docs: Claude Code v2.1.310 - Monitor tool on Bedrock/Vertex/Foundry, Windows hook bypass fix, Claude Tag SDK endpoints

content/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 2.1.310
+
+- Added the Monitor tool and plugin monitors on Bedrock, Vertex, and Foundry, and when telemetry or nonessential traffic is disabled; long foreground sleeps are now blocked there too
+- Fixed requests failing behind some gateways and compatible servers that reject the `effort-2025-11-24` beta value or mid-conversation system messages; Claude Code now retries without them
+- Fixed background cleanup deleting some recent files, such as pasted images, when `cleanupPeriodDays` is set to a very large value
+- Fixed compaction after a "Prompt is too long" error keeping too much of a conversation with dense text, such as base64 or SVG, so the next request could fail again
+- Fixed file read permission prompts not showing where a symbolic link leads
+- Fixed a question's auto-continue timeout firing the moment the external editor closed after a long edit
+- Windows: Fixed PreToolUse and PermissionRequest hooks letting a tool call through when Git Bash is missing and the hook's command is only quoted strings, such as a quoted path
+- Improved auto mode's prompt before the first read outside the working directories: it now says when blocking those reads makes shell commands ask for permission
+- Improved memory use of non-interactive sessions (`-p`, Agent SDK) during compaction when the transcript file is very large
+- Improved a mod's `Image` to draw inside tmux with `allow-passthrough` and `focus-events` on, in kitty, Ghostty, and iTerm2 3.5+ with fullscreen rendering, where it showed only its `alt` text
+- Linux: Improved `/sandbox` and the sandbox startup warning to name Ubuntu's AppArmor restriction on user namespaces, and how to lift it, when it keeps bubblewrap from starting the sandbox
+- Changed the error for an MCP tool call that times out in a non-interactive session while the server's elicitation is unanswered: it now tells Claude that no answer came and not to repeat the call
+- [VSCode] Fixed pressing Enter on the plan review card's "Send feedback and keep planning" button approving the plan instead of sending your comments back
+- [VSCode] Fixed the panel showing "Something went wrong" after "Switch branch & continue" on a cloud session opened from Session history's Web tab
+- [Cloud sessions] Added Claude Code cloud sessions and Remote Control permissions to Enterprise custom roles, so Owners can control access to each by role
+- [Cloud sessions] Added a Choose file button to load a cloud environment's setup script from a file
+- [Cloud sessions] Fixed failed saves and archives in the cloud environment edit dialog showing no error inside the dialog
+- [Cloud sessions] Fixed failed routine API token actions showing only a toast; the error now appears in the routine edit dialog
+- [Cloud sessions] Improved the session start checklist to show a cloud environment's setup script output in a scrolling box
+- [Cloud sessions] Changed turning on Cloud sessions or Remote Control in admin settings to ask for confirmation and list the custom roles that have that permission
+- [Cloud sessions] Changed the cloud environment dialog to open network access, setup script and environment variables from rows instead of listing every editor at once
+- [Claude Tag] Fixed Claude Tag treating `!` commands such as `!restart` and `!help` as ordinary messages when sent in bold, italic or strikethrough
+- [Claude Tag] Fixed Claude Tag admin channel and workspace pages being replaced by a load error when a background refresh of the bundle list fails
+- [Claude Tag] Fixed Claude Tag's spend limits page in admin settings reporting that no channels match a filter while channel names are still loading
+- [Code Review] Fixed the Code Review admin section hiding its repositories and switches after a failed refresh of the repository list
+- [Code Review] Improved the Code Review admin section to retry the first load and show one Try again banner when it still fails
+
 ## 2.1.309
 
 - Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command

content/claude-code-manifest.json

@@ -6,25 +6,25 @@
     "url": "https://github.com/anthropics/claude-code/issues"
   },
   "dist": {
-    "shasum": "f9e48d703c778c2814136cf492918f49f2c4bbfb",
-    "tarball": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.309.tgz",
+    "shasum": "b5029e530ac7794608227f2ef47d313b1af90460",
+    "tarball": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.310.tgz",
     "fileCount": 7,
-    "integrity": "sha512-+lBYZRuXOJpiKJcRv/CK7gF+5UFNWyJE7hSxkgGUKDZOWgANl9MAabfTkrJk183Tp3B0Nv4xF/DU1t0BaKXOPw==",
+    "integrity": "sha512-EySpBwaocdU1nc9r7JH+GOlnMsbXc764d3HX7NL8fr7qqdxz2MiXI9hqf/rzeE/XgU23HHFltIqhb+Fq6G1CVw==",
     "signatures": [
       {
-        "sig": "MEQCIA9wG+9pBE3bRRep/aS4hZtRrmLmWkwD2bAtA7ItFsTSAiA68FU1S0fxubHAI2k73DL4cts1+1y6w83ljfz+0haS5w==",
+        "sig": "MEYCIQCBsEeg95a/BI2ZZrmVgK7s24fdmlu+SWa0TE4MC2sybAIhAMgYcTIg5RRYabnoOl0c48kLSLgjS6wgITkDObLeUoN9",
         "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"
       },
       {
-        "sig": "MEYCIQDD6ykXd+VNDiAvUAPBaIqTjKCdXODxrhN0INiExSEJngIhAN4p5uFgnWLz3aY+TGt7rJEMDI82BbQ0nIbk6bAqTDRD",
+        "sig": "MEUCIQDuwuwLl6dzu2cdC2znBNiwGV8eoR1MO6g6H6x8eMB78AIgHBbRB9dD41C2JB+4x1xE8OhtGkyy0tyu9Y2HbOGdKyY=",
         "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"
       }
     ],
     "unpackedSize": 189395
   },
   "name": "@anthropic-ai/claude-code",
   "type": "module",
-  "_from": "file:staged-npm/anthropic-ai-claude-code-2.1.309.tgz",
+  "_from": "file:staged-npm/anthropic-ai-claude-code-2.1.310.tgz",
   "author": {
     "name": "Anthropic",
     "email": "support@anthropic.com"
@@ -46,9 +46,9 @@
     }
   },
   "homepage": "https://github.com/anthropics/claude-code",
-  "_resolved": "/home/runner/work/claude-cli-internal/claude-cli-internal/staged-npm/anthropic-ai-claude-code-2.1.309.tgz",
-  "_integrity": "sha512-+lBYZRuXOJpiKJcRv/CK7gF+5UFNWyJE7hSxkgGUKDZOWgANl9MAabfTkrJk183Tp3B0Nv4xF/DU1t0BaKXOPw==",
-  "_npmVersion": "11.19.1",
+  "_resolved": "/home/runner/work/claude-cli-internal/claude-cli-internal/staged-npm/anthropic-ai-claude-code-2.1.310.tgz",
+  "_integrity": "sha512-EySpBwaocdU1nc9r7JH+GOlnMsbXc764d3HX7NL8fr7qqdxz2MiXI9hqf/rzeE/XgU23HHFltIqhb+Fq6G1CVw==",
+  "_npmVersion": "11.19.0",
   "description": "Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.",
   "directories": {},
   "maintainers": [
@@ -113,24 +113,24 @@
       "email": "joan@anthropic.com"
     }
   ],
-  "_nodeVersion": "24.22.1",
+  "_nodeVersion": "24.21.0",
   "dependencies": {},
   "_hasShrinkwrap": false,
   "readmeFilename": "README.md",
   "optionalDependencies": {
-    "@anthropic-ai/claude-code-linux-x64": "2.1.309",
-    "@anthropic-ai/claude-code-win32-x64": "2.1.309",
-    "@anthropic-ai/claude-code-darwin-x64": "2.1.309",
-    "@anthropic-ai/claude-code-linux-arm64": "2.1.309",
-    "@anthropic-ai/claude-code-win32-arm64": "2.1.309",
-    "@anthropic-ai/claude-code-darwin-arm64": "2.1.309",
-    "@anthropic-ai/claude-code-linux-x64-musl": "2.1.309",
-    "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.309"
+    "@anthropic-ai/claude-code-linux-x64": "2.1.310",
+    "@anthropic-ai/claude-code-win32-x64": "2.1.310",
+    "@anthropic-ai/claude-code-darwin-x64": "2.1.310",
+    "@anthropic-ai/claude-code-linux-arm64": "2.1.310",
+    "@anthropic-ai/claude-code-win32-arm64": "2.1.310",
+    "@anthropic-ai/claude-code-darwin-arm64": "2.1.310",
+    "@anthropic-ai/claude-code-linux-x64-musl": "2.1.310",
+    "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.310"
   },
   "_npmOperationalInternal": {
-    "tmp": "tmp/claude-code_2.1.309_1792701253628_0.164768826083858",
+    "tmp": "tmp/claude-code_2.1.310_1792790446423_0.3447557044193563",
     "host": "s3://npm-registry-packages-npm-production"
   },
-  "_id": "@anthropic-ai/claude-code@2.1.309",
-  "version": "2.1.309"
+  "_id": "@anthropic-ai/claude-code@2.1.310",
+  "version": "2.1.310"
 }

content/claude/claude-science/changelog.md

@@ -16,6 +16,7 @@ October 21, 2026
 
 October 21, 2026
 
+* As a precaution following the publicly reported compromise of several emSign (eMudhra) intermediate certificate authority (CA) keys, most of the connections Claude Science makes itself, and many of the package installs it runs itself, no longer trust emSign (eMudhra) root certificates or one other root certificate. Versions 0.1.69 and later include all of these changes; to update, see [Update Claude Science](https://claude.com/docs/claude-science/update-claude-science.md)
 * A new **Trouble updating?** link opens [Update Claude Science](https://claude.com/docs/claude-science/update-claude-science.md), a help page with other ways to update. It shows in **Settings > General > About**, in the **Update required** box, and on the "Update available" notice while an update downloads or after one fails
 * Cloud storage in Settings now works with Google Cloud Storage HMAC keys on computers where no AWS region is set
 * Mac: if `config.toml` has `auto_update = false` under `[update]`, Claude Science in its own window no longer checks for updates in the background. You can still check with **Claude Science > Check for App Updates…** in the menu bar

content/claude/claude-tag/admins/add-connections.md

@@ -208,7 +208,7 @@ After you save a credential, you can narrow it further than its allowed websites
 
 To narrow a credential before any channel can use it, add the connector to a new [bundle](#create-a-bundle), select **Edit** from the menu on its row under **What's in it**, and add the bundle's places last.
 
