Claude Code 2.1.285: What allowedProviders Actually Locks Down

Anthropic shipped Claude Code 2.1.285 on September 29, 2026, and buried inside what reads like a routine point release is a setting that decides which cloud a company's entire Claude Code traffic is allowed to touch. I read the changelog the morning it landed because Claude Code is the tool I use to build RAXXO products, and this one had more in it than the version bump suggested. Two of the additions I turned on the same day I read about them.

I almost skipped this release. The version number looked routine.

What Changed in Claude Code 2.1.285?

Six additions landed alongside a long list of fixes. claude --desktop opens the Claude desktop app on your current directory, or on a specific session with --continue or --resume <id>, so you can hand a terminal session to the GUI without retyping anything. claude plugin configure <plugin> shows a plugin's options and flags which ones are still unset, and can save new values it reads from stdin with --values-stdin. A new form of claude plugin install --config, written as <server>.<key>=<value>, lets you set a bundled MCP server's own settings at install time, so a plugin that needs configuration starts working immediately instead of sitting half set up until someone visits /plugin and clicks Configure.

Then there's CLAUDE_CODE_DISABLE_WEB_FETCH, an environment variable that turns off the WebFetch tool entirely, and CLAUDE_CODE_NONSTREAMING_TIMEOUT_RETRIES, which caps how many times a timed-out non-streaming fallback request gets resent. The sixth, allowedProviders, is the one worth its own section below.

This release comes one day after 2.1.284, which added Claude Sonnet 5.5 as the default Sonnet model on the API. I wrote about what shipped with Sonnet 5.5 yesterday, so I'm not repeating the model details here. What's worth noticing is the pattern: a model release followed a day later by a tooling release that tightens configuration and reliability. That's been the rhythm for months now, and it's a reasonable one. Ship the model, then ship the plumbing that lets teams actually control how it gets used.

The fix list is long, more than eighty items by my count, covering everything from Remote Control message delivery to VS Code tab behavior to how redacted logs handle URL passwords. I'm not going to walk through all of them.

A handful matter enough to a solo builder that they get their own section further down. The rest is the kind of maintenance that never makes a headline but keeps the tool from rotting at the edges, the same way removing the subagent spawn cap back in August didn't make headlines either, until it quietly changed how long a session could run.

What Does allowedProviders Actually Lock Down?

It restricts which API providers a machine is permitted to use for Claude Code at all. The options are the Anthropic API directly, a custom endpoint, Amazon Bedrock, Mantle, Google Cloud's Vertex AI, Microsoft Foundry, Claude Platform on AWS, or a Cloud gateway. An administrator picks one or more of those eight and writes the choice into a managed settings file, the kind Claude Code documentation describes as sitting above every other configuration level. A developer's own settings.json, their project settings, and even flags passed on the command line can't widen or remove that restriction. It's enforced, not suggested.

Picture a company that has standardized on Bedrock for compliance reasons, maybe data residency, maybe an existing AWS spend commitment. Before this setting, nothing stopped a developer from pasting a personal Anthropic API key into their own config and quietly routing traffic outside the approved path. allowedProviders closes that gap at the policy level instead of relying on a Slack message asking everyone to please use the right endpoint.

For a one person studio like mine, this setting doesn't do anything. There's no fleet of developer machines to lock down and no managed settings file sitting above my own. I don't have an IT policy to enforce on myself.

But it tells me something about where Claude Code is heading as more teams adopt it. The tooling around governance keeps getting more specific, one enforceable setting at a time, rather than staying at the level of a written policy nobody can actually check.

Is This Worth Updating For as a Solo Builder?

Yes, and the reason isn't allowedProviders. Two of the six additions are things I'd use this week. claude --desktop solves a specific annoyance: starting something in the terminal, then wanting the richer view the desktop app gives you, like the diff panel or the artifact preview, without losing the session. Now I just run claude --desktop --continue and it picks up where the terminal left off.

claude plugin configure is the other one. I've got a handful of plugins installed across my RAXXO tooling, and more than once I've hit a stale setting I forgot I'd left unset. Running configure on each one and seeing exactly which options are blank beats digging through a settings file by hand.

