Claude Code 2.1.158: Safe Execution on Bedrock, Vertex, and Azure

Claude Code v2.1.158, released May 30, 2026 , ships one change: classifier-gated execution (auto mode) is now available on AWS Bedrock, Google Vertex AI, and Azure Foundry. It lands on top of a dense 48-hour release cluster — Opus 4.8 as the new default, a critical API error fix, and a plugin system overhaul. Two hard deadlines apply before you upgrade: Opus 4.8 requires at least v2.1.156, and CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE stops working on June 1, 2026 .

v2.1.154–2.1.158 in Brief

Four point releases landed across three days according to the official CHANGELOG . v2.1.158 expands auto mode to managed inference platforms; v2.1.157 ships 20+ fixes including local skill auto-loading and mid-session worktree switching; v2.1.156 is a mandatory single-fix release for anyone on Opus 4.8; v2.1.154 introduces Opus 4.8 as the default on Max and Team Premium alongside Dynamic Workflows. The table below maps each release to its scope and whether it requires immediate action.

Quick Answer: Run npm install -g @anthropic-ai/claude-code@latest to reach v2.1.158. On Bedrock, Vertex AI, or Azure Foundry, set CLAUDE_CODE_ENABLE_AUTO_MODE=1 to enable classifier-gated execution. Migrate away from CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE before June 1, 2026 — it is removed that day with no graceful fallback.

Before You Upgrade

Four conditions to verify before running the upgrade command.

Hard requirement: v2.1.156 if you run Opus 4.8. Versions below v2.1.156 mutate thinking blocks between turns. Opus 4.8 rejects this with deterministic API 400 errors — not intermittent failures, but consistent ones on every affected turn . This was the sole change in that point release. Upgrade the CLI first, then resume any in-progress sessions.

Deprecation deadline: June 1, 2026. CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE is removed that date with no graceful degradation . Audit your CI pipelines and startup scripts now. The replacement: run /model claude-opus-4-6 followed by /fast on inside a session. Fast mode on Opus 4.8 is priced at 2× the standard rate for 2.5× the speed .

VSCode on pay-as-you-go: Auto mode was already enabled in v2.1.154 for this configuration without any env var. Skip Step 2 in the next section if that is your setup — setting the env var has no effect here and is not needed.

Managed inference platforms (Bedrock, Vertex, Azure Foundry): Auto mode is disabled by default. You must explicitly opt in with CLAUDE_CODE_ENABLE_AUTO_MODE=1. The next section covers the complete setup path.

Enabling Classifier-Gated Execution on Bedrock, Vertex, and Azure

Classifier-gated execution evaluates every tool call at decision time. Provably-safe operations — read-only file access, low-risk Bash — proceed without prompting. Clearly risky actions (credential access, network writes) are hard-blocked. It sits between full manual approval and --dangerously-skip-permissions. Auto mode was first shipped as a research preview in v2.1.83 on March 23, 2026 , scoped exclusively to Claude.ai Max and Teams. v2.1.158 extends it to managed inference endpoints for the first time .

"Auto mode runs a classifier over every tool decision so that provably-safe actions proceed without a human prompt and clearly risky ones get hard-blocked — the middle ground between full manual approval and --dangerously-skip-permissions." — Claude Code What's New, v2.1.83 research preview (March 2026)

What changed in scope: enterprise teams on Bedrock or Vertex previously had no access to the classifier — every tool call required explicit permission handling. v2.1.158 closes that gap. The feature is limited to Opus 4.7 and Opus 4.8; older model variants on those platforms do not expose the classifier endpoint.

Step 1 — Upgrade to v2.1.158:

npm install -g @anthropic-ai/claude-code@latest
claude --version
# Should print 2.1.158

Step 2 — Set the environment variable (Bedrock, Vertex, and Azure Foundry only; skip for VSCode pay-as-you-go):

export CLAUDE_CODE_ENABLE_AUTO_MODE=1
# Or add to your .env / managed inference environment config

Step 3 — Select a supported model: Choose Opus 4.7 or Opus 4.8. Older model versions on those platforms do not expose the classifier endpoint and will not honor the env var.

Step 4 — Verify: Run /status inside Claude Code and confirm auto: on in the output. Send a low-risk test Bash command such as ls -la and confirm it proceeds without a manual approval prompt.

