Claude Code 2.1.286 fixes four cases of exposed credentials and tightens plugin install sources

Claude Code 2.1.286 is a long fixes release, and most of it is polish. Three groups of changes matter if you run it in a team: credentials that slipped past redaction, tighter rules for where plugins come from, and a spend meter that counted too little. The --bare flag also behaves differently enough that scripts relying on it need a check.

Credentials that slipped past redaction

Four fixes deal with credentials that showed up where they should have been masked. The release notes describe all four as fixed and give no detail on how long each problem existed.

• MCP error messages showed a credential's value when Bearer or Basic came before its key name.
• Percent-encoded Bearer tokens were only partly masked in error messages.
• Redacted logs and transcripts showed a secret when its key name contained an invisible character, such as a zero-width space.
• Logs and transcripts showed part of the password in URLs when the password contains punctuation such as ), quotes, ], &, or a second @, or when it runs past a / to a bracketed host such as [::1] in ssh URLs.

Stricter rules for plugins and Remote Control

Plugin installs now refuse npm sources that are git repositories or folders, and plugin dependencies install only from registry packages. This suggests that a plugin whose npm source points at a git repository or a local folder will stop installing until it is published to a registry.

Remote Control sessions, including those started with claude remote-control, used to stay connected after an organization's policy turned Remote Control off. They now disconnect with a notice. A related fix adds a confirmation. The commands /compact, /clear, and /rewind, typed while viewing the transcript of a background agent or a teammate, silently acted on the main conversation. A dialog now names the target and asks first.

Spend metering and retries

The spend meter of the Claude apps gateway priced 1-hour prompt cache writes at the cheaper 5-minute rate. On streamed turns that run a server-side tool such as web search, it also counted only the first model call's input tokens. The notes list both as fixed. This suggests the meter reported less than the actual spend in those cases, so the same usage will show a higher figure after the update.

Retries change too. One limit now covers a whole model call, and with the default retry settings a failing call sends at most 14 requests. When the Anthropic API refuses the model that your default or a model alias resolves to, Claude Code now retries once on the previous model of the same tier. Before this release, every turn failed.

What bare mode does now

The --bare flag now connects only the MCP servers named on the command line, sends the model no system reminders, and starts no background tasks. Under --bare, a shell command that reaches its timeout stops instead of moving to the background. One more fix matters for long sessions: claude --resume and --continue sometimes lost every turn after a batch of parallel tool calls when the earlier session had crashed or been killed.