The <server>.<key>=<value> addition to claude plugin install --config is smaller but solves a real annoyance too. A bundled MCP server that ships inside a plugin used to sit half configured until I remembered to open /plugin and click through to Configure. Now I can pass the values at install time and the server just starts working, no second step to forget. It's a small piece of the same trend I noticed when MCP went stateless: the protocol and the tooling around it keep getting tightened at the edges, one release at a time.

What I'd skip: allowedProviders, for the reason above, and CLAUDE_CODE_NONSTREAMING_TIMEOUT_RETRIES unless I actually hit the specific failure it's built for. It's a narrow env var for a narrow edge case, not something to set defensively.

Not every addition needs a use case on day one.

Here's the concrete number worth knowing, buried in the fix list rather than the additions. A failing API request used to get retried up to 21 times when streaming kept failing over to a non-streaming fallback, each retry adding its own delay. Now streaming and its fallback share one retry budget, so a request that's genuinely failing gives up sooner instead of quietly eating minutes. That's the kind of stall I'd have blamed on a bad connection before, without knowing it was quietly retrying against a budget that size. Knowing there's a ceiling, and that the ceiling just got tighter, changes how long I wait before I assume something's actually broken.

What Else Got Quietly More Reliable?

A few of the smaller fixes matter more than their one-line description suggests. Switching off an MCP server that was added mid-session used to leave its tools available anyway, which meant a server you thought you'd disabled could still get called. That's fixed now, and it's the kind of bug that's easy to miss because nothing crashes, a tool just quietly keeps working when it shouldn't.

Remote Control got a real reliability fix too. A file attached to a message sent from the phone app used to disappear if the first download attempt failed, no retry, no warning. It now retries up to twice on a network error, timeout, or server error before giving up. I use Remote Control to nudge sessions from my phone when I'm away from the desk, usually to attach a screenshot of something broken. Losing that screenshot silently would have meant redoing the whole exchange.

The Artifact tool picked up two related fixes around a scenario that's easy to land in: publishing after rewinding a conversation with Esc Esc. Before this release, a publish after a rewind could overwrite a file's newer content with an older version Claude had only seen in the rewound turns. It's now refused until Claude re-reads the file first, which is a small amount of friction in exchange for not silently destroying newer work. Cloud sessions that restart after a conversation gets compacted also stopped refusing updates to artifacts the session had already read, a bug that would have made resuming a long session in the cloud unreliable right when you need it to just work.

One more worth a mention: plugin and marketplace installs over SSH used to ignore whatever SSH program you'd set in GIT_SSH or your git config's core.sshCommand, silently falling back to the system default instead. That's the kind of fix nobody notices until they're on a machine with a nonstandard SSH setup and can't figure out why a plugin install keeps hanging.

There's also a smaller privacy fix buried in the same list. Redacted logs and transcripts used to show part of a URL's password, or all of it when the URL wrote its "@" symbol as "%40" instead of the plain character. It's an easy detail to miss when you're building a redaction rule, and exactly the kind of gap that only gets found by someone actually reading what a "redacted" log looks like line by line.

None of these show up in a demo. They show up the first time you're relying on exactly the behavior they fix, and it quietly does the wrong thing instead.

Bottom Line

2.1.285 doesn't carry the kind of breaking changes Sonnet 5.5 shipped with the day before. It's a maintenance release with two genuinely useful additions for a solo builder, one enterprise setting that changes nothing for anyone running Claude Code alone, and a long fix list where three or four entries are worth knowing even if you'll never read the full changelog line by line.

My actual plan: update today, since none of this breaks anything I run. Try claude --desktop --continue the next time I want the richer view mid-session, and run claude plugin configure across my installed plugins to check nothing's sitting on a stale default. Ignore allowedProviders entirely unless a client or collaborator ever needs Claude Code locked to a specific provider, at which point I'll know exactly where to look. And keep the 21-retry number in the back of my head. It's the kind of detail that explains a stall you've already seen and will see again, long after you've forgotten where you read about it.