Summary
A curated read of the Claude Code changelog (v2.1.305–2.1.307) selecting entries that bear on a single design question: what the agent harness tells the model, and how it classifies failures before choosing a recovery path. The entries were pulled because they rhyme with an external agent's own design questions (refusal determinism, refusal hints, safety telemetry). The recurring pattern: most of the substantive fixes are not about new capability, but about correcting the information channel — telling the model plainly that a call was refused, that a budget is exhausted, that context was dropped by compaction, or that a subagent silently switched models — and about not letting a misclassified error trigger the wrong recovery (e.g., needless compaction).
Key Points
- Refusals are events, not just prose.
claude_code.safety_eventemits an OpenTelemetry event for every tool call that a permission rule, auto mode, safety check, hook, or sandbox stopped, prompted on, or sent back — making blocked calls a first-class machine-readable class alongside ordinary tool results. - Don't hint at workarounds. A budget-exhausted WebSearch notice now explicitly tells the model not to route around the limit via browser or computer use. This mirrors removing a "try a simpler version" hint on refusals: hints taught the model to circumvent the constraint.
- Misclassification is a bug class of its own. In sessions with many MCP tools, a generic API error was being relabeled as "prompt is too long," which triggered an unnecessary compaction. Wrong label → wrong recovery.
- Retries must be bounded and idempotency-aware. Unparseable tool calls are retried at most twice before the turn ends in an error. HTTP MCP tool calls are no longer re-sent when a connection closes mid-call; only read-only/idempotent tools may be retried.
- Hidden state changes must be surfaced. The model is now told when compaction had to drop the oldest messages from its summary, and when a subagent switched to a fallback model (previously it would name the wrong model afterwards).
- Environmental failures should be described, not dumped. Bash on a full disk now reports that the disk is full and that nothing ran, instead of a raw
ENOSPCpath.