Claude Code v2.1.304 Adds /auto-mode-setup, decider: "person", and Read-Only Tool Sig

Anthropic released Claude Code v2.1.304, a large maintenance release that adds guided auto-mode setup, new mod/plugin permission primitives, and roughly thirty fixes across sandboxing, transcripts, Remote Control, and telemetry.

New mod and plugin APIs

• decider: "person" on a mod's tool.check answer: only the permission dialog or a host callback can approve the ask. Where nobody can be asked, the call is refused with the mod's reason.
• e.isReadOnly on the tool.check event — set to true when the tool call is read-only, so a mod can let read-only calls through without prompting.
• Mods now get a transcript line when a plugin that runs first skips one of the mod's hooks, naming both the event and the plugin.

Slash command additions

• /auto-mode-setup: guided setup that reads your project and recent sessions and teaches auto mode about your environment. Now also available on Bedrock, Vertex, Foundry, the Claude apps gateway, and telemetry-disabled sessions.
• /claude-api managed-agents-secure: compares a Managed Agents agent's settings against Anthropic's published security guide. Read-only — nothing is modified.

Transcript and usage changes

• Compaction summaries in the transcript view (Ctrl+O) now list the names of tools called earlier in the conversation.
• Pro and Max plans warn when resuming an inactive conversation would use a noticeable share of the 5-hour usage limit. You can resume anyway, or start a new conversation and Claude can look up the earlier one if you refer to it.

Notable fixes

• Sandboxed commands on Linux failed to start when a sandbox.filesystem.denyRead glob contained brackets that are not a character class, e.g. a [user-id] route folder.
• rm -r on a mounted drive or a top-level folder (/Volumes, /media, WSL's /mnt/c) now gets the same safety prompt that rm -rf /Applications does.
• CLAUDE_CODE_TRANSCRIPT_LOCAL_GC could drop messages when the disk filled up mid-trim.
• A plugin could keep a headless run going past --max-turns, Stop, or ended input by spawning subagents or re-running a finished one.
• Failed mod reloads no longer strip tools/commands from the version that stays loaded.
• context_management: Extra inputs are not permitted errors behind LLM gateways — Claude Code now resends the request without that field.
• Unsandboxed Bash in Claude Desktop Code tab sessions on macOS/Linux now sees env vars from ~/.zshrc and similar startup files.
• Write results and rejected edits outside the working directory display ~/… or the full path instead of ../../….
• Remote Control history no longer stays withheld when a different account was signed in to the terminal.
• claude --help text for --tools, --resume, --debug, --json-schema, --disable-slash-commands, --system-prompt-snapshot, and claude update now matches actual behavior.
• claude --worktree no longer removes the worktree and its branch without asking at exit.

Developers writing mods or plugins should look at the new tool.check fields first; everyone else gets the security prompt and gateway fixes. There is also a new warning on Pro/Max plan resumes, and a fix for scheduled Cowork cloud sessions that were waiting five minutes per subagent on WebFetch URL approvals nobody could give.