Claude Code v2.1.304: A Guided Auto Mode Setup, Mods That Can't Be Auto-Approved, and a Warning Before You Burn Your 5-Hour Limit

v2.1.304 is a big changelog, and most of it is fixes. A few items are worth your attention if you run Claude Code with real autonomy. Everything below comes from the official changelog. I did not install this release. v2.1.303 contains a single line, “Bug fixes and reliability improvements”, so this post is effectively about both.

/auto-mode-setup: teaching the classifier your environment

#

Auto mode is the feature that lets Claude Code act without a prompt on every step, with a safety classifier deciding what still needs approval. Its weak spot has always been context. The classifier does not know that your terraform apply against sandbox-* is routine and the same command against prod-* is not.

v2.1.304 adds /auto-mode-setup. Per the changelog, it is “a guided setup that reads your project and recent sessions to teach auto mode about your environment.” It is also now available on Bedrock, Vertex, Foundry, the Claude apps gateway, and telemetry-disabled sessions. That last part matters: enterprises that route through a cloud provider or disable telemetry were previously the people least able to tune auto mode.

This is the right direction for Spec-Driven Development. Your specs and CLAUDE.md already describe what is safe, what is off limits and where the boundaries are. A setup step that derives classifier guidance from your project and session history means the policy comes from the work you’ve already written down, rather than from a hand-maintained allowlist. I’d still read whatever it produces before trusting it. The changelog doesn’t say where the output is stored or how you review it, and I haven’t run it.

Mods get a “a person must decide” switch

#

The mods system (the extension surface for panels, status lines, slash commands and tool hooks) gets three security-relevant additions:

• decider: "person" on a mod’s tool.check answer. Only the permission dialog or a host’s callback can approve the ask. Where nobody can be asked, such as a headless run, the call is refused with the mod’s reason.
• e.isReadOnly on the tool.check event, set when the tool call is read-only. A mod can now wave through reads and escalate writes without parsing tool inputs itself.
• A transcript line when a plugin that runs first skips one of your mod’s hooks, naming the event and the plugin.

The first one closes a real gap. Without it, a policy hook that says “ask” can potentially be satisfied by another automated layer. With decider: "person", a rule like “never let an agent push to main without a human” fails closed in CI instead of silently passing. The third change is a visibility fix: if another plugin short-circuits your hook, you now see that in the transcript instead of discovering it from an incident.

A related managed-settings change: mods’ settings.read hooks now receive each settings layer and rewrite the merged settings, “so a managed mod can make an organization’s setting a ceiling, including the cleanupPeriodDays the retention sweep uses.” Admins can enforce limits rather than only suggest defaults.

Skill hooks are also capped: one source (a repo, your own folder, or a plugin) can register at most 1,024 hooks and 16,384 matcher characters per session. Unlikely to bite, but it is a guard against a runaway plugin.

The usage-limit warning

#

On Pro and Max plans, resuming an inactive conversation can now warn you when it would use “a noticeable share of your 5-hour usage limit.” You can resume anyway, or start a fresh conversation and refer to the previous one so Claude can look it up. This is the cost of a cold prompt cache made visible: a long conversation resumed after a break has to be re-read in full. The changelog gives no threshold for “noticeable”.

A related fix: self-paced /loop wakeups scheduled at the 1-hour maximum used to fire just after the 1-hour prompt cache expired, so they re-read the conversation uncached. That is fixed. If you use /loop with long delays, this one directly affects your bill.

Fixes that deserve a second look

#

Some entries in the fix list are the kind of bug you only appreciate after hitting it:

• claude --worktree could lose commits. It removed the worktree and its branch at exit without asking when HEAD was detached or on another branch. If you use worktree isolation for parallel agents, update.
• rm -r safety prompt. Removing a mounted drive or top-level folder (/Volumes, /media, WSL’s /mnt/c) did not trigger the prompt that rm -rf /Applications does. Now it does.
• Headless runs overrunning limits. A plugin could keep a headless run going past --max-turns, Stop, or ended input by spawning subagents or re-running a finished one. For unattended pipelines, --max-turns is a budget control, so this is a cost bug as much as a correctness bug.
• A PreToolUse deny reason was replaced by a timeout error when an Agent SDK callback hook on the same call timed out. Audit logs now keep the real reason.
• CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently set a 100K window. The variable now accepts k and M suffixes and warns on out-of-range values. If you set this in v2.1.296-era subagent cost tuning, check what you actually got.
• Transcript GC dropped messages when the disk filled while CLAUDE_CODE_TRANSCRIPT_LOCAL_GC trimmed the file.
• Subagents sometimes forgot their latest work when messaged or resumed right after finishing, and an agent teams shutdown approval no longer exits the whole CLI.

Performance gets a line too: better responsiveness with many concurrent subagents, lower memory in long or resumed conversations, and a smaller auto mode session file because the classifier’s context is no longer stored with every request.

Code Review levels

#

Not a CLI change, but notable for teams: Code Review now has Quick, Standard (default) and Deep levels, set per organization with per-repository overrides. Owners can also enable review for every repository in a GitHub organization, including ones added later. Pull requests opened within a minute or two of enabling Code Review used to be skipped silently; they are now retried.

Take

#

Nothing here is a headline feature, and that is the point. The changes are about the unattended path: how auto mode learns your environment, how a policy hook insists on a human, how cost surprises are surfaced before they happen. These are the problems of software that is meant to run without someone watching every keystroke. An editor-bound assistant has a person at every step by construction and never needs a decider: "person" option. Terminal-native agents have to earn trust, and this release spends its effort on exactly that.

What I couldn’t verify

#

I haven’t run v2.1.304. The changelog doesn’t say where /auto-mode-setup stores its output, what threshold triggers the usage-limit warning, or how the mods API versions decider. The release also has many VS Code, Cowork, Claude Tag and self-hosted runner entries that I skipped.

Sources

#

• Claude Code CHANGELOG, v2.1.303 and v2.1.304