Claude Code v2.1.319 Released: Major Enhancements to Permission Controls and Stability

Claude Code has always shipped at a rapid cadence, and v2.1.319 is a substantial release. Rather than introducing a flashy new feature, it devotes most of its effort to permission boundaries in enterprise scenarios, MCP task scheduling, gateway behavior consistency, and dozens of fixes that affect day-to-day usability. For teams running Claude Code inside real engineering pipelines, releases like this often matter more than feature updates.

Clearer Boundaries for Auto Mode

This update makes a key adjustment to auto mode: when telemetry or feature flags are disabled — including when running behind an LLM gateway — any call the server cannot verify will now cause Claude Code to ask or refuse outright, rather than falling back to the built-in classifier. Teams that want to preserve the previous behavior must explicitly set CLAUDE_CODE_AUTO_MODE_SERVER=0. The Bedrock, Vertex, and Foundry paths are unaffected by this change.

Another change targets gateway scenarios: CLAUDE_CODE_AUTO_MODE_SERVER=1 can now enable server-side checks even when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set. The release notes explicitly warn that if the latter is enabled in managed settings, the former must also be set to 1, or behavior will be inconsistent. In effect, this tightens the principle of "no execution without oversight," reducing the risk of auto mode spilling over in unobservable environments.

Claude Code's auto mode is a run mode that lets the model execute tool calls continuously without step-by-step human confirmation. Because tool calls may involve high-impact operations such as file writes and command execution, their safety depends on a "classifier" that judges whether a given call is safe. The built-in classifier runs locally or client-side, based on static rules or model scoring; server-side verification instead relies on telemetry and feature flags, placing the judgment logic on Anthropic's side where it can draw on fuller context and policy. When telemetry or feature flags are disabled (for example, an enterprise disabling telemetry for privacy reasons, or running behind a self-hosted LLM gateway), the client cannot deliver call information to the server, and server-side verification fails. In this situation, older versions silently fell back to the built-in classifier — effectively lowering the security baseline when observability is missing. The new version switches to "ask or refuse when unverifiable," moving the default behavior in unobservable environments from permissive to conservative. CLAUDE_CODE_AUTO_MODE_SERVER is the switch that controls whether server-side verification is enabled; setting it to 0 explicitly reverts to the old behavior, with the team assuming the risk.

MCP Task Support and Background Scheduling

MCP tasks in the terminal now have native support. When an MCP server executes a tool call as a task, Claude Code immediately moves it to the background and notifies Claude of the result when it completes. This is especially critical for long-running tool calls, preventing the main conversation from being blocked.

The new CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND environment variable provides the inverse control: when set, Claude Code waits for the MCP task to complete inside the tool call rather than moving it to the background immediately. The two modes correspond to different workflow preferences — waiting is safer when strict sequential execution is required; backgrounding is more efficient when parallel progress is needed.

On the permissions side, a new permissions.denyInsteadOfPrompting setting has been added. When enabled, tool calls that would otherwise stop at a permission prompt are denied outright and the conversation turn continues; this behavior covers terminal sessions, subagents, and teammates. For unattended automated agents, this prevents deadlocks caused by waiting for human confirmation.

MCP (Model Context Protocol) is an open protocol proposed by Anthropic that lets models like Claude connect to external tools and data sources in a standardized way. An MCP server can expose a number of "tools" to Claude, which Claude calls on demand during a conversation. Traditionally, such tool calls are synchronous: after Claude issues a call, it must wait for the result before continuing generation. But when tool execution takes a long time (for example, running a build or querying a large database), synchronous waiting blocks the entire conversation. MCP's "task" semantics allow a server to register a call as a task that can complete asynchronously — returning a task handle first, then delivering the result upon completion. Claude Code leverages this semantic in the terminal to immediately move task-based calls to the background, letting the main conversation continue while the result is injected into context when it arrives. CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND exists as an escape hatch for workflows that require strict ordering: with backgrounding disabled, Claude Code waits for the task to complete inside the call, ensuring the next step sees a result that has actually landed.

Strengthened Gateway and Enterprise Management Capabilities

The Claude apps gateway receives a series of operational improvements in this release. admin.pooled_conflict_rule and admin.pooled_priority_order let administrators specify which group's budget pays first when a developer belongs to multiple pooled groups. The new login_notice setting can display operator-defined messages on the gateway's browser verification page and the Claude Code login page, suited to compliance notices or internal announcements.