The following script (verified, exit 0) shows minimal per-provider configuration with safe-execution defaults for all three platforms:

#!/usr/bin/env python3
"""Minimal safe-execution config demo for Claude Code 2.1.158."""

import json

VERSION = "2.1.158"

PROVIDERS = {
    "bedrock": {
        "env": {"CLAUDE_CODE_USE_BEDROCK": "1", "AWS_REGION": "us-east-1"},
        "model": "anthropic.claude-sonnet-4-5-20250929-v1:0",
    },
    "vertex": {
        "env": {"CLAUDE_CODE_USE_VERTEX": "1", "CLOUD_ML_REGION": "us-central1"},
        "model": "claude-sonnet-4-5@20250929",
    },
    "azure": {
        "env": {"ANTHROPIC_BASE_URL": "https://<resource>.services.ai.azure.com/anthropic"},
        "model": "claude-sonnet-4-5",
    },
}

SAFE_EXECUTION = {
    "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
    "disallowed_tools": ["Bash", "WebFetch"],
    "permission_mode": "acceptEdits",
    "network": "provider-api-only",
}


def main() -> None:
    demo = {
        name: {"claude_code": VERSION, **cfg, "safe_execution": SAFE_EXECUTION}
        for name, cfg in PROVIDERS.items()
    }
    print(json.dumps(demo, indent=2, sort_keys=True))


if __name__ == "__main__":
    main()

Running the script produces the following JSON — use it as the shape for your own environment config:

{
  "azure": {
    "claude_code": "2.1.158",
    "env": {
      "ANTHROPIC_BASE_URL": "https://<resource>.services.ai.azure.com/anthropic"
    },
    "model": "claude-sonnet-4-5",
    "safe_execution": {
      "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
      "disallowed_tools": ["Bash", "WebFetch"],
      "network": "provider-api-only",
      "permission_mode": "acceptEdits"
    }
  },
  "bedrock": {
    "claude_code": "2.1.158",
    "env": {
      "AWS_REGION": "us-east-1",
      "CLAUDE_CODE_USE_BEDROCK": "1"
    },
    "model": "anthropic.claude-sonnet-4-5-20250929-v1:0",
    "safe_execution": {
      "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
      "disallowed_tools": ["Bash", "WebFetch"],
      "network": "provider-api-only",
      "permission_mode": "acceptEdits"
    }
  },
  "vertex": {
    "claude_code": "2.1.158",
    "env": {
      "CLOUD_ML_REGION": "us-central1",
      "CLAUDE_CODE_USE_VERTEX": "1"
    },
    "model": "claude-sonnet-4-5@20250929",
    "safe_execution": {
      "allowed_tools": ["Read", "Edit", "Grep", "Glob"],
      "disallowed_tools": ["Bash", "WebFetch"],
      "network": "provider-api-only",
      "permission_mode": "acceptEdits"
    }
  }
}

Upgrade Pitfalls and Rough Edges

Several v2.1.154–v2.1.157 behavior changes have side effects worth flagging before you upgrade shared or production environments.

Opus 4.8 + version below v2.1.156: deterministic 400s. The API errors from thinking block mutation are not intermittent — they occur on every affected turn. If you upgraded to Opus 4.8 before upgrading the CLI, you may already have a broken session. Upgrade the CLI first, then resume .

Local skills auto-loading in every session. Since v2.1.157, anything under .claude/skills/ loads automatically at session start — no marketplace enrollment required . If you placed experimental or test plugins in that directory, they now surface as registered tools in every session including production. Audit .claude/skills/ before upgrading shared environments.

Worktree locking behavior changed in v2.1.157. The CHANGELOG entry reads:

"Worktrees are left unlocked after an agent exits, enabling normal git worktree remove / git worktree prune cleanup." — Claude Code CHANGELOG, v2.1.157

If your cleanup scripts use worktree locked state as a signal — for example, checking for a .git/worktrees/*/locked file before pruning — that signal is no longer set after an agent exits. Replace that logic with git worktree list --porcelain to identify sessions you still want to preserve before pruning.

GPU acceleration in integrated terminals. /terminal-setup now disables GPU acceleration in VS Code, Cursor, and Windsurf integrated terminals to fix garbled text rendering . Standalone terminals are unaffected — no action needed in those environments.

Experiments Worth Running After the Upgrade

Once you are on v2.1.158, these four experiments make the new features tangible.

