Anthropic released Claude Code version 2.1.319 on GitHub on 6 November. Claude Code is Anthropic’s coding agent, used, for example, in the terminal and in the VS Code extension.

Auto mode no longer falls back to the built-in classifier

In auto mode, Claude Code runs tools without asking for permission each time. Anthropic’s server assesses whether actions are safe, the Japanese blog labmemo.com wrote.

The changelog says Claude Code no longer falls back to its built-in classifier when telemetry or feature flags are turned off. Instead, it either asks the user for permission or denies a call that the server cannot check. The change also applies to users of LLM gateways, the proxy services through which an organisation routes its model calls. Nothing changes for Bedrock, Vertex and Foundry users.

Setting the environment variable CLAUDE_CODE_AUTO_MODE_SERVER=0 restores the built-in classifier. The value 1 turns on the server-side check behind a gateway even if CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set. If an organisation’s managed settings set the latter, the value 1 must also be set there.

The non-interactive claude -p previously returned the success code 0 even when auto mode had denied actions because no check was available. It now returns 1. When the new permissions.denyInsteadOfPrompting setting is on, Claude Code denies a tool call that would otherwise wait for a permission prompt, and the turn continues. The setting works in the terminal, subagents and teammates.

Permission check bypasses patched

The version fixes a Bash permission bypass in which a crafted environment variable prefix could hide part of a command from permission checks. It also fixes a sandbox escape when creating a worktree, a separate working directory for a repository. The site claude-news.today points out that the changelog does not say how the escape worked.

In addition, a sed command could bypass the permission check in accept-edits and auto modes. In some cases, Bash deny and ask rules did not match commands containing quoted words. The /rewind command could restore or delete a file through a symbolic link pointing to a directory. On self-hosted runners, the --trust-workspace false option now also blocks hooks and skills from the repository’s settings files.

Other changes and availability

Other changes to default behaviour include the following: a tool call that an MCP server runs as a task moves to the background immediately, and a self-paced /loop stops when a turn ends without a new schedule. The variable CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND prevents the move to the background, and CLAUDE_CODE_LOOP_KEEPALIVE=1 restores the old /loop behaviour.

Proxy settings may need changing. Where the host environment manages the network, CLAUDE_CODE_PROXY_RESOLVES_HOSTS must be set in the process environment, not in a settings file. The automatic certificate fix for proxies that inspect TLS traffic no longer starts if ALL_PROXY is the only proxy variable. In that case, set HTTPS_PROXY to the proxy’s http:// address.

On 7 November, the npm package’s latest tag pointed to version 2.1.319, but the stable tag was still 2.1.311, Labmemo reported. The blog added that official sources do not say when the version will reach the VS Code extension and the desktop app.