Claude Code 2.1.305 repairs requests on Vertex and Bedrock

Claude Code 2.1.305 fixes a regression from the previous release that made every request fail on Vertex, Bedrock and other providers whenever the endpoint or a gateway rejected tool search. The client now retries without it, including behind gateways that disallow ToolSearch or leave it out of --tools, according to the release notes on GitHub published October 20.

The breakage grew out of a deliberate change. The Claude Code changelog shows that 2.1.304 turned tool search on by default behind a custom ANTHROPIC_BASE_URL, and it shipped with a fallback: a 400 or 422 from the gateway was supposed to trigger a retry without it. That fallback appears to have covered only part of the ground. The 2.1.305 entry names Vertex and Bedrock directly, along with gateways where ToolSearch is disallowed or missing from the tool list, and those are the setups where every request failed. For teams on a cloud provider, 2.1.304 was a version to skip.

A second fix in the release hits the same users. /effort and /autocompact settings did not apply when the model name differed from a modelOverrides value by letter case or by a [1m] tag. Both now match.

The new sandbox option deserves a closer look before you turn it on. sandbox.allowNestedUserNamespaces lets sandboxed commands on Linux create user namespaces, the kernel feature that gives an unprivileged process its own isolated set of user IDs. Chromium and rootless podman need it, which is why it was added. The release notes state the cost in the same entry: with the option on, those commands can get around the sandbox’s file protections.

Unattended retry mode, the one switched on with CLAUDE_CODE_RETRY_WATCHDOG, gets the opposite of a change it saw a few releases ago. In 2.1.301 a new variable capped how long the watchdog waits on a usage limit that resets far in the future. CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS deals with a limit that gets lifted before its scheduled reset. The watchdog now rechecks and notices, so it stops sitting out a limit that is already gone.

Most of the remaining fixes concern agents and sessions. New worktrees in a bare repository sometimes started from local HEAD instead of the default branch, and subagent worktrees with no changes were sometimes left behind. After a subagent switched to a fallback model, Claude could name the wrong model for its work. Workflow resume re-ran pipeline() and parallel() agents that had already finished, when it should have served them from the run’s journal. And an MCP server passed in by a cloud session or by the SDK’s setMcpServers could be replaced later in the session by a same-named server from your own settings.

Cloud sessions get two fixes. Scheduled Cowork cloud sessions waited five minutes for each subagent whose WebFetch needed a URL approval with nobody there to give it. This release fixes more of those cases, so the problem had been patched before. Cloud sessions and teammates also failed to tell Claude when a compaction had to leave the oldest messages out of its summary to fit. They now say so.

Several changes are about error messages. A Bash command on a full disk used to fail with a raw ENOSPC file path, and the error now says the disk is full and that nothing ran. Each /usage warning is now a one-line fix that names its source, pressing f applies the fixes, and the same fixes show up in VS Code and /doctor. Startup warnings that used to print as raw text above the logo now go to the debug log. Permission rules that restrict nothing appear as warning rows under the banner. In screen reader mode, search boxes now say “Search:” in place of a symbol VoiceOver read aloud as “telephone recorder”.

The self-hosted runner gets three fixes, and two of them undo older regressions. A start script that shares only its stdout with the runner or orchestrator failed with “Resource temporarily unavailable” when TERM was set, which dates back to 2.1.300. Repository access had failed since 2.1.296 whenever a git credential helper or askpass program read its settings through GIT_CONFIG. The orchestrator also stopped reporting a spawn-runner hook as timed out when a runner it started in the background kept its output open.

Code Review sometimes skipped the newest commit when several pushes landed on a pull request during a review. Re-reviews also no longer open with LGTM while earlier blocking findings are still open. Claude Tag picks up routine fixes for Slack threads: a routine that reported success without posting after the conversation ended is now skipped, and its creator is told. Admins can also find public Slack channels Claude hasn’t joined in the Add place search.

Some changes alter behavior on upgrade and may break habits or configs. The /artifacts delete confirmation now takes 1 or Enter to keep, 2 to delete and Esc to cancel, and y and n no longer answer it. Plugins that Claude Desktop mounts by path lose their allowed-tools when your organization’s managed settings set allowManagedPermissionRulesOnly. In VS Code, the message for a session that doesn’t start in time and has no hook running now leads with the output logs, where it used to point to sign-in and network first.

The change admins should check first is to allowedMcpServers. It no longer filters stdio servers in managed-mcp.json that use ${VAR} only in env, so a server like that which your allowlist left out will load after the upgrade. To keep it off, add it to deniedMcpServers.