Source: github.com/anthropics/claude-code/releases/tag/v2.1.305
The new sandbox.allowNestedUserNamespaces setting lets sandboxed commands on Linux create user namespaces, which the changelog says lets Chromium and rootless podman run, but also lets those commands get around the sandbox's file protections. A new CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS variable lets unattended retry mode notice a usage limit that was lifted before its reset.
Claude Code now retries without tool search when a Vertex, Bedrock or other endpoint, or a gateway, rejects it or has ToolSearch disallowed or left out of --tools. Other fixes cover new worktrees in bare repositories starting from local HEAD, a clearer error when a Bash command fails on a full disk, and /effort and /autocompact settings that failed to match model names.
Changes to allowedMcpServers stop filtering managed-mcp.json stdio servers that use ${VAR} only in env, so a server the allowlist previously left out now loads on upgrade. Code Review re-reviews also no longer open with LGTM while earlier blocking findings remain open.
Why it matters if you build agents
Teams running agents in Linux sandboxes should decide whether to enable the new nested namespace setting, since it can weaken file protections. Check managed-mcp.json after upgrading, because stdio servers that were filtered out may now start. Agent builders on Vertex, Bedrock and similar providers should no longer see every request fail when tool search is rejected.
Get stories like this every weekday
One short email with the day's agent tooling news.