claudekit / updates / claude-code-2-1-319
[ PATCH · ]

Claude Code 2.1.319

Adds support for MCP tasks in the terminal, the `permissions.denyInsteadOfPrompting` setting and `/claude-api latency-optimize`. Auto mode with telemetry or feature flags off, including behind LLM gateways, no longer falls back to the built-in classifier. Over 140 changes, including fixes for a Bash permission bypass and a sandbox escape when creating a worktree.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.319 shipped on November 6, 2026. The headline change is auto mode: with telemetry or feature flags off, including behind LLM gateways, calls the server can’t check are now asked about or denied, with no fallback to the built-in classifier. The release also adds MCP tasks in the terminal, a setting that denies instead of prompting, and new Claude apps gateway controls. Fixes make up more than half of the release, including a Bash permission bypass and a sandbox escape when creating a worktree.

New features

  • MCP tasks in the terminal

    When an MCP server runs a tool call as a task, Claude Code now moves it to the background right away and tells Claude the result when it finishes. MCP tasks work without feature-flag fetching (Bedrock, Vertex, Foundry, LLM gateways, DISABLE_TELEMETRY). Set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND to wait for the task inside its tool call instead, or CLAUDE_CODE_DISABLE_MCP_TASKS=1 to turn MCP tasks off.

  • permissions.denyInsteadOfPrompting setting

    A tool call that would wait on a permission prompt is denied and the turn continues, in terminal sessions, subagents and teammates.

  • /claude-api latency-optimize

    Finds where your Claude API code makes people wait and tries faster settings against your eval.

  • CLAUDE_CODE_DISABLE_FEATURE_FLAGS environment variable

    Stops feature-flag fetching without turning off telemetry. Every flag then uses its built-in default.

  • “Earlier in this session” row in /tasks

    It lists finished subagents, so you can reopen one and message it even after it leaves the list or you restart.

  • Warning when Claude Code continues on the ant auth login sign-in

    When your claude.ai login ends and Claude Code continues on the sign-in from ant auth login, which bills usage to your Claude Console organization, you now get a warning. A line at startup also names the Claude Console organization that is billed.

  • /loop note in cloud sessions

    /loop confirmations in cloud sessions now note that a timer stops with its container, with an offer of a loop that survives.

  • Spend in /usage behind a Claude apps gateway

    Developers behind a Claude apps gateway who have no spend limit now see spend for today, this week and this month, when the gateway runs this version or later.

  • Pooled group budget order on the Claude apps gateway

    admin.pooled_conflict_rule and admin.pooled_priority_order set which pooled group budget pays first for a developer in several groups.

  • login_notice on the Claude apps gateway

    An optional setting that shows an operator-defined message on the gateway’s browser verification page and on Claude Code’s sign-in screen.

  • JSON logs on the Claude apps gateway

    With CLAUDE_GATEWAY_LOG_FORMAT=json, operational log lines become JSON with severity, time and message, for log collectors that read the level from a field.

  • Claude apps gateway startup warnings

    The gateway now warns at start-up when:

    • another policy’s availableModels also allows a custom model id that one policy lists by name
    • a policy with no desktopHome relies on coworkTabEnabled: false or chatSessionRetentionDays, ahead of Claude Desktop’s November 10 change
    • upstreams mix AWS GovCloud with other upstreams, or base URL variables are set in the gateway’s environment
    • managed settings name an Amazon Bedrock guardrail in a header, which the gateway doesn’t forward, and no bedrock upstream sets a guardrail

  • [Claude Tag] Claude Tag row on the Models admin page

    Enterprise orgs with Claude Tag connected now see a Claude Tag row that links to where its model defaults are managed.

Key improvements

  • Auto mode no longer falls back to the built-in classifier

    With telemetry or feature flags off, including behind LLM gateways, calls the server can’t check are now asked about or denied. Set CLAUDE_CODE_AUTO_MODE_SERVER=0 to keep using the built-in classifier. Bedrock, Vertex and Foundry are unchanged.

  • Auto mode’s server-side check behind an LLM gateway

    CLAUDE_CODE_AUTO_MODE_SERVER=1 now turns on the server-side check even with CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS set. If managed settings set the latter, they must set the 1 too. Once you have switched the check off outside the project, a project’s settings files or a plugin can no longer switch it back on.

  • /context stays short

    At the terminal, each list in the table Claude reads keeps its 10 largest rows, and MCP tools that load on demand share one row per server until they’re called.

  • Self-paced /loop ends cleanly

    A self-paced /loop now ends when a turn finishes without rescheduling, instead of scheduling a fallback wakeup. Set CLAUDE_CODE_LOOP_KEEPALIVE=1 to keep the old behavior.

