Claude Code 2.1.284 stops plugins from pre-approving their own tools under managed permission rules

Most of the 2.1.284 release notes fix rendering, vim mode, and error messages. Four groups of changes matter more: security fixes for teams on managed settings, a narrower answer in auto mode, dollar amounts for gateway spend limits, and support for Claude Sonnet 5.5.

Security fixes for managed settings

With the managed setting allowManagedPermissionRulesOnly, plugins from marketplaces, claude.ai, and npm could still pre-approve their own tools through allowed-tools. From 2.1.284, only plugins from an official Anthropic source, or from a source that managed settings vouch for, keep that pre-approval.

Three smaller fixes point the same way:

• ANTHROPIC_FOUNDRY_RESOURCE was inserted into the Foundry endpoint hostname without validation, and a value that is not a plain resource name is now refused;
• rules symlinked into .claude/rules from outside the project were skipped without the external-imports approval prompt, and a .claude directory symlinked from outside the project now asks for the same approval;
• claude mcp add reported success when managed settings restrict MCP servers to plugins, and it now refuses and explains what to do.

A one-time answer in auto mode

Before a read outside the working directories, auto mode asks for permission. That prompt now offers "Yes, but ask again next time", which allows the one read and keeps asking about later ones.

Spend limits in dollars on the gateway

When the Claude apps gateway runs 2.1.284 or later, /usage and the status line show its spend limit in dollars, such as "$271.40 / $500.00 spent this month". The gateway can also authenticate to its identity provider with certificate credentials (private_key_jwt) and forward telemetry to Google Cloud's OTLP endpoint.

A sign-in whose identity provider lists many groups used to get 431 Request Header Fields Too Large on every request. The gateway now accepts request headers up to 256 KiB.

Sonnet 5.5 and fewer failed turns

The release adds Claude Sonnet 5.5 (claude-sonnet-5-5), which the notes describe as the default Sonnet model on the Anthropic API.

When a compacted conversation is still too long, Claude Code now compacts once more instead of repeating the "Prompt is too long" error. MCP tool calls in a resumed session wait up to 10 seconds for a server that is still connecting, instead of failing with "No such tool available".