Key Updates in Claude Code v2.1.318–v2.1.319 - The denyInsteadOfPrompting Setting and Changes to Auto Mode Behavior

I'm Ishikawa from the Cloud Business Division. This is an update on Claude Code v2.1.318 to v2.1.319 (2026-11-03 to 2026-11-06). Besides permissions.denyInsteadOfPrompting, which keeps work from stalling on approval waits, MCP task support, and a fix for a Bash permission bypass, I also cover changes to auto mode and /loop behavior, and the results of checking the sign-in expiration display on a real machine.

The previous update article is here.

https://dev.classmethod.jp/articles/20261103-cc-updates-v2-1-317/

Update Summary

This covers 2 versions, with a total of 230 CHANGELOG items (84 in v2.1.318 and 146 in v2.1.319). By my classification, there are 126 fixes, 44 improvements, 29 new features, 18 security items, and 13 breaking changes. The breaking-change count is based on the primary classification; the "Breaking Changes" section covers 14 items, adding one that I classified as a fix. Many items are included: fixes for cases where permission checks were not applied, changes to the default behavior of auto mode and /loop, and improvements to how settings files and sign-in are handled.

Notable Updates

Sign-in expiration display (v2.1.318)

The end date and time of a saved claude.ai sign-in is now output as loginExpiresAt in claude auth status and as credential_expires_at in the JSON result of claude -p. Also, starting 10 days before expiration, a one-line warning is written to stderr when claude -p outputs text.

For those using claude -p in CI or scheduled runs, I feel it becomes easier to plan a re-sign-in before the expiration.

Added permissions.denyInsteadOfPrompting setting (v2.1.319)

When you set permissions.denyInsteadOfPrompting, tool calls that would wait on a permission prompt are denied, and the turn continues as is. It is effective in terminal sessions, subagents, and teammates.

A permission prompt here is a confirmation that shows the operation Claude is about to perform and the choices for it. In the example of a Bash command, choices such as "Yes", "Yes, and don't ask again for: …", and "No" are listed. According to the official documentation, in Manual mode, approval is required before running Bash commands (except built-in read-only commands), editing or writing files, WebFetch (except pre-approved domains), and WebSearch.

For usage where subagents or teammates run for a long time, this looks usable as a setting that avoids processing stopping at permission prompts while not letting unpermitted operations run.

MCP task support (v2.1.319)

MCP tasks are now supported in the terminal. When an MCP server runs a tool call as a task, Claude Code immediately moves that task to the background and tells Claude the result when it completes. If you want the tool call to wait for completion instead of moving it to the background, use the environment variable CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND.

If you use an MCP server that returns long-running processing as tasks, I feel you will be able to keep the conversation going while waiting for that processing to complete.

Security fixes for Bash permission checks and the sandbox (v2.1.319)

The following 3 items related to permission checks and the sandbox have been fixed.

• A Bash permission bypass where a crafted environment variable prefix could hide part of a command from permission checks
• Cases where sed commands ran without passing through permission checks in accept-edits mode and auto mode
• A sandbox escape during worktree creation

I feel this is a fix that those who automatically run Bash on the premise of permission rules and the sandbox should apply sooner rather than later.

Removal of the auto mode fallback in certain environments (v2.1.319)

In auto mode in environments where telemetry (operational data that Claude Code sends to Anthropic) or feature flags are disabled (including behind an LLM gateway), calls that cannot be checked server-side are now asked about or denied, and the fallback to the built-in classifier is gone. Bedrock, Vertex, and Foundry are unchanged. How to configure this is explained in the "Breaking Changes" section.

If you use auto mode behind an LLM gateway or in an environment with telemetry disabled, confirmations or denials may increase after the update, so I think it is good to decide in advance how to handle CLAUDE_CODE_AUTO_MODE_SERVER.

Change to the termination condition of self-paced /loop (v2.1.319)

When a turn ends without rescheduling, the self-paced /loop now terminates instead of setting a fallback wakeup. To keep the previous behavior, set CLAUDE_CODE_LOOP_KEEPALIVE=1.

If you use a self-paced /loop, the loop may end earlier than before, so I feel it is good to consider CLAUDE_CODE_LOOP_KEEPALIVE=1 as needed.

