Major Updates in Claude Code v2.1.303 to v2.1.304 - Addition of Review Levels for Code Review and Fix for claude --worktree Deletion Without Confirmation

This is Ishikawa from the Cloud Business Division. I'll summarize the Claude Code updates for v2.1.303 ~ v2.1.304 (released October 18, 2026 ~ October 19, 2026). v2.1.303 contains only bug fixes and reliability improvements, with the majority of changes included in v2.1.304.

The previous update article is here.

https://dev.classmethod.jp/articles/20261017-cc-updates-v2-1-302/

Update Summary

This covers 2 versions (v2.1.303 ~ v2.1.304, October 18, 2026 ~ October 19, 2026). The CHANGELOG for v2.1.303 contains only a single line stating bug fixes and reliability improvements.

v2.1.304 includes 76 changes. 42 are bug fixes, 19 are improvements, 8 are new features, 3 are security-related, and the remaining 4 are changes to default behavior or specifications, handled in the "Breaking Changes & Deprecations" section. Of the 76 changes, 12 are mod-related, and 12 are changes for VS Code, cloud sessions, Claude Tag (Slack), and Code Review.

Additionally, the official X account announced the release of OSS Scanner.

This is expected to reduce vulnerabilities unintentionally introduced into widely-used OSS (such as memory corruption or input validation errors) at the upstream level, raising the quality of that OSS's dependencies and thereby indirectly reducing risk for downstream users as well.

https://x.com/ClaudeDevs/status/2112299602510749992

This GitHub project is not a place to distribute tools, but rather a registry for applying to participate in the scan service. When a maintainer submits a PR adding a projects/<name> directory, the scanner builds the project in an isolated VM, analyzes it without internet access, and sends the results by email to primary_contact. The included tools/ directory is for verifying in advance that your project builds correctly on the scanner. This is not a dependency vulnerability diagnostic tool per se.

Notable Updates

Review Levels Added to Code Review (v2.1.304)

Review levels have been added to Code Review. Organization Owners can set one of Quick, Standard (default), or Deep for their organization, and can also set individual levels per repository.

For Owners using Code Review in their organization, it may be worth considering using different levels per repository, such as setting only high-priority repositories to Deep.

/auto-mode-setup Now Available on Bedrock, Vertex, Foundry, and More (v2.1.304)

The guided setup /auto-mode-setup, which reads projects and recent sessions to inform auto mode about the environment, is now available for Bedrock, Vertex, Foundry, Claude apps gateway sessions, and sessions with telemetry disabled. The CHANGELOG entry begins with "Added," but according to the docs, /auto-mode-setup itself has been available since v2.1.228; what's new in this entry is the expanded range of supported environments.

If you use Claude Code via Bedrock, Vertex, or Foundry and haven't been providing environment information to auto mode, it may be worth trying /auto-mode-setup.

Usage Limit Warning When Resuming Conversations on Pro/Max Plans (v2.1.304)

On Pro and Max plans, a warning is now displayed when resuming a conversation that hasn't been used for a while, if doing so would consume a significant portion of the 5-hour usage limit. You can choose to resume the conversation or start a new one. If you mention the previous conversation in a new one, Claude can reference it.

If you tend to approach the 5-hour usage limit, choosing to reference the previous conversation from a new one when a warning appears may help you conserve your usage allowance.

Fix for claude --worktree Deleting Worktree and Branch Without Confirmation (v2.1.304)

When using claude --worktree with HEAD in a detached state or on a different branch, the worktree and its branch could be deleted without confirmation upon exit, potentially losing commits. This issue has been fixed.

If you sometimes switch branches or enter a detached HEAD state while working with claude --worktree, it is recommended to update as soon as possible.

Fix for rm -r on Mounted Drives Not Showing Safety Confirmation (v2.1.304)

rm -r on mounted drives or top-level folders (/Volumes, /media, WSL's /mnt/c) was not showing the same safety confirmation as rm -rf /Applications. This issue has been fixed.

This fix is relevant for those who rely on Claude Code for operations involving deletions on external drives or WSL's /mnt/c.

