1
00:00:00,300 --> 00:00:00,940
Picture this.

2
00:00:01,780 --> 00:00:07,640
You open a terminal on a Monday, start
Claude Code, and your platform team has

3
00:00:07,740 --> 00:00:09,840
quietly added a hook overnight.

4
00:00:10,600 --> 00:00:12,860
Used to be you'd see a dialog about it
first.

5
00:00:13,760 --> 00:00:14,400
Not anymore.

6
00:00:15,280 --> 00:00:20,020
This is The Claude Code Changelog, brought
to you by Jellypod AI.

7
00:00:20,880 --> 00:00:24,100
I'm Lachlan, and James is here to walk
through what changed.

8
00:00:24,992 --> 00:00:29,012
Last time we covered the subagent effort
variable and the external file write

9
00:00:29,052 --> 00:00:31,472
blocking in 2.1.316.

10
00:00:32,032 --> 00:00:36,252
Today is the admin and security side of
that same release, and it comes down to one

11
00:00:36,372 --> 00:00:38,952
line in the notes, released October 31.

12
00:00:39,472 --> 00:00:44,372
Quote: "Changed server managed settings
for Team and Enterprise logins: settings

13
00:00:44,432 --> 00:00:48,072
fetched from Anthropic's API now apply
without an approval prompt,

14
00:00:48,492 --> 00:00:50,992
and a stored copy that doesn't verify is
refused."

15
00:00:51,572 --> 00:00:51,912
That's it.

16
00:00:52,312 --> 00:00:54,392
One line, and it changes what you see at
startup.

17
00:00:55,232 --> 00:00:57,552
So let's rewind to how it worked.

18
00:00:58,172 --> 00:01:03,772
An owner sets policy in the claude.ai
admin console, and Claude Code fetches it at

19
00:01:03,852 --> 00:01:06,172
startup and polls for updates hourly.

20
00:01:06,892 --> 00:01:09,232
Most of that policy never needed your sign
off.

21
00:01:09,972 --> 00:01:12,112
The dialog covered the risky subset.

22
00:01:12,832 --> 00:01:17,732
Settings that run shell commands, like
apiKeyHelper, statusLine and

23
00:01:18,152 --> 00:01:19,332
otelHeadersHelper.

24
00:01:20,272 --> 00:01:24,232
Sandbox settings that point at an
executable or weaken isolation,

25
00:01:24,692 --> 00:01:27,952
such as sandbox.filesystem.disabled.

26
00:01:28,952 --> 00:01:32,832
Delivered env variables, like proxy and
base URL ones.

27
00:01:33,352 --> 00:01:34,692
And any hook definition.

28
00:01:35,352 --> 00:01:39,372
Per the docs, the wording was "Users must
approve to proceed."

29
00:01:40,192 --> 00:01:41,932
Now, be fair to the old dialog.

30
00:01:42,052 --> 00:01:43,112
It was never a veto.

31
00:01:43,512 --> 00:01:46,712
The docs say if you rejected the settings,
Claude Code exits.

32
00:01:47,052 --> 00:01:50,772
And in non interactive runs, like print
mode or the Agent SDK,

33
00:01:51,112 --> 00:01:54,652
there was no way to show it, so those
settings already applied for that run.

34
00:01:55,172 --> 00:01:57,132
So what you lose is the notice.

35
00:01:57,412 --> 00:02:00,772
The moment where a new hook got named on
screen before it ran.

36
00:02:01,232 --> 00:02:02,152
That part is fact.

37
00:02:02,572 --> 00:02:06,112
Whether that's a good trade is
interpretation, and it depends on whether your team

38
00:02:06,192 --> 00:02:08,352
read that dialog or just mashed Enter.

39
00:02:09,415 --> 00:02:10,915
The other half is a hardening.

40
00:02:11,355 --> 00:02:14,775
The docs describe a case where someone
edits the cached settings file,

41
00:02:15,195 --> 00:02:19,695
and the tampered file applies at startup
until the next server fetch restores it.

42
00:02:20,355 --> 00:02:24,195
A stored copy that doesn't verify is
refused reads like the fix for that.

43
00:02:24,635 --> 00:02:29,275
But the release notes don't say how the
copy is verified, so I'd not assume more

44
00:02:29,315 --> 00:02:29,715
than that.

45
00:02:30,695 --> 00:02:35,595
One practical wrinkle: if you're offline
and your cached copy fails verification,

46
00:02:35,975 --> 00:02:37,235
Claude Code refuses it.

