Intel / repo

claude-code v2.1.305

Source: github.com
Author: ashwin-antTop Viber
Date: Published Oct 20, 2026

Context

The most pressing item in Claude Code 2.1.305 repairs something the previous day's release broke. Tool search lets Claude look up tool definitions on demand instead of receiving every tool's description up front, which keeps the prompt smaller when many tools are installed. Version 2.1.304 (earlier coverage) switched it on by default behind a custom ANTHROPIC_BASE_URL, retrying without it when a gateway answered with a 400 or 422. The 2.1.305 notes describe a 2.1.304 regression without saying which change caused it: every request failed for some users on Vertex, Bedrock and other providers whose endpoint or gateway rejected tool search, and behind gateways where the ToolSearch tool was disallowed or left out of the --tools list. Claude Code now retries without tool search in those cases, so anyone who saw total failures after upgrading to 2.1.304 should upgrade again.

The new setting that deserves the most care is .allowNestedUserNamespaces. On Linux it lets sandboxed commands create their own user namespaces, which tools such as Chromium and rootless podman need in order to run. The release notes are explicit that this also lets those commands get around the sandbox's file protections, so turning it on trades containment for compatibility rather than adding a capability for free.

Two smaller changes affect administrators and long-running setups. An MCP server supplied by a cloud session or through the SDK's setMcpServers could previously be replaced partway through a session by a server with the same name in the user's own settings; the supplied one now stays. And allowedMcpServers no longer filters stdio servers in managed-mcp.json whose only ${VAR} use is in env, so a server an previously excluded will load after the upgrade unless it is listed in deniedMcpServers. The rest of the release is mostly bug fixes across worktrees, Remote Control, screen reader mode, self-hosted runners, Claude Tag and Code Review.

Key takeaways · AI-distilled

The new sandbox.allowNestedUserNamespaces setting lets sandboxed Linux commands create user namespaces, which Chromium and rootless podman need, but the release notes say it also lets those commands get around the sandbox's file protections.
Version 2.1.304 broke every request on Vertex, Bedrock and other providers when the endpoint or a gateway rejected tool search. In 2.1.305 Claude Code retries without tool search instead of failing.
Workflow resume no longer re-runs pipeline() and parallel() agents that had already completed; it serves their results from the run's journal instead of repeating that work.
allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only in env, so a server an allowlist left out now loads on upgrade. Keeping it off now requires deniedMcpServers.

Terms in this piece · Glossary

sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
tool permissions — The rules governing which tools an agent may call and which need confirmation — the boundary between a mistake and an incident.
context compaction — Summarizing an agent's earlier conversation to free room in the context window so a long session can keep going.

Read the source github.com