Claude Code 2.1.303-304: rm -r on a mounted drive finally asks for confirmation

Claude Code 2.1.303 and 2.1.304 shipped on October 18 and 19, 2026. 2.1.303 is listed only as "bug fixes and reliability improvements," with no public detail, nothing to report there. 2.1.304 is bigger: ten additions, eleven changes, twelve improvements, and forty-three bug fixes, and two of those fixes change a concrete safety behavior: the confirmation required before a critical deletion now covers mounted drives, and --worktree stops silently losing commits on exit.

rm -r on a mounted drive or a folder at its top level now asks for confirmation

Shell commands go through an approval step before running, except for a built-in set of read-only commands. An rm aimed at a critical path, such as rm -rf /Applications, gets special handling: neither an allow rule nor a PreToolUse hook can approve it for you, even in modes that skip other prompts. Depending on the mode, Claude Code either asks you to confirm (in auto or bypassPermissions mode, with a two-minute countdown in the terminal) or denies the command, for example in dontAsk or in auto mode outside the terminal. Until 2.1.304, that handling didn't cover an rm -r aimed at an entire mounted drive, such as /Volumes/USB on macOS or WSL's /mnt/c, or at a folder at its top level, such as /Volumes/USB/build or /mnt/c/Users. Those commands went through the ordinary permission flow, without being treated as the particularly risky case they are.

The fix brings these cases in line with rm -rf /Applications. The docs describe this mounted drive prompt, whose reason reads Dangerous rm operation on mounted drive path: <path> and which applies even if you've allowed rm. A relative target counts from your working directory: if you work in /Volumes/USB, a plain rm -rf build gets the prompt too. If you approve every command by hand, the difference is small; if you have a rule allowing rm or work in auto mode, this release adds a safeguard you didn't have on paths that can touch an entire external drive or a whole mounted partition. If you work on an external drive all day and the prompt gets in the way, CLAUDE_CODE_DISABLE_MOUNTED_DRIVE_RM_PROMPT=1 turns it off, as long as it's set in the environment you launch claude from, not in a settings file.

--worktree no longer deletes a worktree and its branch without asking

Running an isolated session in its own git worktree starts with claude --worktree <name>. When an interactive session exits, Claude Code checks the worktree's state before deciding what to do with it: if it's clean, it removes it automatically for an unnamed session, or asks first for a named one; if it holds changed or untracked files, uncommitted work in a submodule, or new commits, it always asks before removing it, so you can keep it.

2.1.304 fixes a gap in that check: when HEAD was detached, or the session had ended up on a branch other than the one created for the worktree, Claude Code could delete the worktree along with its branch on exit without asking, even when commits were still sitting in it. If you switch branches inside a worktree mid-session, or detach HEAD, for example with a git checkout to a specific hash, this fix protects you from a silent loss.

A few additions worth knowing about

• Review levels for Code Review: organizations using automated pull request review now pick a level, Quick, Standard (the default), or Deep, either for the whole organization or per repository. An option also lets you cover every repository in a GitHub organization automatically, including ones added later, without selecting them one by one.
• /auto-mode-setup on more setups: this guided auto mode configuration, which reads your project and recent sessions to adapt to your environment, is now also available on Amazon Bedrock, Google Vertex AI, Microsoft Foundry, behind a Claude apps gateway, and in sessions with telemetry turned off.
• A warning before resuming an inactive conversation: on Pro and Max plans, resuming an inactive conversation that would use a noticeable share of your 5-hour usage limit now shows a warning, with the choice to resume anyway or start a new conversation instead.
• A mod can leave an approval to a person: a mod can now answer a tool.check event with decider: "person", so that only the permission dialog or the host's callback can approve it; wherever nobody can be asked, the action is refused with the mod's reason.
• A --max-turns bypass closed: a plugin could keep a headless run going past --max-turns, a Stop, or ended input, by spawning subagents or re-running one that had already finished. Fixed.

Everything else, briefly

Much of the rest of 2.1.304 touches edge-case usage rather than everyday habits: the VS Code extension (background subagents now show as a single status line under their Agent card instead of streaming every step into the chat), cloud sessions, Claude Tag in Slack, and self-hosted runners. There are also more technical changes: tool search is now on by default behind a custom ANTHROPIC_BASE_URL, a mod's settings.read hooks now receive each settings layer and can rewrite the merged settings, and the skills from a single source are capped at 1,024 hooks per session. None of this changes a daily workflow unless you're directly affected.

What matters here

2.1.303 has nothing to report. 2.1.304 adds minor features, but its two real changes touch safety: the confirmation reserved for critical deletions now covers mounted drives and the folders at their top level, and --worktree can no longer silently lose commits on exit when HEAD is detached or sits on another branch. If you let Claude Code run shell commands without reading every line, or if you switch branches inside a worktree, these two fixes are worth knowing about before your next deletion or session exit.