require confirmation — pass -y when not interactive).

The --json option outputs machine-readable results, making it easy to format or output the necessary information.

For example, here is how to get the id, version, scope, and enabled fields for the first 3 records:

% claude plugin list --json | jq '[.[] | {id, version, scope, enabled}] | .[0:3]'
[
  {
    "id": "aws-agents-for-devsecops@agent-toolkit-for-aws",
    "version": "1.1.0",
    "scope": "user",
    "enabled": true
  },
  {
    "id": "aws-agents@agent-toolkit-for-aws",
    "version": "1.0.0",
    "scope": "user",
    "enabled": true
  },
  {
    "id": "aws-agents@claude-plugins-official",
    "version": "1.0.0",
    "scope": "user",
    "enabled": true
  }
]

--json appeared with the same description in the help for uninstall / update / enable / disable as well as install.

Now that --json is available not just for list but also for install, uninstall, update, enable, and disable, it feels much easier to build workflows that check the state of installed plugins from scripts and apply diffs.

Update Details

New Features

• When pricing: is configured in gateway.yaml for Claude apps gateway, signed-in Claude Code clients receive the same rates via managed configuration, and /cost and telemetry align with the spending meter
• A startup warning is now shown when access_control.allow_cidrs is empty in the gateway, and a one-time warning is also shown when the first request arrives from a public address
• A gatewayInternalNetworks managed setting has been added that allows administrators to permit /login to the Claude apps gateway from the organization's own public IPv4 blocks
• claude self-hosted-runner --remove-session-state (off by default) has been added to delete per-session directories under <base-dir>/_sessions/ when a session ends
• configDirectory has been added to the output of claude auth status --json
• Published Artifacts now include a browser tab icon chosen by Claude to match the page content
• [VSCode] The save destination for always-allow permission rules can now be changed with left and right arrow keys (for keyboard users and screen reader users)
• [VSCode] A "Claude Code: Focus last message" command has been added to move keyboard focus to the latest message in the conversation
• [Claude Tag] A link back to the organization's Claude in Slack admin settings has been added from the Slack channel settings page
• [Code Review] A note has been added below the list of unresolved comments in follow-up reviews, indicating that comments must be resolved (not just replied to) to avoid being counted as unresolved in future reviews

Improvements

• With --continue / --resume, the conversation now appears immediately without waiting for the SessionStart hook to complete, and the full transcript is no longer re-read on the first message
• In fullscreen mode, when adding or removing prompt lines (Shift+Enter), the displayed transcript is not redrawn; only the input area redraws at typing speed
• In turns with heavy tool use, the transcript is no longer redrawn for hidden per-tool-batch reminders
• For projects with scripts in .claude/workflows/, each script is no longer parsed during listing, improving startup time
• Plugin installation, enabling, and disabling via /plugin now take effect when the menu is closed, making a subsequent /reload-plugins unnecessary
• The message Claude receives when denied in auto mode now indicates the name of the blocking rule and encourages trying safer approaches, as well as finishing unrelated work before pausing to ask the user
• In Claude in Chrome, results from reading long pages are now handled inline rather than being saved to a file and re-read
• System prompts on Bedrock, Vertex, and Foundry are now passed as attachments carrying environment, model, and configuration, making the tool list stable in bytes throughout a conversation. This matches the behavior of first-party sessions
• The MEMORY.md truncation warning now shows how many lines were removed and where truncation began
• The startup notification for "N MCP servers need authentication" now appears once per server rather than on every startup
• In local Cowork sessions with all approvals skipped, the Artifact tool now denies reading local files outside the session folder or files accessed via symlinks rather than reading them without confirmation
• [VSCode] Plugin installation, enabling, disabling, and uninstallation in the plugin management dialog now take effect in open sessions without requiring a restart
• [Claude Tag] Read-only searches (Slack search, thread reading, person lookup) are now executed concurrently rather than sequentially, resulting in faster responses
• [Claude Tag] Memory for public channels is now per-channel, and notes saved in other public channels are no longer referenced (workspace-level notes remain shared)

Fixes

Key fixes beyond the three highlighted above (HTTP 400 regression, high CPU usage, WebFetch infinite wait) are as follows:

• File loss in cloud sessions fixed: [Claude Code on the web] Files saved to the persistent session folder were silently lost in cloud sessions running for more than approximately 6 hours. Saved content is now retained for up to 1 day
• Empty message after MCP tool calls fixed: A problem where Claude would respond with "your message came through empty" after MCP tool calls has been resolved
• Missing completions when re-editing prompts fixed: After recalling a previous prompt with the up arrow key and editing it, @ file candidates and / command candidates were not being shown
• Model switching in running sessions fixed: When another Claude Code process updated stale model access information, the running session was silently switching to the organization's default model
• /compact summary corruption fixed: Conversation summaries generated by /compact and auto-compact were corrupting text containing $
• SessionEnd hook timeout setting not working fixed: CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS was not being applied to SessionEnd hooks without a per-hook timeout, causing them to be cut off at 1.5 seconds
• Hooks not firing in --print mode fixed: PermissionRequest hooks were not firing in --print mode
• MCP server OAuth sign-in failure fixed: Sign-in was failing with "No available ports for OAuth redirect" when the local callback port range could not be bound
• Code Review ignoring CLAUDE.md conventions fixed: When a PR edited a root-level file (e.g., README.md), directory-level CLAUDE.md conventions were being ignored simply because the file name matched one listed in CLAUDE.md
• [VSCode] Windows-related issues fixed: The WSL installation prompt no longer appears on machines without WSL installed, and IDE diagnostics for files on the Windows side now return correctly when WSL is present
• A quietly welcome fix: A problem where the spinner wrapped to multiple lines when running task labels were long has been fixed; the label and "Next:" task line now fit on a single terminal line. It's a small change that keeps things to one line in the terminal, but the screen was jumping every time a long task label appeared, so this is a quietly impactful fix
• In addition, numerous minor bugs have been fixed in claude agents operations, plugin validation, Claude in Chrome, the VSCode extension, Claude Tag, Code Review, and more

Breaking Changes

These are listed as Changed in the CHANGELOG, but there are 2 changes that require reviewing your configuration or assumptions.

Task management tools now limited to specific models

Task management tools (TaskCreate / TaskGet / TaskUpdate / TaskList, TodoWrite) are now only available for Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6, and Haiku 4.5. To use them with other models, set CLAUDE_CODE_ENABLE_TODO_TOOLS=1.

# Set the environment variable to use task management tools with unlisted models
$ CLAUDE_CODE_ENABLE_TODO_TOOLS=1 claude

WebFetch permission rules no longer apply to the Artifact tool

Plain WebFetch deny / ask rules no longer apply to Artifact tool reads and updates. To block or add confirmation, use the Artifact rule or WebFetch(domain:claude.ai).

{
  "permissions": {
    "deny": ["WebFetch", "Artifact"]
  }
}

You can also specify "WebFetch(domain:claude.ai)" instead of "Artifact".

Closing

This release includes 2 items where behavior has changed, and both feel like the kind of changes that are easy to miss without reviewing your configuration or assumptions. If you are using a model for which task management tools will no longer appear, or if you were using a WebFetch deny rule to block Artifacts, it would be safe to check your local configuration before upgrading.

For those managing operations with permission rules, or using compatible endpoints, why not try upgrading?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260910-cc-updates-v2-1-267/