Claude Code v2.1.305: Linux Sandbox Namespaces, Provider Retry Fix, and Self-Hosted Runner Patches

Claude Code v2.1.305 is out, and the headline fix is a 2.1.304 regression: every request failed on Vertex, Bedrock, and other providers when the endpoint or gateway rejected tool search. Behind gateways where ToolSearch is disallowed or left out of --tools, requests also broke. Claude Code now retries without tool search when it sees that rejection.

Sandbox: nested user namespaces on Linux

A new setting, sandbox.allowNestedUserNamespaces, lets sandboxed commands on Linux create user namespaces. That covers things like Chromium and rootless podman — and the release notes are direct about the tradeoff: this lets them get around the sandbox's file protections. Enable it knowingly.

Unattended retry mode

CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS is a new env var for unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG). It makes the watchdog notice a usage limit that was lifted before its reset time, instead of waiting out the full window.

Other fixes worth knowing

• /effort and /autocompact settings now apply when the model name differs from a modelOverrides value by letter case or a [1m] tag.
• New worktrees in a bare repository no longer sometimes start from local HEAD instead of the default branch; unchanged subagent worktrees are cleaned up.
• Bash commands on a full disk now say the disk is full and that nothing ran, instead of a raw ENOSPC file path.
• An MCP server passed by a cloud session or the SDK's setMcpServers is no longer replaced later in the session by a same-named server from your own settings.
• Subagent fallback model switches no longer make Claude name the wrong model for its work.
• Workflow resume serves already-completed pipeline() and parallel() agents from the run's journal instead of re-running them.
• Scheduled Cowork cloud sessions no longer wait five minutes per subagent whose WebFetch needs a URL approval nobody can give.
• Startup warnings moved to the debug log; permission rules that restrict nothing now show as warning rows under the banner.
• Screen reader mode: search boxes say "Search:" instead of a symbol VoiceOver read as "telephone recorder", and highlighted prompt text no longer has spaces inserted inside words.

Self-hosted runner

• Fixed a start script sharing only stdout with the runner or orchestrator failing with Resource temporarily unavailable when TERM is set (2.1.300 regression).
• Fixed repository access failing since 2.1.296 when a git credential helper or askpass program reads settings through GIT_CONFIG.
• Fixed the orchestrator reporting a spawn-runner hook as timed out when a background runner kept its output open.

Behavior changes

• /usage warnings are now one-line fixes that name their source; press f to apply. Same fixes appear in VS Code and /doctor.
• MCP consent dialogs are less likely to treat an Enter meant for the prompt as Accept.
• allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only in env — an omitted server now loads on upgrade; use deniedMcpServers to keep it off.
• /artifacts delete confirmation now takes 1/Enter to keep, 2 to delete, Esc to cancel; y and n no longer answer it.