Release archive

Claude Code v2.1.305: Tool Search Regression Fix, Nested User Namespaces for the Linux Sandbox, and Usage-Limit Rechecks

Claude Code v2.1.305 fixes a 2.1.304 regression that failed every request when tool search was rejected, adds sandbox.allowNestedUserNamespaces and a usage-limit recheck for unattended retries, and improves /usage.

October 20, 2026 • 10 min read • By ClaudeWorld

Claude Code v2.1.305 has 38 changelog entries. It fixes a 2.1.304 regression that made every request fail on Vertex, Bedrock and other providers when tool search was rejected, adds a Linux sandbox option for nested user namespaces and a usage-limit recheck for unattended retry mode, and changes how allowedMcpServers treats some managed stdio servers. It also makes /usage warnings fixable in place and fixes issues across worktrees, MCP, screen reader mode, and the self-hosted runner.

What’s New

Tool Search Regression Fix

Since 2.1.304, every request failed on Vertex, Bedrock and other providers when the endpoint or a gateway rejected tool search, and behind gateways with ToolSearch disallowed or left out of --tools. Claude Code now retries without tool search in these cases.

sandbox.allowNestedUserNamespaces on Linux

The new sandbox.allowNestedUserNamespaces option lets sandboxed commands on Linux create user namespaces, for example for Chromium or rootless podman. The changelog notes that this lets those commands get around the sandbox’s file protections.

Usage-Limit Recheck for Unattended Retries

The new CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS variable lets unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) notice a usage limit that was lifted before its reset.

Managed MCP Servers and Plugin allowed-tools

allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only in env, so such a server that your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off. Separately, plugins that Claude Desktop mounts by path no longer keep their allowed-tools when your organization’s managed settings set allowManagedPermissionRulesOnly.

Fixable Warnings in /usage

Each /usage warning is now a one-line fix that names its source, and pressing f applies the fixes. The same fixes appear in VS Code and /doctor.

/artifacts Delete Confirmation

The /artifacts delete confirmation now takes 1 or Enter to keep, 2 to delete, and Esc to cancel; y and n no longer answer it.

Fixes and Improvements

  • Model overrides: /effort and /autocompact settings now apply when the model name differs from a modelOverrides value by letter case or a [1m] tag.
  • Worktrees: New worktrees in a bare repository no longer sometimes start from local HEAD instead of the default branch, and unchanged subagent worktrees are no longer sometimes left behind.
  • Bash: On a full disk, Bash commands no longer fail with a raw ENOSPC file path; the error now says the disk is full and that nothing ran.
  • MCP: An MCP server passed by a cloud session or by the SDK’s setMcpServers is no longer replaced later in the session by a same-named server from your own settings, and MCP consent dialogs are less likely to take an Enter meant for the prompt as Accept.
  • Subagents: Claude no longer names the wrong model for a subagent’s work after the subagent switched to a fallback model.
  • Compaction: Cloud sessions and teammates now tell Claude when a compaction had to leave the oldest messages out of its summary to fit.
  • Workflows: Workflow resume no longer re-runs already-completed pipeline() and parallel() agents; it serves them from the run’s journal.
  • Remote Control: Remote Control no longer leaves empty “(session)” entries in /resume after you switch conversations with /resume.
  • Terminal UI: /usage rows are no longer cut off in narrow terminals. Startup warnings no longer print as raw text above the logo; they go to the debug log, and permission rules that restrict nothing show as warning rows under the banner.
  • Screen reader mode: Search boxes now say “Search:” instead of a symbol VoiceOver read as “telephone recorder”, and highlighted prompt text, such as Ctrl+R search matches and “ultrathink”, no longer has spaces inside words.
  • Mods: A mod’s Image now draws its picture in iTerm2 3.5 and later with fullscreen rendering, where it previously showed only its alt text.
  • Self-hosted runner: A start script that shares only its stdout with the runner or orchestrator no longer fails with Resource temporarily unavailable when TERM is set (a 2.1.300 regression), and repository access no longer fails when a git credential helper or askpass program reads its settings through GIT_CONFIG (broken since 2.1.296).
  • VS Code: A “Running start-up hooks” spinner status, with a screen reader announcement, now shows while SessionStart or Setup hooks run.
  • Claude Tag: Routines set up in a Slack thread no longer report success without posting after the conversation ended; those runs are now skipped and the creator is told.
  • Code Review: Code Review no longer sometimes skips the newest commit when several pushes land on a pull request during a review, and re-reviews no longer open with LGTM while earlier blocking findings are still open.

The release contains 38 changes in total; see the full changelog for every item.

How to Update

  1. Check your installed version: claude --version
  2. Update in place: claude update
  3. If your allowedMcpServers allowlist leaves out managed-mcp.json stdio servers that use ${VAR} only in env, those servers now load on upgrade; add them to deniedMcpServers to keep them off.