Added decider: "person" to mod tool.check (v2.1.304)

You can now specify decider: "person" in the response to a mod's tool.check event. Confirmations (asks) with this specification can only be approved via a permissions dialog or host callback. In environments where no person is available to confirm, the request is denied with the reason provided by the mod. tool.check is a mod event that occurs when Claude Code decides whether to execute a tool call.

This specification is well-suited for mod authors and administrators who want certain tool calls to always require human approval.

Addition of /claude-api managed-agents-secure (v2.1.304)

/claude-api managed-agents-secure has been added. It compares the configuration of Managed Agents agents against Anthropic's published security guide. The configuration is not modified during comparison.

For those running agents with Managed Agents, this can be used for periodic checks without changing any settings.

Target Versions and Period

New Features

• [Code Review] Review levels have been added. Owners can set Quick, Standard (default), or Deep for their organization, and can also configure individual levels per repository (v2.1.304).
• [Code Review] An option has been added to the admin settings to include all repositories in a GitHub organization (including those added later) as review targets without selecting them one by one (v2.1.304).
• /auto-mode-setup is now available for Bedrock, Vertex, Foundry, Claude apps gateway sessions, and sessions with telemetry disabled (v2.1.304).
• On Pro and Max plans, a warning is now displayed when resuming a conversation that hasn't been used for a while, if doing so would consume a significant portion of the 5-hour usage limit (v2.1.304).
• The compaction summary in transcript view (Ctrl+O) now shows the names of tools that were called before it (v2.1.304).
• e.isReadOnly has been added to mod tool.check events. It is set when the tool call is read-only (v2.1.304).
• When a previously executed plugin skips its own mod hook, the event name and plugin name are now displayed as a single line in the transcript (v2.1.304).
• [VS Code] Mod rendering in the chat panel is now available for Amazon Bedrock, Google Vertex AI, and Microsoft Foundry sessions, sessions via LLM gateway, and sessions with telemetry disabled (v2.1.304).

Improvements

• [Cloud Sessions] Local (stdio) MCP servers for plugins synced from claude.ai no longer cause the first turn of a new conversation to wait (unless the server has alwaysLoad: true set) (v2.1.304).
• In auto mode, safety classifier context is no longer saved per request, reducing the size of session files (v2.1.304).
• Warnings about invalid configurations in claude -p have been improved. For files that could not be loaded, only the reason loading stopped is shown, and long lists are limited per file (v2.1.304).
• In SDK and headless mode, the first request is now sent faster when resuming a large compacted session (v2.1.304).
• Responsiveness and throughput have been improved when running many subagents concurrently (v2.1.304).
• Memory usage has been improved when sending requests in long or resumed conversations (v2.1.304).
• The skill list is now re-sent to Claude after compaction. /reload-skills only sends new or changed skills (v2.1.304).
• [VS Code] Background subagents now display a single-line status under the Agent card instead of streaming each step to the chat. The full transcript can be viewed in /tasks (v2.1.304).
• Additionally, improvements and changes have been made to /usage rate limit display, numbered choices for /artifacts deletion confirmation, display when loading mods written in-session, Self-hosted runner error display, git command startup on Windows, ant CLI usage for /claude-api skills on Claude Platform on AWS, and the /fast dialog wording for Opus 5.5 (v2.1.304).

Security

• You can now specify decider: "person" in the response to a mod's tool.check event. Confirmations with this specification can only be approved via a permissions dialog or host callback, and are denied with the reason provided by the mod in environments where no person is available to confirm (v2.1.304).
• /claude-api managed-agents-secure has been added. It compares the configuration of Managed Agents agents against Anthropic's published security guide without modifying the configuration (v2.1.304).
• Fixed an issue where rm -r on mounted drives or top-level folders (/Volumes, /media, WSL's /mnt/c) did not show the same safety confirmation as rm -rf /Applications (v2.1.304).

Fixes (Major)

Excerpted primarily from fixes related to stability and usability.

