[claude-yolo]

Night shift report

WHY THIS MATTERS: Two Claude Code releases landed (2.1.305 and 2.1.306). 2.1.305 fixes a 2.1.304 regression where every request failed on Vertex, Bedrock and gateways that reject tool search, so anyone stuck on 2.1.304 behind a gateway should upgrade. On the platform side, the User Profiles API has left beta: it now has top-level /v1/user_profiles reference pages in every SDK language. It also has a new companion, organization webhooks (beta webhooks-2026-10-07), which tells you when Anthropic restricts or bans one of your end customers' profiles. Platforms and resellers will care about this one. No files were deleted.

HIGHLIGHTS:

• User Profiles GA: new non-beta reference tree content/en/api/user_profiles/ (create/retrieve/update/list/delete/action_urls), mirrored across the SDK language pages. The guide now links to the GA paths and calls enforcement actions "restriction or ban" instead of "hold or block". Profiles get enforcement_status / enforcement_actions fields plus an enforcement_status[] list filter. Requests pinned to user-profiles-2026-09-04 or earlier don't get these fields.
• New: Organization webhooks (manage-claude/organization-webhooks.md, /v1/organizations/webhooks CRUD plus regenerate_signing_secret). There are two events, user_profile.enforcement_action_opened and user_profile.enforcement_action_resolved. Delivery is not live yet: you can register endpoints, but nothing is sent. Access is request-only, and HIPAA-ready orgs are excluded.
• New endpoint: Set Workspace Rate Limits (POST /v1/organizations/workspaces/{id}/rate_limits/{rate_limit_id}) sets or clears per-workspace rate-limit overrides. It has both GA and beta pages.
• CC 2.1.305 security-relevant: sandbox.allowNestedUserNamespaces lets sandboxed Linux commands create user namespaces (for Chromium and rootless podman). The changelog says outright that this lets them get around the sandbox's file protections. allowedMcpServers no longer filters managed-mcp.json stdio servers that use ${VAR} only in env, so a server your allowlist left out now loads on upgrade. Admins need deniedMcpServers to keep it off.
• CC 2.1.305 other notable: Workflow resume no longer re-runs completed pipeline()/parallel() agents. New CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS. /usage warnings now come as one-line fixes you apply with f. Assorted Claude Tag, Code Review, VS Code and self-hosted runner fixes.
• CC 2.1.306: fixes claude -p in cloud sessions saying "Not logged in", and stops a real API error from being shown as "prompt is too long" in sessions with many MCP tools.
• Code Review: REVIEW.md can now pull in other root-level files with @file.md lines. Limits: one level deep, at most 8 files, 150KB combined, 64 links. Includes only apply when REVIEW.md is read from a protected branch.
• Agent SDK MCP docs: a long new section on how long the first turn waits for MCP servers (tool search, alwaysLoad, named servers, CLAUDE_CODE_MCP_STARTUP_WAIT_MS, MCP_CONNECTION_NONBLOCKING).
• errors.md grew by ~200 lines with new entries: browser sign-in listener failure, plugin manifest not read, teammate-only shutdown approval, permission rules that match no tool.
• Tombstones (+2, MCP governance reshuffle): community/working-groups/agents moved to community/interest-groups/agents (the Agents WG was demoted to an interest group). working-groups/triggers-events was renamed to working-groups/tasks-events. The new target pages are archived and the roadmap was updated to match. The old local files still sit on disk as stale copies.
• New product page: claude-science/update-claude-science.md (how to update the app and get past "Update required").
• Bulk churn: ~1,400 API reference files across the SDK languages (mostly the user-profiles/enforcement fields and webhook additions). discovery.json changed only its date, so no new sources.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning