A big release is usually followed by a small one that cleans up what the big one exposed. v2.1.309 tightened the sandbox and permission checks. v2.1.310 lands the next day and is mostly about the places where Claude Code meets other people’s infrastructure: gateways, Windows shells, enterprise admin consoles. Everything here comes from the official changelog. I have not run this version, so treat the behavior claims as the changelog’s, not mine.
Gateway compatibility: retry instead of fail#
If you route Claude Code through an LLM gateway or proxy, this is the headline. The changelog says requests failed on some gateways and servers that reject a beta value or mid-conversation system messages. Claude Code now retries without them.
This matters because gateways are the standard enterprise control point: central keys, logging, spend caps, model allowlists. Many of them validate request shapes strictly, and an agent that sends a field the gateway doesn’t know about gets a hard failure rather than a degraded one. A client that retries without the offending piece is the correct behavior. The cost is that some feature tied to that beta value or system message may silently not apply. If you run a gateway, check your logs for the retry pattern so you know which sessions are running in the reduced mode.
The Monitor tool reaches Bedrock, Vertex and Foundry#
The Monitor tool is now available on Bedrock, Vertex and Foundry, and also when telemetry or nonessential traffic is disabled. In those setups, long foreground sleeps are blocked too.
Monitor is the tool that lets an agent wait on a background process and react to its output without burning turns on polling. Until now, teams on cloud-provider endpoints or locked-down networks were missing it. Blocking long foreground sleeps is the companion change: an agent that sleeps in the foreground holds the session hostage, and that is exactly the failure mode that makes unattended runs expensive. If your agents shell out to sleep 600 waiting for a build, expect that to be refused and the agent to be steered toward Monitor.
Permissions and safety fixes#
A short cluster, in the same spirit as 309:
- Read prompts now show symlink targets. Before, a prompt could ask to read a path without showing where a symlink actually pointed. You now see the real destination before approving. Given that symlinks were the recurring theme of the previous release, this is a welcome follow-up.
- Windows hooks no longer let calls through without Git Bash. The changelog describes hooks that allowed a call when Git Bash was missing. Fail-open hooks are a control that quietly disables itself, so this is the one Windows teams should verify directly: break a hook on purpose and confirm the call is blocked.
- MCP timeout messages tell Claude not to repeat the call. An agent that retries a timed-out, non-idempotent MCP call can double-charge, double-post or double-deploy. Telling the model plainly not to repeat it is cheap and sensible.
- Auto mode’s prompt explains blocked reads. When blocking reads makes shell commands ask for permission, the auto mode prompt now says so, which should cut down on confusing prompts.
Context, memory and cleanup#
- Fixed background cleanup deleting recent files when
cleanupPeriodDaysis very large. If you set a huge retention value to “never delete”, this bug could do the opposite. Worth checking your session history if you did. - Fixed compaction after a “Prompt is too long” error keeping too much dense text, so the retry no longer fails for the same reason.
- Reduced memory use during compaction in non-interactive sessions with very large transcripts. That helps long CI and SDK runs.
- The sandbox warning on Linux now explains Ubuntu’s AppArmor restriction on unprivileged user namespaces. If your sandbox silently didn’t start on a recent Ubuntu, the message now tells you why.
- A question’s auto-continue timeout no longer fires right after an external editor closes, and the
Imagemod element draws in more terminals.
VS Code and cloud sessions#
Two VS Code fixes stand out. The plan review feedback button was approving plans instead of sending feedback, which is the kind of bug that quietly defeats a human review gate. And a “Something went wrong” error after switching branches in a cloud session is fixed.
On the cloud side, the notable addition is custom Enterprise roles for cloud sessions and Remote Control. Admins can now scope who can start or attach to these sessions with roles of their own rather than coarse defaults. Alongside it: a file picker for setup scripts, better error reporting in the environment and routine dialogs, a scrolling setup output box, a confirmation step for admin settings changes, and a reorganized environment dialog. Claude Tag and Code Review admin pages got smaller fixes (a load error, a spend-limit filter that showed no channels, repositories hidden after a failed refresh, now with a single “Try again” banner).
What to do with this#
- Gateway operators: upgrade a canary group and watch for retry traffic.
- Windows teams: test that a failing
PreToolUsehook blocks, with and without Git Bash installed. - Anyone with a large
cleanupPeriodDays: confirm your recent session files are intact. - Enterprise admins: review whether the new custom roles let you drop broader permissions you granted as a workaround.
The bigger picture#
Two consecutive releases, one hardening and one compatibility, is what a maturing runtime looks like. The interesting signal is the direction: fewer new toys, more attention to where an autonomous agent touches proxies, shells, symlinks and admin consoles. That’s where unattended agents succeed or fail in practice, and it’s the right place to spend engineering time. Read the changelog like an advisory feed, and keep disposable worktrees and git history as your backstop.
