Key Updates in Claude Code v2.1.322–v2.1.323 - Addition of Code Mode and Fixes to Bash Permission Checks and Sandbox

I'm Ishikawa from the Cloud Business Division. This post summarizes the Claude Code updates from v2.1.322 to v2.1.323 (2026-11-10 to 2026-11-12). v2.1.323 alone includes 294 changes. I tried out the behavior of halting startup when sandbox settings fail validation.

Here is the previous update article.

https://dev.classmethod.jp/articles/20261110-cc-updates-v2-1-321/

Update Summary

This covers 2 versions (v2.1.322 to v2.1.323, 2026-11-10 to 2026-11-12), for a total of 295 changes. v2.1.322 has 1 change. v2.1.323 has 248 changes in the CLI itself, plus 46 platform-specific changes for the VS Code extension, Claude Code on the web, and others. Categorizing the 248 CLI changes in v2.1.323 for this article gives 142 fixes, 42 security items, 30 improvements/performance items, 15 new features, and so on. Most of the items I classified as security relate to Bash permission checks and the sandbox. There are 20 breaking changes and deprecations.

Notable Updates

Code Mode added (v2.1.323)

Code Mode has been added as an experimental opt-in feature. In this approach, Claude writes JavaScript to call tools. How to enable it and how to disable it at the organization level are explained at the link below, but as of 2026-11-13 this page returns a 404, so I couldn't check the steps. I really wanted to try this.
https://code.claude.com/docs/en/code-mode

For those who manage which features are used in their organization, it's worth knowing that Code Mode can be disabled at the organization level.

engines["claude-code"] added to plugin.json (v2.1.323)

You can now write engines["claude-code"] in plugin.json. In environments whose Claude Code version doesn't match the specified range, the plugin is not installed, updated, or loaded. For installs and updates, the latest version that matches the range is selected.

For those who distribute plugins, specifying the supported Claude Code version range should make it easier to avoid the plugin being loaded by unsupported versions of Claude Code.

Fix for unanswered messages being summarized by /compact (v2.1.323)

Fixed an issue where, when running /compact repeatedly or after a command such as /context, messages Claude hadn't yet answered were included in the summary and disappeared.

I suspect this bug affected most those who routinely check usage with /context and then run /compact.

Bash permission check fixes (v2.1.323)

Cases where allow rules and deny rules didn't work as expected were fixed together. The main ones are as follows.

• Cases where rm was evaluated relative to the wrong folder, skipping the confirmation for dangerous deletions under bypass permissions or Bash allow rules
• Cases where an allow rule with a wildcard immediately following, with no space, such as Bash(ls*), skipped confirmation (rules that include a variable name, such as Bash(NODE_ENV*), now ask for confirmation)
• Cases where deny rules and ask rules overlooked commands run via wrappers such as sudo and env
• Cases where the Write / Edit tools could write to paths covered by a Read deny rule

If you narrow the scope of operations with allow rules or deny rules, or use bypass permissions, I think it's best to update soon.

Startup halts when sandbox settings fail validation (v2.1.323)

Fixed an issue where, when --settings or SDK settings that enable the sandbox failed validation, claude -p and the Agent SDK ran Bash without the sandbox. Now they stop at startup and display the invalid settings. In addition, if the --settings file is not valid JSON and contains a sandbox key, startup is now halted even if the setting would have turned the sandbox off.

If you pass sandbox settings to claude -p --settings in CI and similar environments, it's good to be aware that it will no longer start if the settings contain errors.

Target Versions and Period

New Features

In addition to Code Mode and engines["claude-code"] introduced under Notable Updates, the following features have been added.

