claudekit / updates / claude-code-2-1-305
[ PATCH · ]

Claude Code 2.1.305

Fixes every request failing on Vertex, Bedrock and other providers when the endpoint or a gateway rejects tool search (a 2.1.304 regression). Adds `sandbox.allowNestedUserNamespaces` for Linux sandboxed commands and `CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS` for unattended retry mode, and turns each `/usage` warning into a one-line fix that `f` applies.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.305 shipped on October 20, 2026. The headline fix is a 2.1.304 regression that made every request fail on Vertex, Bedrock and other providers whose endpoint or gateway rejects tool search. The release also adds a Linux sandbox setting and a recheck interval for unattended retry mode, and improves /usage warnings, MCP consent dialogs and Remote Control messages. The fixes span worktrees, model settings, MCP, subagents, cloud sessions, Workflow, display and screen reader mode, self-hosted runners, the VS Code extension, Claude Tag and Code Review.

New features

  • sandbox.allowNestedUserNamespaces (Linux)

    Lets sandboxed commands on Linux create user namespaces, which tools such as Chromium and rootless podman need. Note that this lets those commands get around the sandbox’s file protections.

  • CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS

    Unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) now notices a usage limit that was lifted before its reset, instead of waiting for the reset time.

  • [VSCode] “Running start-up hooks” status

    A spinner status, with a screen reader announcement, shows while SessionStart or Setup hooks run.

  • [Claude Tag] Unjoined public channels in Add place

    Public Slack channels Claude hasn’t joined now appear in the Claude Tag admin Add place search, so admins can set one up from there.

Key improvements

  • /usage warnings you can fix in place

    Each /usage warning is now a one-line fix that names its source, and pressing f applies the fixes. The same fixes appear in VS Code and /doctor.

  • MCP consent dialogs

    An Enter meant for the prompt is less likely to be taken as Accept.

  • Mod images in iTerm2

    A mod’s Image now draws its picture in iTerm2 3.5 and later with fullscreen rendering, where it showed only its alt text.

  • Remote Control spawn-mode messages

    Pressing w now says the new mode is saved for the folder, and a later claude remote-control start that uses the saved mode says where it came from.

  • [VSCode] Session start timeout message

    When a session does not start in time and no hook is running, the message now leads with the output logs and lists causes instead of pointing to sign-in and network first.

  • [Cloud sessions] Deleting a self-hosted environment

    The dialog and error messages now say what blocks the delete and what it will affect.

  • [Claude Tag] Admin pages in large organizations

    Plugin, skill and bundle edits now work while the channel list is still loading.

Changed behavior

  • allowedMcpServers and managed-mcp.json

    allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only in env. One your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off.

  • allowed-tools for path-mounted plugins

    Plugins that Claude Desktop mounts by path no longer keep their allowed-tools when your organization’s managed settings set allowManagedPermissionRulesOnly.

  • /artifacts delete confirmation

    1 or Enter keeps, 2 deletes, and Esc cancels; y and n no longer answer it.

  • Mod docked pane width

    A mod’s docked pane now stays within 45% of the terminal’s width, including a width kept from a wider terminal.

  • [Code Review] Re-reviews

    Re-reviews no longer open with LGTM while earlier blocking findings are still open.

Bug fixes

Request failures & model settings

  • Every request failing on Vertex, Bedrock and other providers when the endpoint or a gateway rejects tool search, and behind gateways with ToolSearch disallowed or left out of --tools (a 2.1.304 regression). Claude Code now retries without it.
  • /effort and /autocompact settings not applying when the model name differed from a modelOverrides value by letter case or a [1m] tag.
  • Claude naming the wrong model for a subagent’s work after the subagent switched to a fallback model.

Worktrees & Bash

  • New worktrees in a bare repository sometimes starting from local HEAD instead of the default branch, and unchanged subagent worktrees sometimes not being cleaned up.
  • Bash commands on a full disk failing with a raw ENOSPC file path; the error now says the disk is full and that nothing ran.

MCP, cloud sessions & Workflow

  • An MCP server passed by a cloud session or by the SDK’s setMcpServers being replaced later in the session by a same-named server from your own settings.
  • Cloud sessions and teammates not telling Claude when a compaction had to leave the oldest messages out of its summary to fit.
  • More cases of scheduled Cowork cloud sessions waiting five minutes for each subagent whose WebFetch needed a URL approval that nobody was there to give.
  • Workflow resume re-running already-completed pipeline() and parallel() agents instead of serving them from the run’s journal.
  • Remote Control leaving empty “(session)” entries in /resume after switching conversations with /resume.
  • [Cloud sessions] The Cloud environments admin page wrongly refusing to save an existing environment with an “installs packages” error.

Display & accessibility

  • /usage rows being cut off in narrow terminals.
  • Startup warnings printing as raw text above the logo; they now go to the debug log, and permission rules that restrict nothing show as warning rows under the banner.
  • Screen reader mode: search boxes now say “Search:” instead of a symbol VoiceOver read as “telephone recorder”, and highlighted prompt text, such as Ctrl+R search matches and “ultrathink”, no longer has spaces inside words.
  • [VSCode] The spinner cutting off “Compacting…” when your spinnerVerbs setting replaces the built-in verbs with short ones.

Self-hosted runner

  • A start script that shares only its stdout with the runner or orchestrator failing with Resource temporarily unavailable when TERM is set (a 2.1.300 regression).
  • Repository access failing since 2.1.296 when a git credential helper or askpass program reads its settings through GIT_CONFIG.
  • The orchestrator reporting a spawn-runner hook as timed out when a runner it started in the background kept its output open.

Claude Tag (Slack) & Code Review

  • Claude Tag access bundles not accepting a repository again after it moved to another GitHub account.
  • A routine set up in a Slack DM thread no longer posting after another routine in that thread restarted the conversation; both now keep posting there.
  • Routines set up in a Slack thread reporting success without posting after the conversation ended; those runs are now skipped and the creator is told.
  • [Code Review] Code Review sometimes not reviewing the newest commit when several pushes landed on a pull request during a review.

Notes

  • If every request failed on Vertex, Bedrock or behind an LLM gateway in 2.1.304, updating to 2.1.305 fixes it.
  • If you manage MCP servers with managed-mcp.json and allowedMcpServers, stdio servers that use ${VAR} only in env may now load on upgrade. Add them to deniedMcpServers to keep them off.
  • If you turn on sandbox.allowNestedUserNamespaces, sandboxed commands can get around the sandbox’s file protections. Use it only for tools that need user namespaces, such as Chromium or rootless podman.
  • If you answered the /artifacts delete confirmation with y or n, use 1 (keep), 2 (delete) or Esc (cancel) instead.