Fixes for conversation history loss and replacement of ~/.claude.json (v2.1.318)

Fixed an issue (a regression in 2.1.314) where a previous conversation could be lost with --continue after retries of an invalid tool call were exhausted. Also fixed an issue where, on non-interactive launch, a ~/.claude.json that is not valid JSON was replaced with default values; it now fails the launch, shows how to restore, and leaves the file as is.

I feel this is a fix that lowers the risk of unintentionally losing conversations or settings for those who resume work with --continue or run claude -p on a schedule.

Target Versions and Period

New Features

MCP

• MCP tasks are now supported in the terminal. When an MCP server runs a tool call as a task, Claude Code immediately moves it to the background and tells Claude the result on completion (v2.1.319)
• Added the environment variable CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND, which makes the tool call wait for completion instead of moving the MCP task to the background (v2.1.319)

Permissions and settings

• Added the permissions.denyInsteadOfPrompting setting. Tool calls that would wait on a permission prompt are denied and the turn continues. Effective in terminal sessions, subagents, and teammates (v2.1.319)
• Added the environment variable CLAUDE_CODE_DISABLE_FEATURE_FLAGS, which stops only the fetching of feature flags without disabling telemetry. Each flag uses its built-in default value (v2.1.319)

Sign-in and billing

• The expiration of a saved claude.ai sign-in is now shown in claude auth status (loginExpiresAt) and in the JSON result of claude -p (credential_expires_at) (v2.1.318)
• Starting 10 days before the expiration of a saved claude.ai sign-in, a one-line warning is now shown on stderr when claude -p outputs text (v2.1.318)
• A warning is now shown when the claude.ai login ends and Claude Code continues with an ant auth login sign-in (billed to a Claude Console organization) (v2.1.319)
• When Claude Code uses an ant auth login sign-in, the name of the Claude Console organization being billed is now shown at startup (v2.1.319)

Subagents, mods, Claude API

• Added an "Earlier in this session" row to /tasks that lists completed subagents, so you can reopen subagents and send them messages even after they drop off the list or after a restart (v2.1.319)
• Added /claude-api latency-optimize, which finds places in code using the Claude API where users are kept waiting and tries faster settings against evaluations (evals) (v2.1.319)
• Added an effort option to the mod's $.model.fork, so lightweight side tasks can run at low regardless of the session's effort. The result includes the effort that was sent (v2.1.318)

Claude apps gateway

• Added assume_role to the mantle upstream of Claude apps gateway, supporting use of roles in other AWS accounts and AWS cost allocation per developer (v2.1.318)
• For developers behind a Claude apps gateway with no spending limit, /usage now shows spending for today, this week, and this month. The gateway must be at this version or later (v2.1.319)
• Added admin.pooled_conflict_rule and admin.pooled_priority_order to Claude apps gateway, so for developers belonging to multiple groups you can configure which pooled group budget is charged first (v2.1.319)
• Added an optional login_notice setting to Claude apps gateway, allowing an operator-defined message to be shown on the gateway's browser authentication page and the Claude Code sign-in screen (v2.1.319)
• Added CLAUDE_GATEWAY_LOG_FORMAT=json to Claude apps gateway, allowing operational log lines to be output as JSON with severity, time, and message (v2.1.319)
• In addition, startup and log warnings have been added regarding allowing custom model IDs via availableModels, policy settings related to the November 10 change in Claude Desktop, mixing AWS GovCloud with other upstreams, how to specify Amazon Bedrock guardrails, and token expiry of Google federation (external_account) credentials (v2.1.318 to v2.1.319)

Cloud sessions and others

• Cloud sessions: Added a "No repository" option, so cloud sessions in Anthropic-hosted environments can be started without choosing a repository (v2.1.318)
• In addition, the following were added: a change that lets cloud sessions find the built-in Chromium via google-chrome or CHROME_PATH, and a New session button; a note in the /loop confirmation message; CLAUDE_RUNNER_SPAWN_REASON and a startup warning for the self-hosted runner; a row on the Models management page of Claude Tag; and recording of responses to mod enablement (v2.1.318 to v2.1.319)