• Fast mode is now available in the Vertex AI global, us, and eu regions. If Vertex rejects fast mode, it falls back to standard speed (v2.1.322)
• claude plugin validate now type-checks a plugin's TypeScript hook modules. Findings are treated as warnings, and with --strict they cause a failure (v2.1.323)
• When a model requires usage credits and those credits are disabled or exhausted, a menu is shown that lets you choose to stop, switch to usage credits, or upgrade (v2.1.323)
• Added CLAUDE_CODE_DISABLE_AGENT_PROGRESS_SUMMARIES (available since 2.1.318). Setting it to 1 disables subagent progress summaries and the requests that generate them (v2.1.323)
• Added CLAUDE_CODE_RESUME_HINT_COMMAND. When the program that launches Claude Code sets it, that program's resume command is shown in the exit hint (v2.1.323)
• In claude -p and SDK sessions, a progress heartbeat is sent every 30 seconds while a hook is running for a long time. This prevents hosts such as Claude Desktop from deciding the response has stalled and ending the turn, and takes effect once the host incorporates this version (v2.1.323)
• The result of claude plugin install --json now includes unsetOptionCount, which indicates the number of unset userConfig options (v2.1.323)
• When a plugin's language server fails to start, a warning is shown with the server name and what to check (v2.1.323)
• When a Perforce configuration is found and CLAUDE_CODE_PERFORCE_MODE is off, a notice naming this environment variable is shown once at startup (v2.1.323)
• The Artifact tool's asset upload now supports .docx (v2.1.323)
• Added a /diff to close hint to the diff panel, and the keys for focusing and closing the panel to the ? shortcut guide (v2.1.323)
• For Claude Desktop sessions on third-party providers, CLAUDE_CODE_AUTO_MODE_MODEL can now be specified in managed settings. This takes effect once Claude Desktop incorporates this version (v2.1.323)
• For mod development, claude plugin validate now shows the $ nouns added, excluded, or replaced by the engine.create hook, and isPromptCovered was added to pane props (v2.1.323)

Improvements

• In /login and claude setup-token, errors for requests that are rejected, unreachable, or time out now show what happened and what to check (v2.1.323)
• /mcp now shows the number of tools excluded because their input schemas are rejected by the API, along with the reason (v2.1.323)
• Improved memory usage when using many subagents. Transcripts of finished subagents are no longer kept in memory while subsequent subagents run, and are released earlier (v2.1.323)
• Improved WebFetch speed and memory usage on deeply nested pages (v2.1.323)
• Installing with the install script no longer downloads the latest version twice (v2.1.323)
• On Linux where /home is an autofs map, startup no longer looks up files in /home itself. For map roots located two or more levels below /, set CLAUDE_CODE_AUTOMOUNT_ROOTS (v2.1.323)
• In -p, SDK, IDE, and cloud sessions, the message shown when the Fable limit is reached now shows when the limit resets and how to continue (v2.1.323)
• The maximum value of CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS was changed from 64000 to 300000 (v2.1.323)
• The number of messages each session on the same machine can send to other sessions without a user prompt was changed from about 20 to 100,000 (v2.1.323)
• In addition, changes were made to the ToolSearch response, the wording shown by claude rm, the scope of the tool.list plugin hook, the handling of workflows in the desktop app's Code tab, and more.

Security (Permission Checks and Sandbox)

Beyond those introduced under Notable Updates, there are many other fixes and changes related to permission checks and the sandbox. The main ones are as follows.

