Code Review has to fit repositories with very different needs, and until now the depth and the guidance behind a review were hard to tune. This week gives owners a depth setting per organization and per repository, lets REVIEW.md pull in shared guidance, and adds a way to switch off an always-on subscription on a single pull request. Around it sit smaller changes to agent view, auto mode, the gateway, the sandbox and cloud sessions.
This update covers week 43 (October 19-23, 2026): versions 2.1.304 to 2.1.310, seven releases and 265 changelog entries. Below are the changes that affect daily work, ordered by how much they change your setup.
How to tune Code Review for your organization and your repositories
Three review levels. Owners can now choose Quick, Standard or Deep Code Review for the whole organization. Standard is the default. Individual repositories can get their own level, so a critical service and a docs repository do not have to share one setting. The level arrived in 2.1.304.
Org-wide coverage. The Code Review admin settings can now review every repository in a GitHub organization, including repositories added later. Combined with per-repository levels, you set a baseline once and override only where needed.
REVIEW.md can include other files. A line in the root REVIEW.md that contains only @ and a file name is replaced by that file’s contents when Code Review reads it. You can use this to keep shared review rules in one file instead of copying them around.
Skills as review guidance. If you already keep guidance in a skill, include the skill’s SKILL.md with an @ line that gives its path under .claude/skills/. Code Review does not run skills. It only puts the file’s contents into the review instructions.
The conditions for includes are worth checking before you rely on them:
- Included files and skill files apply only when
REVIEW.mdis read from a protected branch. - On an unprotected default branch the
@line stays inREVIEW.mdas plain text, and nothing is included. - The line must contain only the
@and the path.
(If your default branch is unprotected, the includes will silently do nothing, so check this first when a review ignores your guidance.)
Stopping a subscription. @claude review stop ends the pull request’s subscription to push-triggered reviews, without starting a review and without canceling one that is already running. off and pause work as aliases. This is the command for a pull request where @claude review always has become noise. It landed in 2.1.307.
Replies to findings. Replying to a Code Review comment does not start a review. The next review reads the replies and can resolve the thread or post one follow-up reply. So you can explain or disagree in a comment, and the answer comes with the next review.
The details are in the Code Review customization docs.
Changes for everyday work
Model, effort and fast mode in agent view. In the agent view dispatch input, type /model, /effort or /fast and press Enter. The sessions you dispatch afterward start with what you set, and nothing is saved to settings. Typed alone, each command opens a picker. /effort and /fast need Claude Code v2.1.299 or later, as does /model typed with nothing after it. The dispatch input does not accept /effort ultracode. For that level, start agent view with claude agents --effort ultracode. See the agent view docs.
/auto-mode-setup reaches more environments. The guided setup reads your project and recent sessions to teach auto mode about your environment. It is now available on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions (2.1.304). On an Enterprise plan or with a Claude Console API key you need v2.1.304 or later. The auto mode configuration docs describe the setup.
Monitor tool on the same platforms. The Monitor tool and plugin monitors now work on Bedrock, Vertex and Foundry, and also when telemetry or nonessential traffic is disabled (2.1.310). Long foreground sleeps are blocked there too.
Sandbox and permission behavior. Several defaults changed, and some of them can surprise a script:
sandbox.allowNestedUserNamespaces(2.1.305) lets sandboxed commands on Linux create user namespaces, for example for Chromium or rootless podman. The catch is that this lets them get around the sandbox’s file protections.claude ultrareviewnow requires workspace trust (2.1.309). It asks on a terminal and otherwise refuses. Scripts pass--trust-workspace, which takes no value, so put a PR number or base branch before it. You can also setCLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.sed -inow gets the standard Bash prompt and runs as written, instead of showing a simulated file-edit preview. Like other Bash edits, it is no longer restored by/rewind.- In bypass permissions mode in the Desktop app and VS Code, dangerous
rmandrmdircommands are now denied at once with a rewrite hint, so unattended sessions keep going.
More on the sandbox is in the sandboxing docs.
