Claude Code 2.1.304 shipped Monday evening at 19:47 UTC, two days after 2.1.303, which carried only bug fixes. The changelog is long, and three things in it actually matter.
Mods get an approver that can only be a human
A mod can now set decider: "person" in its answer to tool.check. After that, only the permission dialog or a host callback can approve the call. Where nobody can be asked, the call is refused with the mod’s reason. For automated runs that means a mod can reliably pin individual tool calls to a human, instead of hoping someone happens to be watching.
Alongside it comes e.isReadOnly on the tool.check event, set when the call is read-only. And the transcript now shows a line when a plugin that runs first skips one of your mod’s hooks, naming both the event and the plugin. Anyone who has ever wondered why a hook did not fire finally gets told.
A mod’s settings.read hooks now receive each settings layer separately and rewrite the merged result. A managed mod can use that to turn an organization’s setting into a ceiling, including the cleanupPeriodDays the retention sweep uses. Skill hooks get new limits: 1,024 hooks and 16,384 matcher characters per source per session.
’/auto-mode-setup’ now works behind gateways too
The guided setup reads your project and recent sessions and teaches auto mode about your environment. Until now it only ran in standard sessions. It is now also available on Bedrock, Vertex, Foundry, through the Claude apps gateway and in sessions with telemetry turned off.
There is also a new /claude-api managed-agents-secure. It compares a Managed Agents agent’s settings against Anthropic’s published security guide and changes nothing. And on Pro and Max, Claude Code now warns you when resuming a long-idle conversation would eat a noticeable share of your five-hour limit. You can resume anyway or start fresh, and Claude will look the old conversation up once you refer to it.
Two fixes that buy back time
Scheduled Cowork cloud sessions used to wait five minutes per subagent whenever that subagent’s WebFetch needed a URL approval nobody was awake to give. That is fixed. With six subagents, it was half an hour of pure waiting.
The second one is nastier: claude --worktree removed the worktree and its branch at exit without asking, when HEAD was detached or on another branch, and commits could be lost. Fixed as well, along with CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently setting a 100K window. The variable now accepts k and M and warns when a value is out of range.
For Code Review, admins now pick a review level per organization — Quick, Standard or Deep — and can give individual repositories their own. There is also an option that covers every repository in a GitHub organization, including ones added later. Code Review went generally available last week.
I wrote about 2.1.302 on Saturday. What separates 2.1.304 is not volume but direction: all three of the interesting changes land in situations where nobody is sitting at the machine. Mods can demand a human approval, auto mode can be set up inside managed environments, and scheduled runs no longer hang on approvals that were never going to arrive overnight. That is the part of Claude Code that looks dullest in a changelog and shows up hardest in production.