  • Permission rule changes

    • Monitor’s WebSocket watch follows a rule on every Bash command: a deny refuses it, and under an ask rule an allow on Monitor, bypass mode or auto mode no longer skips the prompt.
    • A session’s exact Bash or PowerShell ask rule is refused, not asked about, when a broader deny rule covers the command.
    • The Bash tool asks for permission before running which with flags outside a lookup/display set.
    • --add-dir directories register plugin marketplaces only once that directory’s own trust dialog has been accepted.
    • With the Bash sandbox on, skills in .claude/skills folders below the starting folder load only if you start Claude Code there or /cd there.

  • Proxy settings

    Settings files can no longer set CLAUDE_CODE_PROXY_RESOLVES_HOSTS where the host manages the network; set it in the process environment. The automatic certificate repair behind a TLS-inspecting proxy no longer runs when ALL_PROXY is the only proxy variable set. Set HTTPS_PROXY to the proxy’s http:// URL instead.

  • PostToolUse hooks after an interrupt

    PostToolUse hooks now run, with up to 10 seconds to finish, on tool calls that finish after a new message interrupts the turn.

  • What Claude is told after safeguards stop a subagent

    Claude is now told to retry with a narrower prompt or tell you, instead of doing the work itself.

  • Cloud session worker moves

    Cloud sessions now drop session-scoped allow rules at a move to a new worker when their deny and ask rules can’t all be kept, so you may be asked again.

  • Config saves on Windows

    Claude Code waits longer for a file another program has open, so a kill during a save is less likely to leave ~/.claude.json empty.

  • Claude in Chrome

    After a brief disconnect, it waits up to 6 seconds for the session’s own browser to return before picking another. javascript_tool results of up to 60,000 characters now stay in the conversation instead of being saved to a file. shortcuts_list and shortcuts_execute, which listed and started shortcuts saved in the extension, were removed from the built-in Claude in Chrome tools.

  • claude purge and old-session clean-up

    Both now retry a folder that could not be fully deleted, and report it as an error if it remains.

  • Refusals for paths that differ only in letter case

    On macOS and Windows, when a path outside the working directories differs only in letter case from a path inside them, the message names that spelling.

  • Display

    Faint gray secondary text, such as hints, details in /stats, /model and /sandbox, and rejected-action messages, has better contrast. The /model picker groups older models under a “More models” row. /usage in cloud sessions links to Settings → Usage on claude.ai when plan limits can’t be shown.

  • Claude apps gateway messages

    Warnings about a failed upstream call now name the upstream, not only its provider. The spend limit error reads spend limit reached · resets Dec 1, then admin.blocked_message if one is set.

  • Artifact database

    Errors are clearer when an update targets a document that does not exist, and when the service pauses repeated refused writes. Saves of rows others may have written give each file a hidden marker file; existing files without one, earlier versions’ exports among them, are left alone and reported.

  • /claude-api managed-agents-onboard templates

    Updated to match the Claude Console: Performance tuner removed, two renamed, and web search and fetch turned off in five whose prompts don’t use them.

  • Self-hosted runners

    CLAUDE_RUNNER_CHECKOUT_PATH now gives each repository in a session its own folder; a folder name already taken in the session gets -2, -3, … at the end. The end-of-session upload of a session’s debug log was removed; a failed session’s log stays on the runner host unless --remove-session-state is set.

  • [VSCode] Extension improvements

    Removing a plugin marketplace now checks which of its plugins are installed at that moment. The “not signed in” message behind a Claude apps gateway now looks like an error and has a Sign in link. Links in Claude’s replies that point at Claude sign-in, connector or API addresses show as text with the address instead of opening in the browser. The chat panel’s diagnostics tool leaves out files with no problems in large workspaces, returns compact JSON, and accepts an optional minimum severity.

  • [Cloud sessions] Stalled-setup warning

    On self-hosted environments, its link now prefers your organization’s default or an environment with a live runner, and names it.

  • [Code Review] Unlinking a GitHub organization

    It now also turns off the organization’s All repositories setting in Code Review, which stays off after you relink until you turn it back on.

Bug fixes

Permissions and security

  • A Bash permission bypass where a crafted environment prefix could hide part of a command from permission checks.
  • A sandbox escape when creating a worktree.
  • A sed command skipping the permission check in accept-edits and auto mode.
  • /rewind restoring or deleting a file through a directory symlink.
  • Bash deny and ask rules missing commands written with quoted words.
  • Self-hosted runners: --trust-workspace false now also stops hooks in the repository’s settings files and skills from running.
  • Deny and ask rules, hook matchers and disallowedTools entries written with a claude.ai connector’s terminal name (mcp__claude_ai_Slack) being ignored in Claude Desktop (takes effect once Claude Desktop includes this version).
  • Cloud sessions losing session-scoped deny and ask permission rules, such as those a PermissionRequest hook adds, when the session moves to a new worker.
  • Needless permission prompts for read-only commands wrapped in a plain timeout DURATION, such as timeout 30 rg foo.
  • [Claude Tag] Saving auto mode allow rules overwriting another admin’s changes — the save is now refused with a message.

