Release archive

Claude Code v2.1.300: /advisor on Claude Platform on AWS, Stricter Hook Input Validation, and New Mod APIs

Claude Code v2.1.300 adds /advisor on Claude Platform on AWS, validates hook-rewritten tool input, extends mods and OpenTelemetry, and removes the no-op sandbox flags from claude remote-control.

October 14, 2026 • 10 min read • By ClaudeWorld

Claude Code v2.1.300 is a large release with 88 changelog entries. It brings /advisor to Claude Platform on AWS, tightens how hook-modified tool input is handled, adds several mod APIs and OpenTelemetry fields, and changes behavior around request compression, local transcripts, and exit. The rest is a long list of fixes across worktrees, hooks, MCP, cloud and Remote Control sessions, and VS Code.

What’s New

/advisor on Claude Platform on AWS

/advisor is now available on Claude Platform on AWS. No advisor runs until you pick one with /advisor, advisorModel or the --advisor flag, and setting CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns it off.

Hook-Rewritten Input Is Now Validated

updatedInput returned by PreToolUse and PermissionRequest hooks is now validated like Claude’s own tool input: unknown keys are dropped, and input the tool rejects denies the call. Separately, in Cowork cloud sessions a setMode update inside a PermissionRequest hook’s allow is now ignored, while the rest of the approval still applies.

Sandbox Flags Removed from claude remote-control

The --sandbox and --no-sandbox flags on claude remote-control had no effect and have been removed; passing either now exits with an error. To sandbox sessions, set sandbox.enabled in settings.

New Mod APIs and Hooks

  • virtualText in a mod’s prompt decorations draws text in the prompt box that never enters the draft or the submitted prompt.
  • $.ui.view({ agentId }) shows an agent’s transcript in the main view, and $.ui.view({}) goes back.
  • A dir prop on a mod’s Text supports right-to-left text; on Windows and in VS Code’s terminal its rows read in that direction and sit flush right.
  • The new prompt.change hook is raised when the prompt box’s text changes without a typed edit: a recalled history entry, a clear, an undo, or a plugin’s fill.
  • The agent.spawn hook can now rewrite a workflow agent’s prompt and model; before, it could only refuse workflow agents.

OpenTelemetry Additions

The api_request event now includes cache_creation_5m_tokens and cache_creation_1h_tokens, splitting cache writes by lifetime. Trace spans also gain GenAI semantic-convention attributes such as gen_ai.provider.name, gen_ai.conversation.id, gen_ai.tool.name and error.type.

Request Compression and Fuller Local Transcripts

Large requests to api.anthropic.com now use gzip compression even when telemetry is disabled; set CLAUDE_CODE_GZIP_REQUEST_BODIES=0 to turn this off. Local session transcripts now also record each API request’s system prompt, tools and parameters, so a transcript you choose to share can reproduce a request exactly.

Background Commands Are Force-Killed on Exit

On exit, background commands still running 1.5 seconds after being asked to stop are now force-killed. Previously, in fullscreen mode, they could be left running.

VS Code: claudeCode.attachSelection

The new claudeCode.attachSelection setting stops text selected in the editor from being added to your messages.

Claude Tag: Slack Connect, Approval Cards, and Voice Clips

An Owner or Claude Tag admin can now let Claude in Slack answer in Slack Connect channels shared with another organization; this is off by default. Connector actions that need your approval now get a private Allow once / Deny card in the Slack thread, so Claude asks instead of refusing, and Claude can read Slack’s transcript of a voice clip when Slack has one.

Fixes and Improvements

  • Worktrees: Plugin WorktreeCreate and WorktreeRemove hooks now run when Claude Code starts with --worktree (not yet with --tmux), and --worktree sessions no longer sometimes start from the wrong commit when a tag or branch is named like a commit ID.
  • Hooks: SessionEnd hooks no longer sometimes fail to run when you exit while a background command is still running. Agent hooks now respect their model: aliases like haiku resolve, a subagent’s model no longer overrides it, and an unavailable model falls back to the caller’s instead of allowing the action.
  • MCP: A conversation no longer fails with a 400 error on every turn when the API rejects an MCP tool’s input schema; that tool is sent without parameters for the rest of the conversation. Automatic tool search (ENABLE_TOOL_SEARCH=auto) no longer turns off part-way through a conversation, for example while MCP servers reconnect after a resume.
  • Headless and Agent SDK resume: Resuming a session no longer loses recent messages or its compaction summary when the compaction followed a reply cut at the output token limit, or a retried or unfinished reply in the same turn.
  • Background commands: Claude no longer polls a background command’s output file or sleeps while it runs.
  • Daemon: claude daemon stop --any no longer prints “stopped” while a stuck background service keeps running; it now waits, force-kills the service, and exits with 1 if it is still there.
  • Login: A login refused by forceLoginOrgUUID no longer leaves the refused organization’s token stored.
  • Cloud sessions: Turns no longer hang for 5 minutes when the organization’s policy can’t be read; the turn now ends promptly and says why. In Cowork cloud sessions, Write, Edit and NotebookEdit no longer report success for a path on your own computer where the file never arrived.
  • Remote Control: claude remote-control servers now retry after a brief sign-in error, such as a locked keychain, and warn when you need to run claude /login. Sessions are no longer marked stopped while still running on a computer serving several sessions at once.
  • Tasks: Subagents you had typed messages to no longer disappear from /tasks shortly after finishing.
  • Network: Feature flags and staged rollouts no longer stay stale behind a TLS-inspecting proxy whose certificate is trusted only through the OS certificate store.
  • Host-managed providers: CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST sessions now ignore CA-bundle, tool-proxy, git TLS and git config variables like SSL_CERT_FILE in settings; under Claude Desktop, this applies only to project settings.
  • VS Code: Fast mode now turns off when usage credits run out, instead of staying on and having each request refused and re-sent. Shift+dragging a file from the Explorer or an editor tab onto the prompt now works in WSL, SSH and Dev Container windows.
  • Self-hosted runner: The runner and orchestrator no longer freeze while nobody reads their output; logs keep the latest 256 KiB and count drops (not on Windows).
  • Code Review: @claude review comments from people with write access whose GitHub organization membership is private now start a review.

The release contains 88 changes in total; see the full changelog for every item.

How to Update

  1. Check your installed version: claude --version
  2. Update in place: claude update
  3. If you start claude remote-control with --sandbox or --no-sandbox, remove the flag (it now exits with an error) and set sandbox.enabled in settings instead.