Cloud sessions and roles. If custom roles govern your organization, members now need a role with the cloud sessions permission to start cloud sessions. An Owner can add it under Organization settings > Roles. Enterprise custom roles also cover Remote Control permissions (2.1.310), so access to each can be controlled by role. Cloud sessions take a permission mode from the mode dropdown, both when you create the task and while the session runs. And claude -p --cloud <session-id> accepts the message on stdin, for example echo "your message" | claude -p --cloud <session-id>. Details are in the cloud sessions docs.
Gateway controls for admins. Claude apps gateway admins can block specific models or versions with the new deniedModels and availableModelsMatch keys. A blocked model is rejected with a 400 at /v1/messages and left out of /v1/models. deniedModels joins the deny-lists that merge as a union of base and policy settings, so a per-role override cannot drop it. Policies can request the one-hour prompt cache TTL instead of the default five minutes through promptCacheTtl and subagentPromptCacheTtl.
On developer machines, setting CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS (v2.1.307 or later) caps how long a streaming request waits for response headers, so an unanswered request is retried sooner. When the deadline fires, Claude Code logs [first-byte] no response headers in debug output, which lets you confirm it triggered. See the gateway configuration docs.
Technical notes
Claude API and Managed Agents. /claude-api api-version moves Claude API code to API version 2026-10-21 (2.1.307). /claude-api managed-agents-secure compares a Managed Agents agent’s settings with Anthropic’s published security guide and changes nothing (2.1.304).
MCP allowlists. allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only in env (2.1.305). A server your allowlist left out now loads after the upgrade. If you want it off, add it to deniedMcpServers.
Usage limits. Pro and Max plans now get a warning when resuming an inactive conversation would use a noticeable share of the 5-hour limit. You can resume anyway or start a new conversation (2.1.304). /usage warnings are now one-line fixes that name their source, and pressing f applies them. The same fixes appear in VS Code and /doctor (2.1.305). For unattended retry mode, CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS lets it notice a usage limit that was lifted before its reset (2.1.305).
Observability. The new claude_code.safety_event OpenTelemetry event fires for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back (2.1.307). That gives you one event type to count when you want to see how often guardrails step in.
Sessions and the shell. claude respawn restarts a session in the directory you are in, from your shell. Skills, custom commands and prompt-expanding built-ins such as /init are now sent to a new background session as its first prompt instead of being refused.
VS Code. In the panel, background sub-agents now show as one status line under their Agent card, with the full transcript in /tasks (2.1.304).
Claude Design. New /design consent and /design revoke commands grant or withdraw Claude’s access to Claude Design.
What to take away
If you work mostly in the terminal:
- Check your scripts that call
claude ultrareview. They now need--trust-workspace(after any PR number or base branch) or the environment variable. - Remember that
sed -inow runs as a normal Bash command, so/rewindwill not restore its changes. - Try
/usageand pressfto apply the suggested one-line fixes. - Look at
claude respawnif you restart sessions in the same directory often.
If you run parallel sessions:
- Set the model, effort and fast mode with
/model,/effortand/fastin the agent view dispatch input before you dispatch. Make sure you are on v2.1.299 or later. For ultracode effort, start withclaude agents --effort ultracode. - Background sessions now accept skills and prompt-expanding commands as the first prompt.
- In cloud sessions, pick the permission mode in the dropdown and pipe messages to
claude -p --cloud <session-id>where it fits your pipeline.
If you administer integrations and company deployments:
- Choose a Code Review level for the organization, then override it per repository. Check that
REVIEW.mdis read from a protected branch before you rely on@includes. - If you use custom roles, add the cloud sessions permission under Organization settings > Roles, or members cannot start cloud sessions.
- On the gateway, consider
deniedModelsand the one-hour cache keys. SetCLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MSon developer machines if unanswered streaming requests are a problem. - Review your
allowedMcpServerslist. Amanaged-mcp.jsonstdio server with${VAR}only inenvnow loads, so usedeniedMcpServersfor any you want off. - Weigh
sandbox.allowNestedUserNamespacesbefore enabling it, since it lets sandboxed commands get around the file protections.
Sources: the Claude Code changelog, versions 2.1.304 to 2.1.310 (week of October 19-23, 2026), and the Claude Code documentation pages linked above. Availability of beta features may change.