-Agent Proxy starts applying an edit to a credential or a domain entry within about a minute after you save it, in existing threads as well as new ones. It checks the channel's credentials and domain entries first, then the workspace's, then the organization's, and within each by priority. A request that matches no credential, no domain entry, and nothing in the environment's network access is blocked. Private IP ranges and cloud metadata endpoints stay blocked regardless.
+Agent Proxy starts applying an edit to a credential or a domain entry within about a minute after you save it, in existing threads as well as new ones. It checks the channel's credentials and domain entries first, then the workspace's, then the organization's, and within each by priority. A request that matches no credential, no domain entry, and nothing in the environment's network access is blocked, apart from [GitHub API requests and git operations](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress), which a separate GitHub proxy handles. Private IP ranges and cloud metadata endpoints stay blocked regardless.
 
 ## Create a bundle
 
@@ -268,7 +268,7 @@ Claude does channel work in an isolated [sandbox](https://claude.com/docs/claude
 * **A [connector](#add-a-connector)**: a credential that applies to the channel. Requests matching its [allowed websites](#set-allowed-websites) pass with that credential attached.
 * **The channel's [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the Trusted access level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
 
-A host that none of these allows stays unreachable, and when more than one bundle applies to a channel, the entries of all of them apply. Web search is governed by none of them, because searching happens on Anthropic's servers rather than in the sandbox; see [Web search vs. network requests](#web-search-vs-network-requests).
+A host that none of these allows stays unreachable, and when more than one bundle applies to a channel, the entries of all of them apply. Web search is governed by none of them, because searching happens on Anthropic's servers rather than in the sandbox; see [Web search vs. network requests](#web-search-vs-network-requests). Claude's GitHub API requests and git operations are governed by none of them either, because they go through a separate GitHub proxy. That proxy limits them to the repositories you [granted to the channel](https://claude.com/docs/claude-tag/admins/configure-github.md#grant-repository-access), except that git may still be able to clone public repositories you didn't grant.
 
 ### Add a domain
 

content/claude/claude-tag/admins/network-requirements.md

@@ -22,7 +22,7 @@ Requests from Claude to your services originate from Anthropic's network. To let
 
 The authoritative list is [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses); check it when you create the rule.
 
-The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) are what scope which of *your* systems Claude can call.
+The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) are what scope which of *your* systems Claude can call. For GitHub, the repositories you granted to the channel do that scoping instead, except that git may still be able to clone public repositories you didn't grant; see [Network egress](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress).
 
 > [!NOTE]
 >

content/claude/claude-tag/concepts/agent-identity.md

@@ -30,7 +30,7 @@ When Claude works on a channel task, the request moves through three places:
 
 The diagram below traces one request through this process.
 
-![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=lijct3C2aoA3LHFn\&q=85\&s=10d796e77738a52a505dcab2c9950cda)
+![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like an issue tracker, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/y3Hxae32FdEU67_n/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=y3Hxae32FdEU67_n\&q=85\&s=0cf396f807a5bc0ed4aec73a9feb5d06)
 
 **1. Tag Claude in a channel**
 
@@ -42,19 +42,19 @@ Claude does the work in an isolated environment built for this thread, reading f
 
 **3. The request crosses Agent Proxy**
 
-When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
+When the work needs something outside the sandbox, like querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
 
 **4. Agent Proxy attaches a credential**
 
 A matching credential comes from the credential store, which keeps the credentials of the [connectors](https://claude.com/docs/claude-tag/admins/add-connections.md) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
 
 **5. The result posts back, as Claude**
 
-The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread.
+The credentialed request reaches your system, like the warehouse, and the result returns to the thread.
 
 ### Agent Proxy
 
-For each outbound request from the sandbox, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
+For each outbound request from the sandbox, other than a GitHub API request or a git operation, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
 
 | When the destination | Result |
 | :- | :- |
@@ -75,6 +75,8 @@ For the endpoints and addresses your network team may need to allowlist, see [Ne
 
 A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](https://claude.com/docs/claude-tag/admins/add-connections.md).
 
+A GitHub API request or a git operation doesn't go through those layers. It goes through a separate GitHub proxy. See [Network egress](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress) for what governs those requests instead.
+
 ### Web search vs. network requests
 
 Claude can search the web from a channel without any Domains entry. Web search is [Anthropic's built-in web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool), which runs on Anthropic's servers, not code running in the channel's sandbox.