Auto mode

  • claude -p exiting 0 in auto mode when its actions were refused because no safety check was available — text and JSON output now exit 1.
  • Auto mode being wrongly refused when a client sent a model change and a request for auto mode back to back.
  • /status showing “Auto mode server: Enabled” when the server-side review isn’t reaching the session, for example behind an LLM gateway that drops it.
  • Auto mode refusing actions without saying why when permission rules or autoMode settings are very large — it now explains and, unless autoMode deny rules are set, asks you in the terminal.
  • CLAUDE_CODE_AUTO_MODE_SERVER=1 in managed settings being ignored behind an LLM gateway when the gateway’s URL is set only there and server-managed settings can’t be fetched.
  • Help links in /status and the auto mode billing notice opening only part of the address when they wrap.

MCP and plugins

  • MCP servers on the older handshake failing to connect, or returning empty results, because Claude Code declared an extension that it only uses with newer servers.
  • A long-running MCP tool call on a claude.ai connector sometimes never reporting its result after --resume.
  • claude -p --resume with a prompt losing a deferred tool call when its MCP server is missing — the run now exits 1, keeps the call and refuses later input.
  • Background plugin auto-update, claude plugin update and /plugin “Update now” not installing dependencies added by the new plugin version.
  • ${CLAUDE_PLUGIN_ROOT} not being substituted in a plugin-provided subagentStatusLine command, which can now reference the plugin’s own scripts.
  • claude plugin eval warnings suggesting max: 0 for a tool that must not be called, which could never pass.

Sign-in and config files

  • A request that kept failing with a 401 refreshing your login on every retry and causing 401s in your other sessions.
  • Edits to a settings file being ignored when made within a few seconds of Claude Code writing that file.
  • A config file left at the legacy name hiding your setup with no warning — Claude Code now says on stderr when a home holds two config files, and which is in use.
  • ~/.claude.json, settings and edited files ending up empty or cut off when the disk fills during a save in a read-only folder or to a bind-mounted file (one session saving at a time).
  • A terminal whose Claude apps gateway sign-in had expired sending telemetry and managed-settings requests that the gateway refused and logged as invalid_token.
  • A hang of about 0.5s after pressing Enter on the /login success screen.
  • A mistyped model name, such as opus-5-5, telling you to update Claude Code instead of suggesting the model you meant.
  • Certificate errors behind a TLS-inspecting proxy persisting when CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC was set — Claude Code now makes a TLS handshake with the configured API host after a certificate failure, through your http:// proxy if one is set; it sends no API request.

Tools and commands

  • A session’s diff failing to load on claude.ai and the mobile apps, and /diff showing “Diff unavailable”, when the folder or repository has a file or folder named HEAD.
  • The /diff pane opening blank in sessions where 64 or more turns edited files.
  • Slash commands typed after a leading space, tab or newline being sent to Claude as plain text instead of running.
  • /context sending its full visual grid to Claude on every later turn — Claude now reads only the table.
  • Claude Code listing every project file at start on Linux for projects on a network file system (NFS, SMB, Lustre and similar).
  • Write ending the turn as a refusal when it couldn’t read the file to overwrite.
  • Background Bash commands that finish almost instantly losing their output, and the Bash tool’s diff of changed files missing a file the command wrote just before it ended.
  • NotebookEdit changing the wrong cell when the notebook changed while a permission prompt was open.
  • /rewind failing with “No files were restored” when restoring code to a checkpoint from before /branch.
  • WebFetch describing claude.ai shared-chat links as empty pages — it now says shared chats can’t be read and to paste the conversation instead.
  • /rename reporting plain success when the new name could not be saved to the session transcript.

Subagents and the agents view

  • /clear killing running commands of background agents, teammates and workflows that keep running.
  • Subagents being told after compaction to expect a completion notice for background agents they neither started nor took over.
  • A background agent’s later report being lost silently — the notification now says it was refused and how to ask for it.
  • Subagent hand-back reports showing an internal marker and provenance note when expanded outside verbose mode.
  • CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a turn that was interrupted in plan mode when the session resumes in another permission mode.
  • The agents view appearing to send a reply to a background session waiting on a permission prompt — the reply now stays in the box with a hint to open the session and answer.
  • Agent view removing a draft saved by another agent view in the same directory when exiting, or coming back with another agent view’s input text after restarting for an update.
  • The agents view preview cutting off long commands, results and status lines without an ellipsis, and dropping **, backticks and tags from commands waiting for approval.