• Fixed the startup mode when auto mode is unavailable: Fixed an issue where, when auto mode was unavailable, --permission-mode auto or defaultMode: auto in settings started in a mode that could allow more operations. It now starts in Manual mode, which confirms beforehand (v2.1.323)
• Fixed the Bash sandbox turning off during a session: Fixed cases where the Bash sandbox could turn off during a session (v2.1.323)
• Fixed the scope of sandbox.excludedCommands: Fixed cases where sandbox.excludedCommands caused commands that weren't specified to run outside the sandbox (v2.1.323)
• Fixed allow rules with combined sudo flags: Fixed cases where a Bash allow rule written with combined sudo flags skipped confirmation (v2.1.323)
• Fixed confirmation being skipped due to zsh shell options: Fixed cases where Bash commands ran without confirmation in zsh with certain non-default shell options set (v2.1.323)
• Fixed writes outside the project with plansDirectory: Fixed an issue where plan files could be written outside the project when plansDirectory was set. Writes that can't be confirmed to stay within the project are rejected (v2.1.323)
• Fixed confirmation skipping and .cmd execution on Windows: Fixed an issue where some file-reading commands given wildcards or file lists ran without confirmation, and an issue where .cmd and .bat wrappers next to an .exe in the same PATH folder were run. It now runs the .exe, the same as cmd.exe (v2.1.323)
• Changed handling when the permission check fails after a hook response: If the permission check fails with an error after a PreToolUse hook returned "allow", it is evaluated as though the hook had not responded. If the permission check fails on input rewritten by a PermissionRequest hook, it asks again, or rejects the call if no one is available to respond (v2.1.323)
• Changed rules saved with "don't ask again": Allow rules that appear to contain secrets, or that would be saved to a git-tracked settings.local.json, are limited to that session and are not saved (v2.1.323)
• Added a warning for allow rules whose variable values contain *: A warning is now shown at startup for Bash allow rules whose variable values contain *, such as Bash(PORT=* npm run dev) (v2.1.323)
• Changed MCP server sign-in to ask for confirmation: Tools that Claude uses to complete MCP server sign-in now ask for confirmation even in bypass and auto modes. When confirmation isn't possible, such as in dontAsk mode, use /mcp (v2.1.323)
• In addition, fixes and changes were made to confirmations for lsof and writes to .git and .claude, reading file checkpoints from inside the sandbox, loading project settings via symbolic links, proxy and CA settings when reading managed settings fails, re-checking policy in WebFetch, confirmation before updating artifacts, and more.

Fixes (Major Ones)

Here is an excerpt focusing on fixes related to stability and usability.

• Fixed message merging in resumed sessions: Fixed an issue where, in a resumed session, the next message sent was merged with an earlier interrupted message that wasn't the one being resumed (v2.1.323)
• Fixed memory spike after modifying a large file: Fixed an issue where memory usage spiked on the next prompt after Claude modified a very large file (v2.1.323)
• Fixed manual edits to settings.json being reverted: Fixed an issue where settings saved by a running session reverted the contents of a settings.json you had just edited by hand. Settings files deleted during the session stay deleted (v2.1.323)
• Fixed non-streaming request failures: Fixed an issue where non-streaming requests failed on errors that are recoverable when streaming, such as rejected images, thinking blocks, and beta headers (v2.1.323)
• Fixed sign-in switching in background sessions: Fixed issues such as sessions using a named Anthropic profile, or an API key or auth token passed from the shell, switching to a different sign-in in the background. If the profile can't be found, for example, it stops and shows a message to that effect. Sessions that were open during the update are advised to be reopened (v2.1.323)
• Fixed MCP tool calls not prompting for re-sign-in: Fixed an issue where an MCP tool call ended with a sign-in server error such as TOKEN_EXPIRED without prompting for re-sign-in (v2.1.323)
• Fixed "Not logged in" reappearing on macOS: Fixed an issue where, when the keychain responded slowly, "Not logged in · Please run /login" reappeared right after a successful /login or after a token refresh (v2.1.323)
• Fixed the error message when Amazon Bedrock denies a model: When Amazon Bedrock denies an account the use of a model, the message now directs you to enable the model rather than to refresh AWS credentials (v2.1.323)
• Fixed awsAuthRefresh and gcpAuthRefresh running twice: Fixed an issue where, when three or more sessions needed to sign in again at the same time, the awsAuthRefresh or gcpAuthRefresh command could run twice for a single request (v2.1.323)
• Fixed file writes being shown as "Read 1 file": Fixed an issue where a Bash command that writes a file with cat > file <<EOF was shown as "Read 1 file" (v2.1.323)
• Fixed column misalignment in WebFetch tables: Fixed an issue where WebFetch dropped empty table cells, shifting subsequent values one column to the left (v2.1.323)
• Fixed managed settings being missed: Fixed an issue where managed-settings.json and managed-settings.d could be missed at startup while another program was rewriting the files. They are now read again at startup (v2.1.323)
• Fixed settings.local.json not being globally ignored: Fixed an issue where .claude/settings.local.json was not globally ignored when a folder later became a git repository or on a new machine (v2.1.323)
• Fixed claude -p using a different model: Fixed an issue where, when the requested model was blocked by settings, text-output claude -p used a different model without showing anything. A warning is now printed to stderr (v2.1.323)
• Fixed OpenTelemetry export failures: Fixed an issue where export failed silently when the otlp exporter had an endpoint but OTEL_EXPORTER_OTLP_PROTOCOL was not set, and the default is now http/protobuf. Also fixed an issue where export failed when reaching the collector through a proxy took more than 10 seconds, and the wait time is now 25 seconds. The maximum value that can be specified with OTEL_EXPORTER_OTLP_TIMEOUT was also reduced from the previous 30 seconds to 25 seconds (v2.1.323)
• A quietly welcome fix: Fixed a case where pressing Ctrl+C right after claude update completed caused the claude command to be deleted (v2.1.323). Recovering from a missing command is troublesome, so this is a modest but reassuring fix.
• In addition, many other small bugs were fixed, covering MCP server and plugin loading, Remote Control, cloud sessions, /usage and usage limit displays, Windows-specific behavior, and more.