1. Initialize a local skill without marketplace enrollment:

claude plugin init my-local-skill
# Creates .claude/skills/my-local-skill/ scaffold
# Restart Claude Code — the skill loads automatically

Verify the tool name appears in /status without any marketplace registration step. This is the intended workflow per v2.1.157 , and confirms auto-loading is working correctly in your environment.

2. Try mid-session worktree switching. With a project that has multiple Claude-managed worktrees, call EnterWorktree into a second branch without restarting Claude. Run git status inside the new worktree to verify a clean checkout from the correct branch. This was not possible in a running session before v2.1.157.

3. Pair OTEL_LOG_TOOL_DETAILS=1 with auto mode. Set both env vars, then run a mix of read and write operations:

export CLAUDE_CODE_ENABLE_AUTO_MODE=1
export OTEL_LOG_TOOL_DETAILS=1
claude

The telemetry output will show which tool calls were approved, which were blocked, and which parameters were evaluated. This is the practical way to build intuition about what the classifier treats as risky in your specific codebase before relying on it in CI automation.

4. Prompt Dynamic Workflows. Inside a session, type a plain-English orchestration request — for example, "write a workflow that runs ESLint on all PRs and posts a summary comment." Then run /workflows to inspect the authored plan. Compare the inferred steps against what you would write by hand to understand what Claude fills in versus what you must specify explicitly. Note that Dynamic Workflows documentation had not been published at the time of writing — the CLI feature ships ahead of its docs page.

Frequently Asked Questions

Do I need CLAUDE_CODE_ENABLE_AUTO_MODE=1 if I use Claude.ai Max or Teams?

No. Claude.ai Max and Teams have had classifier-gated execution since the v2.1.83 research preview in March 2026 . The env var is only required on AWS Bedrock, Google Vertex AI, and Azure Foundry managed inference endpoints, where auto mode was disabled by default until v2.1.158. VSCode users on pay-as-you-go API also had auto mode enabled without the env var since v2.1.154.

Why am I seeing API 400 errors with Opus 4.8?

Versions of Claude Code below v2.1.156 mutate thinking blocks between turns. Opus 4.8 rejects this with a 400 status code. The fix was the sole change in v2.1.156 . The errors are deterministic — they happen on every affected turn, not intermittently. Upgrade to v2.1.156 or later (v2.1.158 is current as of May 30, 2026) and the 400s will stop.

What is the difference between a Dynamic Workflow and the existing multi-session agent view?

Dynamic Workflows are Claude-authored orchestration plans. You describe your intent in plain English; Claude writes the orchestration logic — specifying which agents to spawn, in what order, with what inputs. The existing claude agents view shows running sessions but does not define or store orchestration logic. Dynamic Workflows add the authoring layer. View authored plans and run history with /workflows inside a session.

My local skills are loading in every session after upgrading to v2.1.157. Is this intentional?

Yes. v2.1.157 removed the marketplace enrollment requirement . Anything under .claude/skills/ now loads automatically at session start. If you have experimental plugins in that directory that you do not want active in all sessions, move them out before the next session starts. Scaffold new plugins with claude plugin init <name> — they will appear under .claude/skills/<name>/ and load on restart.

Fast mode pricing changed with Opus 4.8 — what are the new rates?

Fast mode on Opus 4.8 is priced at 2× the standard rate for 2.5× the speed . The previous flag CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE is removed on June 1, 2026 — no graceful fallback, no deprecation warning at runtime. Switch to /model claude-opus-4-6 followed by /fast on before that date if you need the older model's fast mode. Token-level pricing for standard Opus 4.8 had not been published in the release notes at time of writing.

What to Watch Next

The v2.1.154–v2.1.158 cluster is a meaningful inflection: Opus 4.8 is the active default, auto mode is no longer a Max/Teams exclusive, and the plugin system now works without marketplace registration. Two areas to track: Dynamic Workflows documentation (shipping after the CLI feature, not before), and auto mode classifier behavior at the edges of your specific tooling stack — the OTEL_LOG_TOOL_DETAILS=1 approach is the most direct way to audit that before putting it in front of automated pipelines.

For teams running Claude Code on Bedrock or Vertex at scale, the combination of auto mode and detailed tool telemetry gives you an auditable log of every tool decision for the first time. That was not possible on managed inference platforms before this release, and it has clear applications for compliance reviews and permission boundary iteration without requiring manual session oversight.

Last updated: 2026-05-31. Based on the Claude Code CHANGELOG, GitHub releases, official Claude Code changelog, and npm version history as of May 30, 2026.