Claude Code v2.1.304 Adds Managed Agent Security Audits and Refines Mod Controls

Extension and plugin governance#

• Strict human permission enforcement: Plugin mods can now return decider: "person" in a tool.check response. This restricts approvals strictly to interactive prompt dialogs or host callbacks, automatically refusing the action with the mod’s specified reason if no human is available to decide.
• Read-only state detection: Mod developers can check e.isReadOnly on tool.check events to determine if an incoming tool call is read-only.
• Hook execution transparency: Transcripts now record an explicit line whenever an earlier plugin skips a mod’s hook, identifying both the plugin name and the skipped event.
• Audit utilities: Introduced /claude-api managed-agents-secure, a diagnostic command that benchmarks a Managed Agent’s settings against Anthropic’s published security guide without modifying existing settings.

Environment and auto-mode updates#

• Expanded auto-mode availability: The /auto-mode-setup command—which analyzes project context and recent sessions to train auto mode on local environments—is now supported on Amazon Bedrock, Google Cloud Vertex AI, Palantir Foundry, Claude apps gateways, and telemetry-disabled environments.
• Context and usage warnings: Pro and Max plan users now receive a warning when resuming an inactive conversation that would consume a substantial portion of their 5-hour usage cap, prompting them to either resume or start a fresh session that references the previous history.
• Transcript compaction visibility: Summary views (accessible via Ctrl+O) now list the names of tools called earlier in the session alongside the compacted summary.

Critical fixes#

• Command execution and safeguards: Extended filesystem deletion warnings (rm -r) to root-level mount locations such as /Volumes, /media, and WSL’s /mnt/c. Fixed Linux sandbox crashes caused by non-character-class brackets in sandbox.filesystem.denyRead path globs (e.g., [user-id] route directories).
• Unattended and cloud executions: Fixed an issue where scheduled Cowork cloud sessions suffered 5-minute timeouts per subagent when WebFetch calls requested URL approvals without a human operator. Fixed a bug where headless sessions continued running past --max-turns or manual stop signals due to spawned subagents.
• Integration and gateway fixes: Removed unsupported context_management: Extra inputs are not permitted fields when communicating behind custom LLM gateways. Resolved thread blocking where model switches and message inputs queued behind background context checks in SDK and desktop environments.

These updates expand on previous control mechanism improvements seen in Claude Code v2.1.295 and earlier plugin mod system enhancements.