Claude Code v2.1.302 and v2.1.304: Permission, Deletion and Sandbox Changes

Two release notes, each read on its own #

This article covers two separate release notes. The Claude Code v2.1.302 release notes are dated 2026-10-16. The Claude Code v2.1.304 release notes are dated 2026-10-19. Each change below is attributed only to the version whose notes list it. The notes do not describe how the two releases relate to each other, so this article does not infer a release order, a cumulative effect, or any change that a release does not list.

A separate model setting for the client-side classifier #

Auto mode uses a safety classifier to check tool calls. The Claude Code v2.1.302 release notes add CLAUDE_CODE_AUTO_MODE_MODEL, which the notes describe as the model the client-side auto mode classifier uses. The notes state that it "does not change the model for server-side auto mode." The variable therefore applies to the client-side classifier only. The notes describe no other effect for it.

The same release also changes server-side auto mode. The notes say that a conversation too long for the safety check is now compacted, instead of every checked tool call being denied. The notes describe that outcome only, so this article does not describe how the compaction works.

The v2.1.302 notes also add an Idle compaction row to /config for turning idle compaction off or back on. They say the notices shown after an idle compaction now explain how to turn it off. Users who want idle compaction disabled can find the control in /config, as the notes describe.

The Claude Code v2.1.304 release notes add /auto-mode-setup. The notes describe it as a guided setup that reads your project and recent sessions to teach auto mode about your environment. They say it is now also available on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions. The notes do not say what the setup writes or where its output is stored.

Permission mode for headless and SDK runs #

The v2.1.302 notes change the starting permission mode for claude -p and Agent SDK sessions that do not set one. According to the notes, these sessions now start in default mode "on third-party providers, with telemetry off or on a fresh install," and "--permission-mode auto keeps auto." The notes describe the new behaviour only. They do not describe the mode used before this change, so this article makes no comparison.

For scripts that need auto mode, the notes name --permission-mode auto as the flag that keeps it. Because the default changes under the three conditions the notes list, a script that depends on auto mode should pass the flag explicitly rather than rely on the default.

The same v2.1.302 notes also change fork subagents. They are now on by default in claude -p, the Agent SDK, the desktop app and VS Code. The notes say CLAUDE_CODE_FORK_SUBAGENT=0 turns them off, and that claude mcp serve never offers them. The notes also say that the main conversation's subagents now run in the background in the desktop app and VS Code, as they do in the terminal.

Deletion prompts for mounted drives and top-level folders #

The Claude Code v2.1.304 release notes list a fix for rm -r of a mounted drive or a folder at its top level. The notes name /Volumes, /media and WSL's /mnt/c as examples. They say these paths were not getting the safety prompt that rm -rf /Applications gets. The notes do not describe the wording of that prompt.

The same notes list a fix for Bash and PowerShell deleting a large command's output file when it could not be copied to the session's tool-results folder, "unless the disk is full." The notes do not say how often this case occurs.

The v2.1.304 notes also list a fix for claude --worktree. It no longer removes the worktree and its branch without asking at exit when HEAD is detached or on another branch. The notes say that case could lose commits. Users of worktrees should expect the prompt the notes describe when they exit in those states.

Sandbox denyRead globs on Linux #

The v2.1.304 notes fix a case where sandboxed commands on Linux failed to start. The failure happened when a sandbox.filesystem.denyRead glob contained brackets that are not a character class. The notes give a [user-id] route folder as the example. The notes say the fix stops that failure, so the commands start.

The notes do not list which other glob forms are handled, and they do not describe how denyRead rules are matched. A command that starts does not show, by itself, that a rule blocks the paths you intended. The notes describe the start-up failure only.

Mod permission decisions and settings hooks #

The v2.1.304 notes change how a mod's tool.check answers a permission request. A mod can now set decider: "person". The notes say that "only the permission dialog or a host's callback can approve the ask," and that the request is refused with the mod's reason where nobody can be asked. Mod authors whose tool.check code assumes a different answer shape should review it against this wording.

The same release adds e.isReadOnly to the mod's tool.check event. The notes say it is set when the tool call is read-only. The notes do not describe how the host uses the field after the mod reads it.

The v2.1.304 notes also change settings.read hooks. These hooks now receive each settings layer and can rewrite the merged settings. The notes say this lets a managed mod make an organization's setting a ceiling, and they name cleanupPeriodDays, which the retention sweep uses, as one example. Administrators who run managed mods can check which mods use settings.read hooks and what they rewrite.

Several other mod fixes in the same notes concern reliability. A failed mod reload no longer removes the tools and commands of the version that stays loaded. A click on a mod's button is no longer lost when buttons with the same label and no key are redrawn unchanged. Mod sharing in the built-in plugin-authoring skill no longer stops at the secret scan on machines with managed settings and on Team and Enterprise plans.

Limits on skill and prompt hooks #

The v2.1.304 notes set a per-source limit for skill hooks. The skills of one source, which the notes list as a repo, your own folder, or a plugin, can register at most 1,024 hooks and 16,384 matcher characters per session. The v2.1.302 notes set a separate limit: at most 12 of one event's prompt and agent hooks run at a time, and the rest wait their turn. The notes do not explain how these numbers were chosen.

Read tool image sources #

The Claude Code v2.1.302 release notes list a fix for the Read tool loading an image file of any size, or a pipe or device named like an image, entirely into memory. The notes say image sources over 128 MB are now refused. The notes do not give an alternative path for files over that limit.

Other notices in the two releases #

The v2.1.302 notes add a notice to /design-sync and /design-login. It says that standalone Claude Design, at claude.ai/design, closes by December 14, 2026. The notes do not say what replaces it.

The v2.1.304 notes add /claude-api managed-agents-secure. The notes say it compares a Managed Agents agent's settings with Anthropic's published security guide, without changing anything.

Upgrade checklist #

1. Read the Claude Code v2.1.302 release notes and list the items that apply to your setup, such as auto mode, headless runs, the Read tool, fork subagents and the Claude Design date.
2. Read the Claude Code v2.1.304 release notes and list the items that apply to your setup, such as deletion prompts, sandbox denyRead globs, worktrees and mods.
3. If you use CLAUDE_CODE_AUTO_MODE_MODEL, confirm that you want it for the client-side classifier only, since the notes say it does not change server-side auto mode.
4. If a claude -p or Agent SDK script needs auto mode, pass --permission-mode auto, because the notes say it keeps auto mode.
5. If your workflow sends image files to the Read tool, check whether any source is over 128 MB, since the notes say those are refused.
6. If you use Linux sandboxing with denyRead globs that contain brackets, confirm that the affected commands start, as the v2.1.304 notes describe.
7. If your workflow deletes from /Volumes, /media or /mnt/c, note that the v2.1.304 notes say these paths now get the safety prompt.
8. If you maintain mods that answer tool.check, review the decider: "person" value and the e.isReadOnly field described in the v2.1.304 notes.
9. If you run managed mods with settings.read hooks, check what each hook rewrites in the merged settings, including cleanupPeriodDays.
10. If you use the standalone Claude Design product, note the closing date of December 14, 2026 stated in the v2.1.302 notes.