Claude Code

Claude Code 2.1.305 can resume workflows without repeating completed pipeline() and parallel() agents. Try built-in fork subagents, now enabled by default in headless and SDK runs, before maintaining your own prompt-copy and restart code.

Where the built-in security plugin is active, 2.1.299 by default prevents user plugins from weakening permission requests required by policy.

Where it stands, 2026-10-24

Install 2.1.310 using the pinned npm command below; stable and the ordinary Homebrew cask still lack repairs. Before unattended runs, set permission modes explicitly, test policy enforcement, and preserve recovery outside /rewind. Avoid unreviewed user plugins and nested user namespaces without adequate outer containment. MCP Tasks remains gated public beta; hosted Code Review is GA for Team/Enterprise. Changes on public main after 2.1.310 are documentation and comments only.

Channel. Test and pin non-prerelease 2.1.310 with npm install -g @anthropic-ai/claude-code@2.1.310. At 10:18 UTC on 24 October 2026, npm latest and next were 2.1.310; stable was 2.1.308. The ordinary Homebrew cask also carried 2.1.308, missing 2.1.309’s sandbox and workspace-trust repairs and 2.1.310’s remaining Windows hook fix.

Set the policy before a job starts

Choose the permission mode in every unattended job. Unconfigured claude -p and Agent SDK sessions now start in default on third-party providers, with telemetry disabled, or on a fresh install. If the job needs auto, pass --permission-mode auto explicitly. Before launch, decide what the job may do unattended. Test an action it should refuse and one it should complete.

Test delegated limits before removing your wrappers. 2.1.299 closes mod-prompt routes past turn and budget limits, 2.1.304 closes further spawn/resume routes, and 2.1.309 makes split-pane teammates inherit the leader’s command-line tool deny and --tools rules. Before deleting your delegation wrapper, test a child hitting its limit and attempting a denied tool. Count completed jobs and the minutes you spend approving, investigating and recovering them. Make the native path earn its keep on that total, and retain external spend controls where the job requires them.

Choose which user plugins may run. Claude Code calls these plugins mods. These plugins can start processes with your access; environment pins do not contain their code. The guard depends on managed policy or the relevant Team/Enterprise sign-in. To reject user mods on load or reload, set allowManagedModsOnly: true under the built-in guard’s managed pluginConfigs options. Administrators can relax the verdict holds; ordinary permission-dialog asks are not universally protected.

Keep consequential approvals person-only when the job demands it. 2.1.304 adds decider: "person", refusing when neither a dialog nor host callback can answer. Regenerate installed mod types before using it: 2.1.310’s public mirror still lists only host.

Check policy as the account running the job. When no admin source supplies policy, an OS-denied managed-settings read is reported and skipped; other read failures stop startup. Check which policy sources loaded before relying on their restrictions.

Test that policy-hook failures block actions. Set onFailure: "block" on applicable command or HTTP hooks; continuing remains the general default. On Windows, test missing Git, PowerShell exits and quoted executable paths against 2.1.309 and 2.1.310. PermissionRequest needs decision JSON to deny a call; exit 2 does not deny it. Failed plugin-event delivery can withhold an already-run tool’s result. Reconcile the tool’s effects before retrying.

Choose the containment and recovery boundary

Test the containment paths your commands use. 2.1.309 repairs shell startup outside the sandbox on macOS/Linux, MCP-config writes, macOS symlinked write denies and Linux write denies on background commands that outlive the session. Test those paths with disposable targets. File deny rules cover recognized shell commands and redirects, not arbitrary Python/Node file access or recursive commands that omit the target. Keep a process boundary around untrusted code.

Leave nested user namespaces off unless an outer boundary is adequate. The opt-in sandbox.allowNestedUserNamespaces can enable Chromium/Electron workloads while letting malicious commands escape Claude Code’s restrictions, including protected paths and credential-file rules. The setting alone is insufficient for rootless Podman or Buildah.