Improvements

• With shared network home directories, ~/.claude.json, settings files, and saved logins are now less likely to be deleted on save, temporarily emptied, or replaced with a nearly empty or stale copy (v2.1.318)
• In sessions on network file systems, when a settings file is wrongly reported as missing, it is now rechecked, reducing cases of starting without MCP servers or trusted folders (v2.1.318)
• In unattended runs (claude -p, SDK apps), ~/.claude.json is no longer rewritten every time when the content has not changed (v2.1.318)
• When saving settings on Windows, it now waits longer for files held open by other programs, lowering the chance of ~/.claude.json becoming empty if killed during a save (v2.1.319)
• Improved the reliability of git commits and pull request creation when the Bash tool runs on macOS's standard /bin/bash (v2.1.318)
• Background subagents now move shell commands that have run for 3 minutes to the background on all providers. The CHANGELOG explains this is so the prompt cache does not expire during execution (v2.1.318)
• MCP tasks now work in the terminal even in environments that do not fetch feature flags (Bedrock, Vertex, Foundry, LLM gateways, DISABLE_TELEMETRY). To disable, set CLAUDE_CODE_DISABLE_MCP_TASKS=1 (v2.1.319)
• The terminal /context now keeps the table Claude reads short. Each list keeps only the 10 largest rows, and on-demand-loaded MCP tools are condensed into one row per server until they are called (v2.1.319)
• In the /model picker, older models are now grouped in a "More models" row instead of being listed after the current models (v2.1.319)
• Results of Claude in Chrome's javascript_tool now stay in the conversation instead of being saved to a file, up to 60,000 characters (v2.1.319)
• PostToolUse hooks now run with a grace period of up to 10 seconds even for tool calls that complete after a turn was interrupted by a new message (v2.1.319)
• In /claude-api managed-agents-onboard, the built-in tools of new agents and the MCP tools of the quickstart template are now given the auto permission policy ("Judge risky actions") by default, the same as in Claude Console. You can opt out by saying "run without asking" (v2.1.318)
• In addition, improvements were made to Claude apps gateway logs and error display, the VS Code extension's sign-in screen and diagnostic tools, cloud session and Remote Control messages, Claude in Chrome reconnection, contrast of auxiliary text, auto-update retries, claude purge, and more (v2.1.318 to v2.1.319)

Security and Permissions

Permission check and sandbox fixes

• Fixed a Bash permission bypass where a crafted environment variable prefix could hide part of a command from permission checks (v2.1.319)
• Fixed cases where sed commands ran without passing through permission checks in accept-edits mode and auto mode (v2.1.319)
• Fixed a sandbox escape during worktree creation (v2.1.319)
• Fixed cases where Bash deny / ask rules were not applied to commands containing quoted words (v2.1.319)
• Fixed cases where /rewind could restore or delete files through directory symbolic links (v2.1.319)
• Fixed an issue where, when a session was resumed in a different permission mode, CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-ran a turn that had been interrupted in plan mode (v2.1.319)
• VS Code extension: Fixed an issue where Claude executed an unapproved plan after a window reload. Steps interrupted in plan mode now stop with a notification if the session returns in a different permission mode (v2.1.319)
• Fixed an issue where a cloud session lost session-scoped deny / ask permission rules (such as those added by PermissionRequest hooks) when moved to a new worker (v2.1.319)
• In Claude Desktop, fixed cases where deny / ask rules, hook matchers, and disallowedTools entries written with the terminal name of a claude.ai connector (mcp__claude_ai_Slack) were ignored. This takes effect once Claude Desktop incorporates this version (v2.1.319)
• Self-hosted runner: The scope of what --trust-workspace false stops has been widened (original: stops hooks in the repository's settings files and skills from running) (v2.1.319)
• Fixed an issue where a permission prompt could be answered by keys typed right after sending a message or before a slow-to-appear permission prompt showed up (v2.1.318)

