Framework Watch: Claude Code 2.1.304 Lets a Mod Demand a Human Approver, Agno 3.1.5 Pins Sandboxed Agents to a Commit, OpenHands 1.28 Asks for Secrets In-Chat, and SGLang 0.5.22 Fixes Wrong Mamba States

Selected agent-framework and serving releases published on October 18-19, 2026 that did not appear in earlier Framework Watch entries. Agno 3.1.4 was covered previously; 3.1.5 and 3.1.6 are new. Claude Code 2.1.303, released October 18, lists only "Bug fixes and reliability improvements".

Claude Code 2.1.304: approval that only a person can give

The October 19 release adds decider: "person" to a mod's tool.check answer: "only the permission dialog or a host's callback can approve the ask, and it is refused with the mod's reason where nobody can be asked". That gives extension authors a way to require a human for specific tool calls, and to fail closed in headless runs. Mods also gain e.isReadOnly on tool-check events. Safety fixes in the same release:

• claude --worktree no longer removes the worktree and its branch without asking at exit when HEAD was detached or on another branch, "which could lose commits".
• rm -r of a mounted drive or top-level folder such as /Volumes or WSL's /mnt/c now gets the same safety prompt as rm -rf /Applications.
• A plugin can no longer keep a headless run going past --max-turns, Stop or ended input by spawning subagents.
• A new /claude-api managed-agents-secure command compares a Managed Agents configuration with Anthropic's published security guide "without changing anything".

Agno 3.1.5 and 3.1.6: reproducible sandboxes

A sandboxed ClaudeAgent or CodexAgent now takes repository=Repository(url, branch="main"); "The first turn pins the exact commit, later turns keep the pin and the engineer's edits across warm reuse and checkpoint restore." A new S3CheckpointStore keeps content-addressed checkpoints in S3-compatible storage, verified before put returns, so sandboxed agents can run across replicas without a shared filesystem, and open_run_checkpoint(run_id) lets a host read what a run left behind after its container is gone. The new KeenableTools search toolkit "refuses fetches that resolve to private or loopback addresses". Version 3.1.6 adds session-aware eval cases, so multi-turn conversations can be graded as consecutive turns.

OpenHands 1.28: secrets requested inside the conversation

OpenHands 1.28.0 lets the agent "request a secret through an in-conversation modal", followed by inline secret prompts in chat, so a credential reaches the agent at the moment it is needed rather than being preloaded into its environment. The release also fixes resuming a paused cloud sandbox and adds executable known-bug proofs for its own verification suite; 1.28.1 bumps the agent server to 1.56.0.

SGLang 0.5.22: a correctness fix worth reading

The serving engine's release (950 PRs from 245 contributors) lists throughput gains -- up to 2.3x per GPU for DeepSeek-V4.1 on H200, up to 27% more throughput and half the p95 time-to-first-token for prefill-decode disaggregation on long prompts, and a loader it says is 10x faster. The line to act on is an "Important fix": "Hybrid linear models could resume from wrong mamba states when speculative decoding and structured output were used together." SGLang now requires Python 3.11 or newer.

Analysis: The common move is making implicit state explicit. Pinning a commit on the first turn, verifying checkpoints before acknowledging them, and requiring a named human decider all turn assumptions into checkable facts. The SGLang fix is a reminder of what happens when they stay implicit: two features that each work alone combined to produce silently wrong state. Anyone serving hybrid linear-attention models with speculative decoding and constrained JSON output should upgrade and re-run their output-validation tests, since the symptom would have been wrong answers rather than errors.