• Fixed an issue where claude --worktree deleted the worktree and branch without confirmation: When HEAD was in a detached state or on a different branch, the worktree and its branch could be deleted without confirmation upon exit, potentially losing commits (v2.1.304).
• Fixed an issue where plugins caused headless execution not to terminate: Plugins launching subagents or re-executing completed ones caused headless execution to continue past --max-turns, Stop, or end of input (v2.1.304).
• Fixed an issue causing operations to stall in SDK and desktop sessions: Model switching, messages, and interruptions were being held up waiting for context usage checks (v2.1.304).
• Fixed context_management errors via LLM gateway: A context_management: Extra inputs are not permitted error was occurring via LLM gateway. Requests are now retried without this field (v2.1.304).
• Fixed an issue where environment variables could not be referenced in the Code tab of Claude Desktop: On macOS and Linux, Bash commands outside the sandbox could not reference environment variables exported in shell startup files such as ~/.zshrc (v2.1.304).
• Fixed an issue causing "Context limit reached" and similar errors when stopping during compaction: Stopping a turn during compaction of a conversation that the API rejected as too long resulted in "Context limit reached" or "Prompt is too long" errors (v2.1.304).
• Fixed an issue where subagents forgot their most recent work: Subagents that received a message or were resumed immediately after completion could sometimes forget the content of their most recent work (v2.1.304).
• Fixed one cause of session startup timeouts in VS Code: One cause of the "Subprocess initialization did not complete within 60000ms" startup failure has been fixed; the execution time of SessionStart command hooks is now excluded from the time limit, up to a total of 10 minutes (v2.1.304).
• A subtle but welcome fix: Fixed an issue where CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k was silently being treated as a 100K window. It now accepts k and M suffixes like --autocompact, and warns for out-of-range or ignored values (v2.1.304). Those who specified the auto-compaction window via environment variable may want to review whether the intended value was being used.
• Additionally, numerous minor bugs have been fixed in Remote Control, mod reloading, Linux sandboxing, Cowork cloud sessions, the VS Code extension, Claude Tag (Slack), Code Review, and more (v2.1.303~v2.1.304).

Breaking Changes & Deprecations

This section covers 4 changes listed as "Changed" in the CHANGELOG that may affect existing configurations or behavior. No deprecations are noted.

Default Enablement of tool search with Custom ANTHROPIC_BASE_URL (v2.1.304)

Tool search is now enabled by default in environments using a custom ANTHROPIC_BASE_URL. If the gateway returns 400 or 422, the request is retried without tool search.

The following are example commands (URLs are for illustration). The fact that tool search was not previously enabled by default is inferred from the CHANGELOG's statement that it was "changed to enabled by default."

Before the change (~v2.1.303):

# Start with a custom ANTHROPIC_BASE_URL (LLM gateway)
ANTHROPIC_BASE_URL=https://llm-gateway.example.com claude

After the change (v2.1.304~):

# Same startup as above, but tool search is now enabled by default
# If the gateway returns 400 or 422, the request is retried without tool search
ANTHROPIC_BASE_URL=https://llm-gateway.example.com claude

allowed-tools for Skills Under Policies That Only Permit Plugin-Originated Hooks (v2.1.304)

The CHANGELOG entry, organized into a table, is as follows. This only applies to skills meeting the conditions in the table below, not all skills.

Hook Limit for Skills (v2.1.304)

The CHANGELOG entry, organized into a table, is as follows. "Source" refers to any of the following: repository, personal folder, or plugin.

The behavior when the limit is exceeded is not described in the CHANGELOG.

mod settings.read Hook (v2.1.304)

The CHANGELOG entry, organized into a table, is as follows.

Since the pre-change specification is not stated in the CHANGELOG, it is uncertain whether existing settings.read hooks are affected. If you have mods using settings.read hooks, please verify their behavior in v2.1.304.

Closing Notes

v2.1.303~v2.1.304 includes Code Review review levels and an expanded range of environments for /auto-mode-setup, as well as fixes for bugs that could have caused loss of work, such as safety confirmations for claude --worktree and rm -r. There are also changes to default behavior around mods, skills, and gateways, so those distributing configurations within an organization may want to review the Breaking Changes section.

If you use mods, skills, LLM gateways, or Code Review, why not update and check the changes for yourself?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20261017-cc-updates-v2-1-302/