Permission-related behavior changes

• URL entries in deniedMcpServers now also block Anthropic-provided servers whose upstream URL matches. Connectors in cloud sessions and self-hosted runners are also blocked when the connector's own URL is passed to the session. Otherwise, specify the connector by name to deny it (v2.1.318)
• After disabling auto mode's server-side check outside the project, project settings files and plugins can no longer re-enable it (v2.1.319)
• Monitor's WebSocket monitoring now follows the rules for all Bash commands. If the rule is deny it is denied, and if it is ask the prompt is no longer skipped even with allow for Monitor, bypass mode, or auto mode (v2.1.319)
• Even when there is a session-configured exact-match Bash / PowerShell ask rule, if a broader deny rule covers that command, it is now denied rather than asked about (v2.1.319)
• The Bash tool now checks permissions before running which with flags other than lookup/display flags (v2.1.319)
• Directories added with --add-dir now register plugin marketplaces only after that directory's own trust dialog has been approved (v2.1.319)
• When a cloud session moves to a new worker, if not all deny / ask rules can be kept, session-scoped allow rules are now also discarded (you may be asked again) (v2.1.319)
• The restriction on where CLAUDE_CODE_PROXY_RESOLVES_HOSTS can be set and the change to the conditions for loading nested skills are covered in the next "Breaking Changes" section (v2.1.319)

Fixes (Major Ones)

Highlights centered on fixes related to stability and usability.

• Fixed conversation loss with --continue: Fixed an issue where a previous conversation could be lost with --continue after retries of an invalid tool call were exhausted. This was a regression introduced in 2.1.314 (v2.1.318)
• Fixed an invalid ~/.claude.json being replaced with default values: Fixed an issue where, on non-interactive launch, a ~/.claude.json that is not valid JSON was replaced with default values. It now fails the launch, shows how to restore, and leaves the file as is (Issue: anthropics/claude-code#87551) (v2.1.318)
• Fixed idle compaction replacing the conversation with something other than a summary: Fixed an issue where idle compaction replaced the conversation with a response that was not a summary (v2.1.318)
• Fixed sessions stalling on macOS while running many Bash commands: Fixed an issue where macOS sessions running many Bash commands stopped along with growing memory (v2.1.318)
• Fixed settings changes being lost on shared network home directories: Fixed an issue where, when a settings file could not be updated on a shared network home directory, /logout, claude auth logout, and claude mcp remove reported success and changes to trust, consent, and MCP settings were silently lost (v2.1.318)
• Fixed all connections failing due to a bad NODE_EXTRA_CA_CERTS file: Fixed an issue where all connections failed if the NODE_EXTRA_CA_CERTS file was empty, not PEM, or started with a corrupted certificate. It now uses the readable certificates and prints a warning to stderr (v2.1.318)
• Fixed being unable to connect to MCP servers with older handshakes: Because Claude Code declared an extension used only by newer servers, MCP servers with older handshakes failed to connect or returned empty results; this has been fixed (v2.1.319)
• Fixed slash commands with leading whitespace not running: Fixed an issue where slash commands typed with a leading space, tab, or newline were sent to Claude as plain text instead of being executed (v2.1.319)
• Fixed 401 retries affecting other sessions: Fixed an issue where a request that kept failing with 401 refreshed the login on every retry, causing 401s in other sessions as well (v2.1.319)
• Fixed the /context grid being sent every turn: Fixed an issue where /context sent the full visual grid to Claude on every subsequent turn; Claude now reads only the table (v2.1.319)
• Fixed auto mode claude -p exiting with exit 0 on denial: Fixed an issue where auto mode claude -p exited with exit 0 when safety checks were unavailable and the operation was denied. It now exits with exit 1 for both text and JSON output (v2.1.319)
• Fixed enumerating all files at startup on network file systems: Fixed a case on Linux where opening a project on a network file system (NFS, SMB, Lustre, etc.) enumerated all project files at startup (v2.1.319)
• Fixed output loss for background Bash that finishes instantly: Fixed an issue where background Bash commands that finished almost instantly were reported as complete but lost their output (v2.1.319)
• Fixed /clear stopping commands of agents running in the background: Fixed an issue where /clear terminated running commands of background agents, teammates, and workflows that continue running, and foreground subagents of background agents and teammates (v2.1.319)
• Fixed /rewind failing for checkpoints before /branch: Fixed an issue where /rewind failed with "No files were restored" when restoring code to a checkpoint before /branch (v2.1.319)
• Fixed dependencies added on plugin update not being installed: Fixed an issue where claude plugin update and "Update now" in /plugin did not install dependencies added in the new plugin version (v2.1.319)
• Fixed dependencies not being installed in background plugin auto-updates: Fixed an issue where background plugin auto-updates did not install dependencies added in the updated plugin version (v2.1.319)
• A quietly welcome fix: Fixed an issue where unnecessary permission prompts appeared for read-only commands wrapped in a plain timeout DURATION, such as timeout 30 rg foo (v2.1.319). I feel it is quietly welcome that there is less confirmation hassle when running read-type commands with a time limit using timeout.
• In addition, many small bugs were fixed in Remote Control, cloud sessions, the VS Code extension, the agents view, Claude apps gateway, the self-hosted runner, and more.

