Claude Code 2.1.303–2.1.310: Safety Telemetry, Code Review Levels and Sandbox Hardening
Claude Code shipped eight releases between October 18 and 23. The new features fall into three groups: observability, review and setup.
claude_code.safety_event(2.1.307): an OpenTelemetry event for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back. Teams can now chart how often their guardrails fire.- Code Review levels (2.1.304): Quick, Standard (the default) or Deep, set per organization or per repository.
@claude review stopends an@claude review alwayssubscription on a pull request. /auto-mode-setup(2.1.304): a guided setup that reads your project and recent sessions to teach auto mode about your environment, now also on Bedrock, Vertex and Foundry./claude-apiadditions:managed-agents-securecompares a Managed Agents configuration against Anthropic's security guide, andapi-versionmigrates code to API version 2026-10-21.
Several changes tighten the sandbox and the permission system. In 2.1.309, sandboxed Bash on macOS and Linux no longer runs shell startup files outside the sandbox before each command. Sandboxed commands and auto-accepted edits can no longer modify the file passed with --mcp-config. PowerShell hooks that exit with code 2 now block correctly. Dangerous rm/rmdir commands are denied immediately in bypass-permissions mode in Desktop and VS Code, and claude ultrareview now requires workspace trust. In 2.1.305, the new sandbox.allowNestedUserNamespaces setting lets sandboxed commands on Linux create user namespaces (for example Chromium or rootless podman). The changelog warns that this can weaken file protections, so enable it only when you need it.
A batch of fixes targets LLM gateways. When a gateway rejects tool search, context_management fields, the effort beta value or mid-conversation system messages, Claude Code now retries without them. HTTP MCP tool calls are no longer sent twice when the connection drops; only read-only or idempotent tools are retried. The Monitor tool now works on Bedrock, Vertex and Foundry (2.1.310).
Read more — Claude Code Changelog
Codex CLI 0.164: Prompt Presets, Enterprise MCP Auth and Credential Masking
OpenAI released Codex CLI 0.164.0 on October 23. The main addition is /presets, which gives you ten numbered slots for saved prompts and slash commands behind a keyboard menu. /model now accepts inline arguments for model, reasoning effort and speed, and /permissions accepts a permission profile name. Together these let you switch configurations with one command. Kitty and Sixel terminals now show image previews in the fullscreen transcript, and the Amazon Bedrock setup wizard is on by default.
For enterprise use, MCP servers can now authenticate through eligible Codex account grants or a dedicated sign-in, including OAuth clients that need a client secret. Credential masking now covers remote Bash commands and Zsh snapshot sessions, including credentials from custom providers, so secrets stop appearing in transcripts and logs.
The release also has reliability and security fixes. A failed compaction no longer leaves a partial summary in history. Resumed sessions find compressed histories and restore saved thread settings. Windows proxy authentication uses the signed-in user's credentials. Sandbox checks were hardened against case-variant macOS paths and replaceable symlinks.
Read more — OpenAI Codex Changelog
GitHub Copilot Model Policy API Goes GA as Six Models Retire
On October 19, GitHub made the Copilot model policy REST API generally available. GET and PATCH endpoints control which Copilot models are available at four scopes: enterprise (/enterprises/{enterprise}/copilot/model-policies), enterprise teams, agent apps, and organizations (/orgs/{org}/copilot/model-policies). An enterprise can keep control itself, delegate it to organizations, or delegate to teams and apps. Platform teams can now manage model access as code instead of clicking through settings pages.
The timing fits the same day's retirements. Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 were deprecated. The suggested replacements are Gemini 3.8 Flash, GPT-6.1 Sol, GPT-6 Luna and Grok 4.7. Enterprise admins may need to enable the replacements in their model policies before users see them, and that is a single PATCH call with the new API.
GitHub also shipped related admin features during the week. The Copilot usage metrics API now reports custom skills, agents and MCP servers, as well as usage from third-party tools such as OpenCode. A global default for Copilot features is GA, and the Copilot impact dashboard adds industry comparisons.
Read more — GitHub Changelog
Ollama Adds Text-to-Speech With Gradium's Phonon and an OpenAI-Compatible Speech Endpoint
Ollama 0.40.11 adds speech models, starting with Phonon, a family of small text-to-speech models from Gradium. The English phonon model is Apache 2.0. The phonon:40m-* variants for French, German, Spanish and Portuguese, plus a five-language multilingual model, are CC BY-NC 4.0, which means noncommercial use only. Speech currently runs on Apple Silicon Macs through Apple's MLX framework. Windows and Linux support is listed as coming soon.
From the CLI, ollama run phonon "text" speaks the text, --voice picks a voice from Gradium's catalog, and redirecting output writes a 24 kHz mono WAV file. You can also pipe a chat model's reply straight into Phonon, and speech starts as soon as the first sentence arrives. For applications, Ollama exposes POST /v1/audio/speech with OpenAI-compatible model, voice, input and response_format (WAV or raw PCM) parameters. Existing OpenAI SDK code works if you point its base URL at localhost:11434/v1, and responses stream, so playback can start right away.
Ollama reports it ran 35% faster than Gradium's own runtime on an M5 Max MacBook Pro (bf16, 45 seconds of speech, median of 10 runs). Word error rate matched the Hugging Face Transformers reference implementation on 200 Seed-TTS English sentences. Together with the transcription support that local runtimes already have, this lets developers build a fully local voice loop on a laptop.
Read more — Ollama Blog
Hermes Agent v0.22.3–v0.22.5: MCP Progress Notifications, Pluggable Delegation and OpenClaw Migration
NousResearch shipped four Hermes Agent releases after v0.22.0. v0.22.2 (October 15) corrected v0.22.1, which had been built from the wrong commit. It fixes the gateway failing to start after a reboot under systemd, launchd and Docker supervisors, and makes long local-model turns more reliable on laptops. One known issue remains: sessions created under 0.22.1 can't be deleted.
v0.22.3 (October 21) rolls up about 620 merged PRs. The full notes are deferred to v0.23.0, but notable additions include MCP progress notifications shown as live tool progress, a refreshed classic CLI layout, and plugin-declared OAuth clients. v0.22.4 followed the same day with small fixes: plugins that install no dependencies skip the empty consent prompt, and WhatsApp can be safely re-paired after logging out.
v0.22.5 (October 22–23, about 81 PRs) reworks Nous sign-in, adds usage-window plan support, and introduces pluggable delegation backends, so subagent work can go to different runtimes. It also adds a hermes import-agent command and a migration path from OpenClaw, which makes switching between the two personal-assistant projects easier. hermes update now refuses to offer a held-back stable release.
Read more — GitHub (NousResearch)
Links & Sources
You May Also Enjoy
