What happened
Anthropic’s Claude Code release notes for v2.1.304 describe new guided setup for auto mode, a read-only signal for tool checks, a person-only approval decider, and a command that compares Managed Agents settings with Anthropic’s security guide. The release also includes broad fixes and workflow changes across plugins, transcripts, remote sessions, cloud sessions, VS Code, and Code Review.
The release notes report that /auto-mode-setup now provides a guided setup that reads a project and recent sessions to teach auto mode about the user’s environment. The notes also say the command is available on Bedrock, Vertex, Foundry, the Claude apps gateway, and telemetry-disabled sessions. The source does not state whether these capabilities are available to every Claude Code user or under which plans.
For extension and permission workflows, the release adds decider: "person" to a mod’s tool.check response. The notes say only the permission dialog or a host callback can approve the request, and that the request is refused with the mod’s reason when nobody can be asked. A new e.isReadOnly field identifies read-only tool calls. The release also adds /claude-api managed-agents-secure, which compares a Managed Agents agent’s settings with Anthropic’s published security guide without changing settings.
The remaining changes are mostly reliability, observability, and workflow updates. They include clearer plugin-hook transcript messages, tool names in compaction summaries, warnings when resuming could consume a noticeable share of a five-hour Pro or Max usage limit, fixes for sandbox and mounted-drive safety prompts, improved behavior for subagents and remote sessions, and new Code Review levels and organization-wide repository coverage options. No source-provided or independent test result is included.
Why it matters
The changes make Claude Code’s agent workflows more inspectable and configurable. The source says auto-mode setup can read a project and recent sessions to teach the about a user’s environment, while the security command provides a non-mutating comparison against Anthropic’s published guidance. These capabilities could reduce setup friction and improve oversight, but the release notes provide no independent evaluation, security audit, performance , rollout detail, or pricing information.
The release’s central product significance is tighter control over agent actions. Requiring a person or host callback for a specific approval path could help teams distinguish explicit human authorization from automated decisions, while the read-only indicator can give hosts more information when applying permissions or audit rules. The source describes the behavior, but does not provide evidence about how often these controls prevent unwanted actions.
The guided setup may be practically useful for users who want auto mode to account for local project conventions and recent work. However, because it reads project and session information, organizations will need to understand data handling, retention, and policy interactions before enabling it. The release notes do not specify what information is retained, what is sent to a model or service, or how administrators can review the setup’s output.
The Managed Agents security comparison is explicitly described as non-mutating, which lowers the immediate operational risk of running it. It should be treated as a configuration aid rather than proof of security: the source does not report an independent audit, the checks it performs, false-positive or false-negative rates, or whether passing the comparison guarantees compliance with any external standard.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Watch for documentation showing which Claude Code versions, plans, gateways, and hosting environments support the new commands; how much project and session data auto-mode setup reads; and whether organizations can enforce the new permission and settings controls. The release notes do not establish general availability, pricing, default rollout status, or the practical accuracy of the security comparison.
The source does not provide a visible publication date, pricing, license terms, or a complete availability matrix. Confirm those details in current Anthropic documentation before treating any listed capability as generally available.
For auto mode, verify the exact project files and recent-session information it reads, whether users receive a reviewable summary, and what telemetry-disabled or enterprise-hosted deployments do differently. These are meaningful unknowns because the command is described as environment-aware rather than as a purely local configuration step.
For Managed Agents and mod permissions, watch for administrator documentation, audit-log support, host callback behavior, and compatibility details across Bedrock, Vertex, Foundry, gateways, and Claude applications. The release also warrants follow-up testing of the safety fixes involving mounted drives, sandbox globs, worktree cleanup, and subagent shutdowns, since the source reports fixes but supplies no test methodology or results.