Breaking Changes

These are changes that affect existing settings and operations. Items whose pre-change behavior cannot be read from the CHANGELOG are marked "—".

Below are examples for reviewing your settings and operations. Environment variable names and values follow the CHANGELOG; everything else (how to configure, proxy URLs, grep patterns) is an example I constructed.

auto mode (v2.1.319)

Before (up to v2.1.318): In environments with telemetry or feature flags disabled, calls that could not be checked server-side were judged by the built-in classifier.

After (v2.1.319 onward): They are asked about or denied. To keep using the built-in classifier, configure as follows.

# Example: keep using the built-in classifier
export CLAUDE_CODE_AUTO_MODE_SERVER=0

If you want to use the server-side check behind an LLM gateway while CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set, also set CLAUDE_CODE_AUTO_MODE_SERVER=1. If the former is set in managed settings, the latter must also be set in managed settings.

# Example: use the server-side check in an environment where CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1
CLAUDE_CODE_AUTO_MODE_SERVER=1

self-paced /loop (v2.1.319)

Before (up to v2.1.318): When a turn ended without rescheduling, a fallback wakeup was set.

After (v2.1.319 onward): The loop ends. To keep the previous behavior, configure as follows.

# Example: keep the previous behavior
export CLAUDE_CODE_LOOP_KEEPALIVE=1

Automatic certificate repair behind proxies doing TLS inspection (v2.1.319)

# Example before (up to v2.1.318): automatic repair ran with only ALL_PROXY
export ALL_PROXY=http://proxy.example.com:8080

# Example after (v2.1.319 onward): set the proxy's http:// URL in HTTPS_PROXY
export HTTPS_PROXY=http://proxy.example.com:8080

Scripts that match self-hosted runner logs (v2.1.318)

In nack session=… lines, reason=… now follows retryable=…. The delimiter is not documented in the CHANGELOG, so the example accepts it with .*.

# Example before (up to v2.1.317)
grep -E 'nack session=.*retryable=(true|false):'

# Example after (v2.1.318 onward)
grep -E 'nack session=.*retryable=(true|false).*reason='

Trying Out the Sign-in Expiration Display

I checked the sign-in expiration output added in v2.1.318 in a v2.1.319 environment. I ran only read-only commands in an empty working directory. The output is narrowed to just the needed fields with jq.

% claude --version
2.1.319 (Claude Code)

% claude -p --max-turns 1 --output-format json "Reply with OK only." | jq '{is_error, result, credential_expires_at}'
{
  "is_error": false,
  "result": "OK",
  "credential_expires_at": "2026-11-28T21:54:49.882Z"
}

% claude auth status | jq '{loggedIn, authMethod, loginExpiresAt}'
{
  "loggedIn": true,
  "authMethod": "claude.ai",
  "loginExpiresAt": "2026-11-28T21:54:49.882Z"
}

The same date and time (2026-11-28T21:54:49.882Z) was output for credential_expires_at in the JSON result of claude -p and for loginExpiresAt in claude auth status. Both commands had an exit code of 0. Note that the stderr warning shown from 10 days before expiration applies to claude -p text output, so I did not check it this time, as I ran with JSON output.

Being able to check the sign-in end date and time, which claude auth status did not previously show, with a single command is a modest but helpful change, I feel.

Conclusion

With permissions.denyInsteadOfPrompting and MCP task support, I feel it has become easier to handle runs where no human has to stay glued to the screen and long-running tool calls. Including the sign-in expiration display, I see this as a release where changes related to unattended operation stand out.

If you use auto mode behind an LLM gateway or use /loop, why not check the Breaking Changes section, then update and try it out?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://code.claude.com/docs/en/permissions

https://dev.classmethod.jp/articles/20261103-cc-updates-v2-1-317/