Breaking Changes and Deprecations

There are 20 breaking changes and deprecations. Two that can be handled through environment variable settings are shown with configuration examples, followed by a table of all of them.

Assumed context window for unrecognized model IDs changed from 200K to 1M (v2.1.323)

The context window Claude Code assumes for model IDs it doesn't recognize has changed from 200K to 1M. The model's own context window does not change. Use /autocompact to compact earlier, or CLAUDE_CODE_DISABLE_1M_CONTEXT=1 to keep 200K.

For sessions with third-party models that have smaller context windows, every turn may fail until /clear once the limit is reached, so you are advised to set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 before reaching the limit.

The following are configuration examples.

Before (up to v2.1.322):

# Assumes 200K for unrecognized model IDs (no setting required)
claude

After (v2.1.323 onward):

# Assumes 1M for unrecognized model IDs
# To keep 200K, set the environment variable
export CLAUDE_CODE_DISABLE_1M_CONTEXT=1
claude

Organization settings and policy requests no longer use a proxy specified only by ALL_PROXY (v2.1.323)

Organization settings and policy requests no longer use a proxy configured only with ALL_PROXY. On networks where these requests require a proxy, set HTTPS_PROXY.

The following are configuration examples (proxy.example.com is a hostname for illustration).

Before (up to v2.1.322):

# Organization settings and policy requests also use the ALL_PROXY proxy
export ALL_PROXY=http://proxy.example.com:8080

After (v2.1.323 onward):

# HTTPS_PROXY is required for organization settings and policy requests
export ALL_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

List of breaking changes and deprecations

All are changes in v2.1.323.

Startup, models, and network

Permissions and sandbox

Plugins and MCP

worktree

Other Platforms

Here are the main items from the 46 changes outside the CLI itself.

• VS Code extension: A Claude Code trust confirmation is now shown before starting the first session in an untrusted folder. If you decline, that folder's settings and MCP servers are not used. Also, live output of running Bash and PowerShell commands is shown beneath the command card in the chat (v2.1.323)
• Claude Code on the web: Added a failure notification when the sandbox required by a scheduled task is unavailable at the execution destination, a No repository option for new sessions in self-hosted environments, and a warning on session deletion indicating that scheduled tasks will be paused. Also fixed an issue where pull request updates from GitHub Enterprise Server linked to github.com, and an issue where git clone and fetch operations taking over 10 minutes could be disconnected at the final stage (v2.1.323)
• Remote Control: Added a Try again button to the error shown when the computer running the session has signed out of Claude Code (v2.1.323)
• Claude Tag: On the Enterprise plan, Claude Tag sessions started from Slack are now covered by the Compliance API (beta). Listing sessions and reading transcripts are supported. A Scope filter was added to the Network events tab on the Activity page (v2.1.323)
• Code Review: A Download CSV button was added to the admin settings, allowing per-repository review costs to be exported by month, week, or day (v2.1.323)

Trying Out Startup Halting When Sandbox Settings Fail Validation

Fixed an issue where, when --settings or SDK settings that enable the sandbox failed validation, claude -p and the Agent SDK ran Bash without the sandbox.

