Claude Code 2.1.268: The Three-Version Gateway Breakage Operators Missed, and Four New Controls

If you run Claude Code against a third-party Anthropic-compatible endpoint — a self-hosted proxy, an AI gateway, or any service behind ANTHROPIC_BASE_URL — you have been getting HTTP 400 on every turn since version 2.1.265. Not on some requests. Every request.

Version 2.1.268, released today, fixes it. It also ships four operator-facing controls that change how gateway teams configure network access, pricing visibility, and prompt-cache behavior.

The HTTP 400 Regression: Three Versions, Every Turn

The regression landed silently in 2.1.265. A regex added to the Artifact tool's JSON schema — one that Anthropic's own endpoints handle — was rejected by third-party endpoints as an invalid schema property. The effect was total: the server returned 400 before Claude could produce any output.

Teams running proxies or gateways behind ANTHROPIC_BASE_URL would have seen a wall of 400 errors starting from whatever version their users auto-updated to. The CHANGELOG lists it as a bugfix with no "regression since" annotation, so without version-pinning or detailed error logs, the affected window (2.1.265 through 2.1.267) wasn't obvious.

The immediate action: upgrade to 2.1.268. If you manage a gateway and have seen elevated 400 rates in the last week, this is the cause.

For teams that pin versions in managed deployments, audit your Claude Code version floor. Any floor between 2.1.265 and 2.1.267 inclusive has been silently breaking third-party endpoint traffic.

gatewayInternalNetworks: Scoped Login Without Public Exposure

Until now, the Claude apps gateway's /login endpoint either required addresses in access_control.allow_cidrs or was blocked from outside addresses entirely. For organizations that run their gateway on a public IPv4 block — a cloud VPC with a routable address, for example — allowing logins without opening allow_cidrs to the internet was awkward.

The new gatewayInternalNetworks managed setting lets administrators specify their organization's own public IPv4 block as "internal." Clients on those addresses can reach /login without being listed in the general allow_cidrs allowlist, and the gateway now logs a startup warning when allow_cidrs is empty — plus a one-time warning on first public-address request, so the exposure is visible.

Configuration sits in gateway.yaml under managed_settings:

managed_settings:
  gatewayInternalNetworks:
    - 203.0.113.0/24   # your org's public block

The practical split: allow_cidrs governs all authenticated API traffic; gatewayInternalNetworks governs the login path separately. Teams running gateways inside corporate networks that happen to use public IP space now have a clean separation without relaxing allow_cidrs.

Pricing Sync: /cost and Telemetry Now Match the Spend Meter

When a gateway operator sets pricing: in gateway.yaml, Claude Code's /cost command and its telemetry output previously reflected Anthropic's published list prices, not the rates the gateway was actually applying. This created a reconciliation gap: the spend meter showed one number, the client showed another.

From 2.1.268, signed-in clients that reach a Claude apps gateway with pricing: configured receive those rates as a managed setting. /cost and session telemetry now reflect the operator-configured pricing. For teams that run internal charge-back accounting or show spend dashboards to users, this is the fix that makes the client's output trustworthy.

Bedrock, Vertex, and Foundry: Prompt Cache Byte-Stability

This change matters more than it looks. Before 2.1.268, sessions on Bedrock, Vertex, and Foundry delivered the system prompt inline, with the full environment, model, and settings block embedded. Because that block could vary across requests (timestamps, dynamic context), the cache prefix was never reliably stable — meaning prompt cache hits on cloud-provider sessions were inconsistent even when the conversation content hadn't changed.

Two changes ship together:

1. System prompt on Bedrock, Vertex, and Foundry now delivers environment, model, and settings details as attachments, matching how first-party Claude.ai sessions work. The core system prompt text is now stable across requests.
2. The tool list is now byte-stable across a conversation — late-connecting tools load deferred instead of rewriting the tool block in place.

The combined effect is that long-running Bedrock/Vertex/Foundry sessions can now achieve the same prompt cache hit rates as first-party sessions. For teams that run heavy agentic workloads on these clouds, this reduces effective per-request cost without any configuration change — it's automatic once clients upgrade.

There is a behavior change to note: excludeDynamicSections in SDK sessions no longer re-renders the first message on every request. A related fix ensures that prompt caching and extended thinking don't break mid-session when this option is set. If you have instrumentation that expected the first message to appear twice in the request log, it will no longer do so.

Task-Tracking Tools Now Restricted by Model Family

A narrower change worth tracking in managed deployments: TaskCreate, TaskGet, TaskUpdate, TaskList, and TodoWrite are now offered only on Claude 3.x and specific Opus 4/Sonnet 4/Haiku 4 variants. On other model versions, they are off by default.

If your users run these tools against models not in that list (for example, Fable 5.1 or Mythos 5.1), they will no longer appear. You can re-enable them with CLAUDE_CODE_ENABLE_TODO_TOOLS=1, but the default is now restrictive.

The rationale in the CHANGELOG is not stated, but the pattern matches other tool-gating decisions: task-tracking tools have side effects that interact poorly with models whose context handling differs.

What Gateway Operators Should Do Now

Immediate:

• Upgrade all Claude Code deployments to 2.1.268. The ANTHROPIC_BASE_URL fix is critical; 2.1.265–2.1.267 clients are silently broken on third-party endpoints.
• Audit version floors in any managed or pinned deployment.

This week:

• If your gateway uses a public IPv4 block for internal traffic, evaluate gatewayInternalNetworks to separate login access from the general allow_cidrs policy.
• If you have a pricing: block in gateway.yaml, verify that /cost output now matches your expected rates.

For Bedrock/Vertex/Foundry deployments:

• No action required for the prompt-cache improvement — it takes effect automatically on upgrade.
• If you track request sizes for capacity planning, expect system prompt delivery to change shape (attachments vs inline); parser logic that assumes inline delivery may need adjustment.

The gateway regression is the headline, but the Bedrock/Vertex/Foundry prompt-cache stabilization is the change with the largest long-term cost impact for teams that run production agentic workloads on cloud-provider infrastructure.