What changed
Anthropic shipped Claude Code 2.1.296 with managed policy support for the Claude Desktop Code tab, earlier subagent compaction and workflow model controls. It also repairs managed hooks, secret redaction, disabled MCP startup, Bash and Git Bash permission checks, and per-session browser approval.
Why it matters
Several fixes sit directly on enforcement and evidence boundaries: a denied hook must actually block, disabled tool servers must stay off, shared logs must redact secrets, and shell indirection must not convert a prompt-required command into an automatic approval.
What to do
Pin 2.1.296 in staging and replay denied PreToolUse hooks, disabled MCP servers, BASH_ARGV0 indirection, Git Bash destructive paths, Chrome actions and transcript sharing with synthetic secrets. Promote only when logs show the expected denial and redaction paths.
Caveat
This is a large vendor-authored release, not independent assurance. Some fixes are platform- or gateway-specific, and the new allow_large read option, longer retry ceilings and Desktop gateway policy expand resource and policy behavior that also needs canary limits.