Anthropic released version 2.1.323 of its coding agent Claude Code on GitHub on 12 November. Claude Code is used on the command line, in VS Code and in Claude Desktop.

Code Mode is experimental and opt-in

In Code Mode, Claude writes JavaScript to call its tools, the changelog says. Users turn the mode on themselves, and an organisation can turn it off. The changelog does not explain in more detail how the mode works or what it is meant to achieve.

Claude Code Daily Briefing (claude-news.today), which collects Claude news, says that in this mode Claude can bundle several tool calls into one program and run them at once. The newsletter suggests that the mode aims for the same thing as similarly named features in Docker’s agent environment and OpenCode: fewer round trips to the model. It advises trying the mode on less important work first.

Gaps in permission checks and the sandbox fixed

Many of the changes concern permission checks and the sandbox, which limits what commands run by Claude can access. The sandbox could switch off mid-session. In certain situations, the Write and Edit tools could write to a path protected by a Read deny rule. Bash deny and ask rules did not apply to some commands run through sudo and env.

In addition, claude -p and the Agent SDK ran Bash commands without the sandbox if the settings that start the sandbox failed validation. Claude Code now stops at startup instead.

Changes that may require action

If Claude Code does not recognise a model ID, it now assumes a context window of 1 million tokens instead of 200,000. If another provider’s model has a smaller window, a full session can fail on every turn until /clear is run. The changelog advises setting CLAUDE_CODE_DISABLE_1M_CONTEXT=1 before the session fills up.

If auto permission mode is unavailable, --permission-mode auto now starts in Manual mode, which asks for permission first. When a Bash allow rule names a variable, such as Bash(NODE_ENV*), Claude Code now asks for permission.

On macOS, Linux and WSL, the sandbox no longer honours write access granted through a symlink in a writable folder that leads elsewhere or to a missing path. Users must grant access to the real path instead. On macOS and Linux, git worktree add, move and remove must be run outside the sandbox.

Requests for organisation settings no longer use a proxy set only with the ALL_PROXY variable, so users may need to set HTTPS_PROXY. Claude Code runs its own ripgrep and most of its internal git commands without most login credentials and API keys. A credential helper or hook running under these commands can therefore no longer find them.

Sessions on the same machine can now send each other 100,000 messages without a prompt from the user, up from about 20.

A plugin’s plugin.json file can now limit which Claude Code versions it supports. When hooks take a long time to run in claude -p and SDK sessions, Claude Code sends a heartbeat every 30 seconds. Other fixes cover login, sessions, MCP servers and plugins, among other things.

Instructions for turning Code Mode on and blocking it are in the Claude Code documentation at code.claude.com/docs/en/code-mode.