Claude Code 2.1.285 lets admins restrict API providers and fixes a token login that skipped org policy

Claude Code 2.1.285 is mostly a fixes release, but the fixes cluster around one theme: what an organization's managed settings actually control. The release adds a provider allowlist, closes a gap where an auth-token login ran without organization policy, and changes what happens when the managed settings file cannot be read.

What managed settings now cover

The new allowedProviders managed setting limits which API providers a machine may use. The list in the notes is the Anthropic API, a custom endpoint, Bedrock, Mantle, Vertex AI, Foundry, Claude Platform on AWS, and a Cloud gateway. Before this, a managed machine could be pointed at any of them.

A second change is easy to misread. When the operating system denies reading the managed settings file, Claude Code used to refuse to start. From 2.1.285 it warns and starts without that file's policies. Other read errors, and a file that cannot be parsed, still stop every session. An administrator who relied on the hard failure now needs to watch for the warning instead.

Fixes that touch security

Sessions that authenticate against the Anthropic API with ANTHROPIC_AUTH_TOKEN never loaded the organization's policy. The notes describe this as fixed, without saying since when it applied. Three other fixes point the same way:

• redacted logs and transcripts showed part of a URL password that contains @, or all of it when the URL writes @ as %40;
• in SDK and -p sessions, switching off an MCP server added mid-session left its tools available;
• fork subagents did not keep the session's plan mode or dontAsk mode, and a fork now runs under its parent's permission mode and cannot exit plan mode.

New switches and commands

The CLAUDE_CODE_DISABLE_WEB_FETCH environment variable turns off the WebFetch tool. claude --desktop opens the Claude desktop app on the current directory, or on a session with --continue or --resume.

Plugins get two additions. claude plugin configure <plugin> shows a plugin's options and which are unset, and claude plugin install --config accepts values in the form <server>.<key>=<value>, so a bundled .mcpb MCP server can be configured at install time instead of through the /plugin menu. Installing a plugin whose id differs from an installed one only in ., -, @, or letter case used to write into the other plugin's cache or data folder; the install is now refused.

One fix removes a daily annoyance: sandbox auto-allow asked for approval on every run of inline scripts such as python3 -c or node -e simply because they contained =.