Check the Python SDK separately from the CLI. When an application forwards an untrusted resume ID, claude-agent-sdk below 0.2.121 lets an attacker inject MCP configuration and execute commands at startup outside SDK permission controls; use 0.2.121 or later. The fix shipped on 17 July 2026; 16 October 2026 was its NVD publication. Check that dependency even when upgrading the CLI.

Inspect the MCP servers admitted after upgrading. From 2.1.305, managed stdio definitions whose substitutions occur only in env are no longer filtered by allowedMcpServers. Compare connected servers with policy intent and use deniedMcpServers for explicit prohibitions.

Remove obsolete Remote Control flags. claude remote-control now rejects --sandbox and --no-sandbox, which previously did nothing; use sandbox.enabled. Check launch wrappers before upgrading.

Recheck deletion policy that depended on prompts. 2.1.299 stops prompting for runtime-built rm in unreadable scripts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1 is set. In Desktop and VS Code bypass mode, 2.1.309 instead makes dangerous rm/rmdir prompts deny immediately with a rewrite hint. Test the intended refusals before leaving those jobs unattended.

Keep recovery independent of session cleanup. sed -i is now ordinary Bash work, so /rewind no longer restores its edits. Keep a diff or version-control recovery route. Test retention too: 2.1.301 repairs cleanup of hook-created worktrees with possible unpushed commits, and 2.1.304 repairs commit-loss paths after detached HEAD or branch changes.

Inspect diagnostic exports before sharing them. 2.1.300 adds system prompts, tools and API request parameters to local transcripts. Limit transcript retention and sharing, and mask both OTel prompt and prompt_text.

Decide which wrappers the native tools can replace

Try MCP Tasks only with a recovery plan. The gated public beta requires 2.1.304+, flag fetching, a supporting protocol-2026-07-28 server and eligible main-conversation CLI/SDK/GitHub Actions calls; one-shot claude -p, third-party providers, telemetry-off sessions, Desktop and VS Code are excluded. Streaming headless sessions also need open input and the documented background settings. Eligible remote tasks survive client exit and can be followed by resuming the same session. Preserve server, connection and session identity. Cancellation cannot guarantee stopped effects; expired unknown outcomes need server-side reconciliation.

Test native waiting before maintaining another polling loop. 2.1.310 makes Monitor available on Bedrock, Vertex, Foundry and telemetry-off sessions, which now also block long foreground sleeps. Test that provider path before replacing sleep-based waits.

Measure hosted review against human review time. Hosted Code Review became GA for Team/Enterprise on 15 October 2026. Choose Quick, Standard or Deep per repository; Standard is default, and the service neither approves nor blocks a PR. Count missed bugs, useful comments and reviewer minutes before retiring PR-comment automation. Include the time spent dismissing bad comments. Keep the service only if the review queue gets shorter without letting more bugs through.

Set review prohibitions on the machine running the review. Code Review PR reviews and ultrareview run despite disableWorkflows unless that machine’s MDM or managed-settings file sets it. For a no-upload policy, test upload prevention separately.

Check which sessions Desktop can supervise. The Code tab documents saved environments, parallel sessions and in-session subagents, background shell commands and dynamic workflows. Its cross-session view covers Desktop-run local/SSH/WSL sessions, excluding cloud, terminal CLI and VS Code. Test that coverage before replacing a broader dashboard.

What is unresolved

• Trust received repositories deliberately. 2.1.309 adds ultrareview workspace trust and noninteractive refusal unless explicitly trusted. Decide before adding --trust-workspace to CI. Protection for Manifold’s withheld GitSpawn configuration remains unverified here. A released fix naming it or a reproducible test on the pinned build would settle that question.

• Check who reviews your sessions and what it costs. Server-side auto review remains rollout dependent. A readable current billing contract and matched session, fallback and billing records would settle coverage and cost. The detailed 21 September 2026 gateway-warning guidance remains historical here.

• Prove task recovery with the intended server. Record handles and external outcomes across disconnect, resume, cancellation and expiry under the MCP Tasks lifecycle. Use those trials to check whether a consequential job recovers without duplicating work.