Claude Code upgrade checklist: auto mode and observability

Do not roll out a Claude Code upgrade across a team just because the changelog looks like routine maintenance. The 2.1.193 and 2.1.195 updates touch shell classification, denial evidence, telemetry content, MCP authentication, and background-agent state.

Check Auto Mode Scope

If you enable `autoMode.classifyAllShell`, all Bash and PowerShell commands can go through the auto-mode classifier. Test it on one low-risk repository, then inspect `/permissions` recent denials before changing the team default.

Lock Telemetry Content Flags

Decide whether your OpenTelemetry backend may store assistant responses, user prompts, tool parameters, tool content, or raw API bodies. If your intent is prompt-only logging, explicitly set `OTEL_LOG_ASSISTANT_RESPONSES=0` before upgrade.

• Prompt content is one approval surface.
• Tool parameters and command details are another.
• Raw API bodies are the highest-risk logging path because they can contain the conversation history.

Treat Denials As Evidence

Auto-mode denial reasons now appear in the transcript, denial toast, and `/permissions` recent-denials surface. Use that evidence to tune rules, hooks, or sandbox boundaries instead of approving repeated denials by habit.

Verify MCP Auth Before Tool Use

The upgrade improves MCP authentication visibility and retry behavior, but each MCP server still needs an owner, credential path, tool scope, and read/write boundary. Start read-only when the server can touch production systems.

Recheck Background Agent State

If your team uses background agents, verify a task that finishes, a task that stops, and a restarted or recovered task. The rollout is not complete until the agent view shows state clearly enough for a reviewer to trust it.