Cloud sessions, Remote Control and self-hosted runners

  • Remote Control sessions still showing “Limit reached” on other devices after a usage limit was lifted outside the session.
  • claude remote-control exiting silently with status 0 when a first-run question gets no answer (scripts, services, batch jobs, Ctrl+C) — it now says why and exits 1. A piped y with no newline after it now counts as a yes.
  • Self-hosted runner sessions failing with no explanation when the server keeps refusing to renew model access — the runner now retries sooner and posts a warning in the session.
  • A runner started with --use-anthropic-git-proxy or --configure-git registering before a failed startup check made it exit.
  • /permissions in cloud sessions replying only that it isn’t available — it now says where the session’s rules live and how to change them.
  • Background tasks that keep running after /clear disappearing from the task list in Claude Code on the web, and hidden commands appearing in the slash command menu of cloud sessions on mobile and web.
  • Mod hot-reloading turning off for the session when you typed three messages instead of answering its question in a cloud session.
  • [Cloud sessions] Scheduled tasks silently dropping a connector named memory, and Send now on a waiting message ending running background agents.

Claude apps gateway and LLM gateways

  • Claude Desktop offering a web search tool that always failed when every upstream is Amazon Bedrock.
  • Idle background sessions started through a shell-exported LLM gateway leaving the gateway after an update.

Agent SDK, Claude in Chrome and more

  • Text being dropped from informational messages sent to SDK clients, and Agent SDK hosts getting a generic exit-code error instead of a failed run’s own error message when the disk was full.
  • The OpenTelemetry claude_code.session.count metric counting Agent SDK prewarm() processes that were never claimed.
  • Detailed beta tracing not presenting CLAUDE_CODE_CLIENT_CERT to collectors that require a client certificate.
  • Claude in Chrome reporting the extension as not connected when the connection dropped mid-action — Claude now checks the page before repeating an action that may have run.
  • Artifact database calls being re-sent to artifacts without a database, and artifact database reads that save to a folder (out_dir) being refused.
  • The file card sometimes missing in the Claude iOS app when Claude sent a single file.

VS Code extension

  • Prompts over 50,000 characters being cut off silently — the prompt now stays in the chat box with a notice, and a paste over the limit is refused with a notice.
  • Claude carrying out an unapproved plan after a window reload — a step interrupted in plan mode now stops with a notice when the session comes back in another permission mode.
  • A click on the survey or “Report a problem” buttons sending the unfinished prompt.
  • Cloud sessions opened from the Web tab bringing back turns that /clear, Retry or Edit had removed, and a deleted session’s file coming back when that session was renamed.
  • claude-vscode.toggleDictation starting dictation in every open Claude view at once — it now acts only in the view you are using, and a second press stops it.
  • A possible chat panel freeze when a dropped item’s path contains a very long run of ”/” characters, and slowdowns while a reply with many unclosed $$ math fences streams in.

Claude Tag

  • Claude Tag setup blocking launch when the channel list couldn’t fully load — admins can now launch without picking a channel.

Notes

  • If you use auto mode with telemetry or feature flags off, or behind an LLM gateway, calls the server can’t check are now asked about or denied. Set CLAUDE_CODE_AUTO_MODE_SERVER=0 to keep the built-in classifier. Bedrock, Vertex and Foundry are unchanged.
  • If managed settings set CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS, they must also set CLAUDE_CODE_AUTO_MODE_SERVER=1 for the server-side check.
  • MCP tasks now move to the background by default. Use CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND to wait inside the tool call, or CLAUDE_CODE_DISABLE_MCP_TASKS=1 to turn them off.
  • Self-paced /loop now ends when a turn finishes without rescheduling. Set CLAUDE_CODE_LOOP_KEEPALIVE=1 for the old behavior.
  • If a script checks exit codes, claude -p in auto mode with refused actions and claude remote-control with an unanswered first-run question now exit 1.
  • If you rely on proxy settings, set CLAUDE_CODE_PROXY_RESOLVES_HOSTS in the process environment where the host manages the network, and set HTTPS_PROXY if ALL_PROXY is your only proxy variable.
  • You may see more permission prompts for which with flags, Monitor’s WebSocket watch under ask rules, and cloud sessions that move to a new worker. With the sandbox on, nested .claude/skills load only when you start or /cd there.
  • shortcuts_list and shortcuts_execute were removed from the built-in Claude in Chrome tools.
  • If you run self-hosted runners, the end-of-session debug log upload is gone, and folders under CLAUDE_RUNNER_CHECKOUT_PATH may get -2, -3 suffixes.
  • If you operate a Claude apps gateway, check the new startup warnings for policies with no desktopHome ahead of Claude Desktop’s November 10 change.
  • This post covers the main items. See the GitHub release notes for the full list.