Two versions in two days. Claude Code 2.1.309 landed on 22 October, 2.1.310 on the 23rd. Together they make one release where the new feature sits in one version and the more important fixes in the other.
The Monitor tool reaches all three cloud providers
New in 2.1.310: the Monitor tool and plugin monitors on Bedrock, Vertex and Foundry. They also work where telemetry or nonessential traffic is switched off. Long foreground sleeps are blocked in those environments now as well.
If you run Claude Code through any of the three providers, that is the headline. Monitoring used to be tied to environments allowed to phone home to Anthropic, and that is precisely the piece missing in locked-down enterprise setups.
Two more fixes you will feel rather than read. Requests were failing behind gateways and compatible servers that reject the effort-2025-11-24 beta value or mid-conversation system messages; Claude Code now retries without them. And background cleanup was deleting recent files, pasted images among them, when cleanupPeriodDays was set to a very large value.
The sandbox run in 2.1.309
The earlier version is the more interesting one, and it reads like an audit. Sandboxed Bash on macOS and Linux ran the shell’s startup files before every command, outside the sandbox. The macOS sandbox’s denyWrite glob patterns did not apply at a file’s real location when the path went through a symlink. Sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config. A disabled MCP server could be reconnected by a later permission prompt.
It carries on. The Bash permission check trusted a variable set by a command whose redirect can fail to open. Compound commands that change directory before running git did not prompt when the cd was wrapped or prefixed. An Edit(path) deny rule failed to block a Bash redirect to that same path. Add two gaps in the worktree isolation guard.
Two smaller ones are useful day to day. Sessions were compacting over and over after reading files under a very large nested CLAUDE.md; an oversized nested file now loads only its start. And a skill in an --add-dir folder whose name was already taken is now offered as <folder>:<name> instead of being unreachable.
Seven fixes in one place is a signal
I wrote about 2.1.308 two days ago, when /claude-api api-version was the new thing. Two days on, a single version carries seven fixes around the sandbox and the permission check. That is not an alarm, it is the ordinary consequence of more people leaving Claude Code running unattended. If you use auto mode or the sandbox, update sooner rather than later.