Claude Code v2.1.304 Update Explained: Auto Mode and Permission Security Upgrades

Claude Code has released v2.1.304. This update doesn't introduce any disruptive features, but it densely fixes dozens of real-world edge cases while making substantive enhancements along three main lines: permission control, auto mode, and multi-agent collaboration. For developers who interact with Claude Code in the terminal every day, this changelog is worth reading entry by entry.

A more granular permission model: decider and read-only events

This update adds two new fields to the plugin tool.check. The first is decider: "person", which means: when a tool call requires manual approval, only the permission dialog or a host callback can complete the approval; if no one in the current environment can respond, the request is rejected outright along with the reason provided by the plugin. This design pulls "permission decisions in unattended scenarios" out of the gray zone.

The second is e.isReadOnly, which is set when a tool call is read-only. Plugin authors can use it to distinguish read from write operations—allowing read-only calls through while keeping strict validation on write operations. Combined with the existing sandbox mechanism, the permission layer is moving from "one-size-fits-all" toward "graded by operation nature."

tool.check is a hook declared by plugin authors within the Claude Code plugin system, through which plugins perform pre-validation on every tool call: they can allow, deny, or mark it as "requires manual approval." The newly added decider field in this version applies precisely to the third case—it declares who completes the final approval action, with the value "person" indicating that a human (permission dialog or host callback) must make the call, and the machine cannot substitute. The complementary isReadOnly describes the nature of the call: read-only tools (reading files, querying state, etc.) do not change the external world and can therefore be safely auto-approved; only write operations require strict scrutiny. Together, the two form a two-dimensional permission model of "nature grading + clear decision source," and also give plugins predictable behavior in unattended CI and batch-processing environments.

/auto-mode-setup: let auto mode get to know your project first

The newly added /auto-mode-setup is a guided configuration flow that reads your project and recent sessions to teach auto mode about your development environment. According to the change notes, this feature now covers Bedrock, Vertex, Foundry, Claude apps gateway, and sessions with telemetry disabled—meaning enterprise-side and privacy-sensitive scenarios are equally supported.

Another new command worth noting is /claude-api managed-agents-secure, which compares the Managed Agents proxy's settings item by item against Anthropic's published security guidelines, without making any changes throughout. This is a "diagnose only, don't act" security audit approach, suitable for quickly identifying configuration gaps before a compliance review.

Optimizations for auto mode and context management

Auto mode receives several underlying improvements in this update: the safety classifier's context is no longer stored with every request, reducing session file size; when resuming large compressed sessions, the first request can be sent faster; and memory usage is reduced in long-running or resumed conversations.

On usage warnings: when Pro and Max plan users resume an inactive session and it's estimated to consume a significant portion of the 5-hour limit, they now receive a clear warning and can choose to continue resuming or start a new conversation—if they mention previous content in the new conversation, Claude can still retrieve the prior conversation.

Fixes for the multi-agent and plugin systems

Responsiveness and throughput in multi-agent concurrent scenarios have been improved. One specific bug fix: plugins previously allowed headless runs to break through the --max-turns, Stop, or end-of-input limits by spawning sub-agents or re-running completed agents to continue execution—this loophole has been closed.

Plugin hot-reload issues have also been addressed: previously a failed reload would remove the toolbar and commands of a version still loading, and would incorrectly or silently report whether the old version was still running. This behavior has now been corrected. Additionally, the issue where buttons with the same label and no key lost clicks on unchanged redraws has also been fixed.

Headless mode refers to invoking Claude Code non-interactively, such as via claude -p, commonly used in CI pipelines and script automation. --max-turns is the parameter limiting the maximum number of model turns in a single run; Stop and end-of-input are the other two termination signals, and together the three form the "brakes" for automation scenarios. If a plugin could bypass these limits by spawning sub-agents or re-running completed agents, it would mean an automation task that should be controlled could continue indefinitely, consuming quota and introducing uncertainty. This fix closes that path, ensuring that termination semantics still hold when plugins are involved. Plugin hot-reload refers to updating a plugin version without restarting the session; the difficulty lies in command and toolbar ownership during the coexistence of old and new versions, as well as the accuracy of status notifications.

Scattered fixes worth noting

The changelog also includes several entries that are easy to overlook but affect real-world experience:

• When rm -r targets a mounted drive or its top-level directory (/Volumes, /media, WSL's /mnt/c), it no longer lacks a safety prompt equivalent to rm -rf /Applications;
• claude --worktree now exits when HEAD is detached or on another branch, no longer deleting the worktree and its branch without asking, avoiding lost commits;
• Context usage checks no longer block model switching, messages, and interruptions in SDK and desktop sessions;
• The context_management: Extra inputs are not permitted error behind LLM gateways has been fixed—Claude Code now removes this field when resending requests;
• After compaction completes, the skill list is re-sent to Claude, while /reload-skills only sends newly added or changed skills.

The Code Review feature has also been enhanced: organization owners can choose Quick, Standard (default), or Deep review levels for the entire organization, and can set them individually for a single repository; a new option in admin settings can cover all repositories within a GitHub organization, including future ones, without checking them one by one.

The --worktree parameter is used to have Claude Code work in an independent Git worktree (a parallel working directory of the same repository), thereby isolating changes without disturbing the main branch. The problem occurred when HEAD was detached or pointed to another branch: at that point the "current branch" semantics were unclear, and directly deleting the worktree and its associated branch would also lose unmerged commits. The fix changes this to exit and ask first, returning the decision on destructive operations to the user. Another fix involves LLM gateways: some gateways strictly validate request body fields and return an Extra inputs are not permitted error upon encountering an unrecognized context_management. Claude Code now strips this field when resending, thereby remaining compatible with such more conservative gateway implementations.

Summary

v2.1.304 is a typical "stabilizer" release: the new features are mainly configuration guidance and security auditing, with the focus on refining permission semantics and fixing edge cases. For plugin developers and enterprise deployers, the capabilities provided by decider: "person" and isReadOnly may be more valuable than they appear on the surface.

Background notes

Auto Mode refers to the way Claude Code autonomously executes operations continuously with less manual confirmation. Its precondition is that the system has sufficient understanding of the project structure, common commands, and recent work context; otherwise it is prone to misjudging intent or taking out-of-bounds actions. The role of /auto-mode-setup is precisely to make this precondition explicit: it scans project files and historical sessions in one pass to form an environment profile usable by auto mode. The Bedrock, Vertex, Foundry, and Claude apps gateway mentioned in the article are enterprise-grade access channels for Claude models (corresponding to AWS, Google Cloud, Azure, and enterprise self-built gateways, respectively); these channels often come with data residency and audit requirements, while sessions with telemetry disabled mean usage data is not sent back externally. That this configuration flow covers these scenarios shows it can complete profile construction without relying on telemetry data.