Claude Code v2.1.296 Adds Gateway Policy Keys, autoCompactWindow, Read allow_large

Claude Code v2.1.296 (released 09 Oct) ships new managed-policy keys, a subagent compaction override, and a batch of fixes across the gateway, hooks, self-hosted runners, and plugins.

What's new

• A code key in the Claude apps gateway's managed.policies[]. It takes the same settings as cli and also applies in Claude Desktop's Code tab; next to desktop it turns on Claude Desktop's gateway mode.
• autoCompactWindow in subagent frontmatter and --agents definitions, so a subagent can auto-compact earlier than the main conversation's window.
• CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to run every workflow agent on one model while other subagents keep their own.
• CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS to set a longer max delay for the backoff on retrying an overloaded (529) request.
• A note in /plugin when a plugin's hooks are left out because another enabled plugin has the same name.
• An allow_large option on the Read tool, so Claude can read a text file past the usual size limits in one call when it needs the whole file and the context has room.

Notable fixes

• Managed-settings PreToolUse hooks that deny a tool call with "continue": false, and managed prompt hooks that block one, now refuse the call without ending the turn.
• PostToolUse hooks in managed settings now apply updatedMCPToolOutput in sessions where it was previously skipped.
• Headless sessions no longer start a folder's .mcp.json or plugin MCP server that was switched off for that folder after a directory change or plugin reload.
• A Claude apps gateway serving allowedProviders with "gateway" no longer locks out laptops that name that gateway in user settings.
• A saved Claude apps gateway sign-in is no longer ignored when managed settings set forceLoginMethod to gateway without a forceLoginGatewayUrl (regression from 2.1.295).
• Token counts fixed for Haiku 5.5 and other models that take only adaptive thinking, which failed behind some gateways and were counted with budget thinking elsewhere.
• Self-hosted runner: clearer errors on refused registration (names the org admin setting, or notes a restarted on-demand runner needs a fresh work order), and git fetch/pull/push no longer fail when another session of the same repo starts on a runner with --capacity above 1.
• Workflow scripts no longer silently truncate results and agent options nested deeper than about 20,000 levels.
• Plugin $ methods now run in the calling agent's working directory and respect the turn their hook holds; $.agent.register is refused from a hook still running after the mod was reloaded or removed; $.http.fetch no longer rejects a HEAD request whose declared Content-Length exceeds the 4 MiB body limit.
• Secret redaction in shared transcripts and debug logs now catches values following a key with no value, including JSON inside a shell string.
• Marketplace names like constructor no longer break plugin marketplace add, marketplace update, or plugin install; add refuses such names clearly. Plugin secrets named constructor or prototype are no longer deleted on the next options save.
• Esc or an interrupt during a UserPromptSubmit hook or a mod's prompt.submit hook no longer ends headless sessions, clears the typed prompt, or lets the unchecked prompt through.
• Toasts and notifications no longer wait unseen while the /diff panel or a dialog is open.
• --teleport no longer opens an empty conversation when the session history can't be read.

If you maintain managed settings, run self-hosted runners, or rely on subagent workflows, this release touches those paths directly.