Claude Code v2.1.304 adds person-only tool approvals, auto-mode setup, and managed-agents security audit
cliClaude Code 2.1.304 ships several agent-authoring features: plugin `tool.check` hooks can now return `decider: "person"` to force human approval, and receive `e.isReadOnly` for read-only tool calls. A new `/auto-mode-setup` command teaches auto mode about your project (now also on Bedrock, Vertex, Foundry and Claude apps gateway), and `/claude-api managed-agents-secure` audits Managed Agent configs against Anthropic's security guide. Plus many fixes to subagents, hooks, headl
An agent author can now force human-only approval on tool calls via `decider: "person"`, detect read-only calls in hooks, bootstrap auto mode with `/auto-mode-setup`, and audit Managed Agents against Anthropic's security guide with `/claude-api managed-agents-secure`.
Point release but introduces several net-new plugin-API surface (decider: person, isReadOnly) and new slash commands (/auto-mode-setup, /claude-api managed-agents-secure) that agent authors can leverage.
npm i -g @anthropic-ai/claude-code@2.1.304// In a Claude Code plugin, force human approval for a tool call
export const hooks = {
async 'tool.check'(e) {
if (e.tool === 'Bash' && !e.isReadOnly) {
return {
decider: 'person',
reason: 'Shell writes must be approved by a human reviewer.'
};
}
}
};