47
00:02:37,855 --> 00:02:39,915
Expect that, rather than being surprised
by it.

48
00:02:40,405 --> 00:02:44,385
So if you're on a Team or Enterprise
login, here's how to look for yourself.

49
00:02:44,985 --> 00:02:47,485
First, update, then run claude doctor.

50
00:02:48,185 --> 00:02:50,865
Find the line that says Managed settings,
remote.

51
00:02:51,345 --> 00:02:54,005
The docs say it reports whether the
delivered settings loaded,

52
00:02:54,305 --> 00:02:57,005
whether your org has none, or why the
fetch failed.

53
00:02:57,645 --> 00:03:00,585
That needs version 2.1.248 or later.

54
00:03:01,305 --> 00:03:05,265
Inside a session, slash status shows which
managed source is active,

55
00:03:05,505 --> 00:03:08,325
and slash permissions shows your effective
permission rules.

56
00:03:09,082 --> 00:03:10,422
Then read the cached payload.

57
00:03:10,862 --> 00:03:14,842
It lives at remote settings dot json
inside your dot claude folder in your home

58
00:03:14,882 --> 00:03:15,382
directory.

59
00:03:15,982 --> 00:03:20,282
Run jq on it, and look for hooks,
apiKeyHelper, statusLine,

60
00:03:20,542 --> 00:03:24,362
otelHeadersHelper, anything under sandbox,
and the env block.

61
00:03:24,842 --> 00:03:27,502
Those are exactly the keys the dialog used
to put in front of you.

62
00:03:28,243 --> 00:03:32,403
And don't try to build your own tripwire
with a ConfigChange hook.

63
00:03:33,043 --> 00:03:37,703
The docs say those don't run when server
managed settings arrive or refresh.

64
00:03:38,403 --> 00:03:40,243
If you're the admin, flip it around.

65
00:03:40,823 --> 00:03:44,203
Your developers get no on screen notice
when you add a hook,

66
00:03:44,703 --> 00:03:48,103
so tell them in Slack or wherever they
actually read.

67
00:03:49,063 --> 00:03:53,383
Audit log events for settings changes are
available through the compliance API or

68
00:03:53,783 --> 00:03:55,023
audit log export.

69
00:03:55,983 --> 00:04:00,803
Also, the docs still call server managed
settings a client side control,

70
00:04:01,083 --> 00:04:02,643
not a security boundary.

71
00:04:03,183 --> 00:04:04,103
That hasn't changed.

72
00:04:05,103 --> 00:04:09,303
One more thing: at the time of writing,
the docs page still described the old

73
00:04:09,363 --> 00:04:12,743
dialog, so don't be thrown if it disagrees
with your terminal.

74
00:04:13,327 --> 00:04:16,447
A few smaller things in 2.1.316.

75
00:04:17,007 --> 00:04:21,527
Shell commands are no longer left running
on macOS and Linux when Claude Code exits

76
00:04:21,567 --> 00:04:25,767
by itself, say when credentials are
refused or a cloud session is archived.

77
00:04:26,407 --> 00:04:30,247
Sessions started with the restricted flag
could upload files from outside the

78
00:04:30,287 --> 00:04:32,967
working directories when a Read allow rule
covered them.

79
00:04:33,427 --> 00:04:35,507
That's fixed, so update if you rely on it.

80
00:04:36,183 --> 00:04:40,803
For gateway folks, there's pooled budget
on the spend limits admin API,

81
00:04:41,283 --> 00:04:45,363
one shared monthly budget for a group on
top of each member's own limit.

82
00:04:46,143 --> 00:04:51,203
Managed policy mode layered merges every
matching policy instead of stopping at the

83
00:04:51,263 --> 00:04:51,603
first.

84
00:04:52,443 --> 00:04:57,203
Guardrail input tagging for Bedrock
upstreams wraps prompts in the tags a

85
00:04:57,243 --> 00:04:59,583
guardrail's prompt attacks filter needs.

86
00:05:00,283 --> 00:05:05,183
And in VS Code, you can sign in to a
Claude apps gateway right from the chat panel.

87
00:05:05,843 --> 00:05:11,203
So, today's homework: run claude doctor,
and read that cached file once.

88
00:05:11,783 --> 00:05:15,283
Five minutes, and you'll know exactly what
your org runs on your machine.