In v2.1.323, I checked whether startup stops when the sandbox settings passed to --settings fail validation, and when JSON containing a sandbox key is invalid. For comparison, I also tried invalid JSON that doesn't contain a sandbox key.

For verification, I prepared the following 3 JSON files in a working directory.

In the logs below, lines containing the full path of the verification files are omitted.

When the settings that enable the sandbox fail validation

% cat sandbox-invalid-value.json
{"sandbox": {"enabled": true, "excludedCommands": "docker"}}

% claude -p --max-turns 1 --settings ./sandbox-invalid-value.json "OK とだけ返してください"
These settings files did not load, so nothing in them is in effect, including hooks and permission rules. Each loads again once the problem listed for it is fixed:

Error: sandbox required but unavailable: the settings passed with --settings or the SDK's settings option configure the sandbox but failed validation, so none of them apply (sandbox.excludedCommands: Expected array, but received string). Fix them and start again
  Refusing to start without a working sandbox (see sandbox.failIfUnavailable).

% echo $?
1

It stopped at startup with Error: sandbox required but unavailable, and no OK reply was output. The error message shows the key that failed validation (sandbox.excludedCommands) and the reason (Expected array, but received string), and the exit code is 1. At the end of the message, the setting name sandbox.failIfUnavailable is shown.

When JSON containing the sandbox key is invalid

% cat sandbox-broken-json.json
{"sandbox": {"enabled": false},}

% claude -p --max-turns 1 --settings ./sandbox-broken-json.json "OK とだけ返してください"
These settings files did not load, so nothing in them is in effect, including hooks and permission rules. Each loads again once the problem listed for it is fixed:

Error: sandbox required but unavailable: the settings passed with --settings or the SDK's settings option configure the sandbox but failed validation, so none of them apply (Invalid or malformed JSON). Fix them and start again
  Refusing to start without a working sandbox (see sandbox.failIfUnavailable).

% echo $?
1

Even with "enabled": false, which turns the sandbox off, startup was halted with the same error. The reason was shown as Invalid or malformed JSON, and the exit code is 1.

When JSON without the sandbox key is invalid

% cat nosandbox-broken-json.json
{"model": "sonnet",}

% claude -p --max-turns 1 --settings ./nosandbox-broken-json.json "OK とだけ返してください"
These settings files did not load, so nothing in them is in effect, including hooks and permission rules. Each loads again once the problem listed for it is fixed:
OK
% echo $?
0

A warning that the settings file couldn't be loaded was shown, but processing continued, OK was returned, and the exit code was 0. The omitted line shows Invalid or malformed JSON. Of these 3 cases, startup stopped only in the 2 cases containing the sandbox key.

Because the key name that failed validation and the expected type appear directly in the error message, isolating the cause looks easy. For those who build automation on the premise of the sandbox, this is a change that lets you use --settings with confidence.

Conclusion

Among the new features, Code Mode, where Claude writes tool calls in JavaScript, interested me the most. I couldn't view the documentation as of 2026-11-13, but once it becomes available I'd like to try it and see how it differs from conventional tool calls. In addition, with the permission check and sandbox fixes arriving together, I feel the range of what you can confidently leave to Claude Code has widened.

Why not check the list of breaking changes and deprecations for items relevant to your environment, and then update?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://www.npmjs.com/package/@anthropic-ai/claude-code

https://dev.classmethod.jp/articles/20261110-cc-updates-v2-1-321/