On logging, CLAUDE_GATEWAY_LOG_FORMAT=json makes operational log lines output as JSON with severity, time, and message fields, making it easy for log collectors to read levels by field. In addition, the gateway now emits warnings at startup for policy conflicts and for cases where desktopHome is missing but coworkTabEnabled: false or chatSessionRetentionDays is relied upon — a way of surfacing configuration hazards early.

The /usage command has also been extended: developers behind a Claude apps gateway without a spending cap can see today's, this week's, and this month's spending, provided the gateway runs this version or later.

Security Fixes Are the Centerpiece of This Release

A large portion of the release notes consists of security patches that deserve item-by-item attention. A Bash permission bypass has been fixed — carefully crafted environment variable prefixes could previously hide certain commands from permission checks; a bug where the sed command could skip permission checks in accept-edits and auto mode has been fixed; and a sandbox escape when creating worktrees has also been fixed.

Isolation for self-hosted runners has been tightened as well: --trust-workspace false now also prevents hooks in repository settings files and skills from running. For teams running agents in shared environments, this change reduces the attack surface originating from repository content itself.

Other security-related fixes include: explicit beta tracing now presents CLAUDE_CODE_CLIENT_CERT to collectors that require client certificates; /rewind can no longer restore or delete files through directory symlinks; and configuration files and settings no longer end up empty or truncated when the disk is full.

A worktree is a Git mechanism that allows multiple working directories to be checked out simultaneously on the same repository, each corresponding to a different branch and isolated from one another. Claude Code automatically creates worktrees when it needs to work on multiple branches in parallel or isolate experimental changes. A sandbox escape means the agent, which is expected to run confined within a directory or permission boundary, jumps outside that boundary via path traversal, symlinks, special files, or other means to access or modify files beyond it. Escapes in worktree scenarios are especially dangerous because the agent may reach repository content that should not be modified via the worktree's metadata directory or links pointing to the main repository. --trust-workspace false is a trust switch for self-hosted runners: when set to false it means workspace content is not trusted, and hooks defined in repository settings files and skills should not be executed, since such content may have been committed by others and constitutes an injection attack surface. This version puts that restriction into practice, making it harder for agents in shared environments to be hijacked by malicious repository content.

Stability and Experience Details

A large batch of fixes centers on high-frequency commands like /diff, /context, and /tasks. /diff no longer shows as unavailable when a file or directory named HEAD exists at the top level of the repository; the issue where the /diff panel was blank in sessions with files edited 64 or more rounds ago has also been resolved. /context previously sent the full visualization grid to Claude on every subsequent turn; now Claude only reads the table, reducing unnecessary token consumption.

/tasks adds an "Earlier in this session" row listing completed subagents — even if they've left the list or you've restarted, you can reopen them and continue the conversation. /clear no longer mistakenly kills background agents, teammates, and commands still running in workflows.

On MCP connections, servers using the older handshake protocol previously failed to connect or returned empty results because Claude Code declared extensions used only by newer versions; this has been fixed. The case where long-running MCP tool calls failed to report results after --resume has also been addressed.

Some changes seem minor but affect daily use: slash commands starting with a space, tab, or newline are no longer sent to Claude as plain text; the roughly 0.5-second hang after pressing Enter on the /login success screen is gone; the issue where help links in /status and the auto mode billing notice opened only part of the URL after wrapping has been fixed; and the /model selector now tucks older models into a "More models" row for a cleaner interface.

Configuration saving on Windows has also been improved: Claude Code now waits longer to handle cases where other programs are holding the file, reducing the chance of ~/.claude.json ending up empty if the save is killed midway.

Behavior Changes to Watch For

Some changes alter existing behavior. When claude -p in auto mode refuses to perform an action because no safety check is available, text and JSON output now exits with code 1 instead of the previous 0. Scripts that judge results by exit code need to be adjusted accordingly.

CLAUDE_CODE_DISABLE_FEATURE_FLAGS is a new environment variable that stops feature flag fetching without disabling telemetry — all flags use built-in defaults. /claude-api latency-optimize is a new command that identifies what is making people wait in Claude API code and tries faster settings based on your evals.

Overall, v2.1.319 is an iteration focused on "containing risk and filling in the management surface." It makes auto mode behavior more predictable, gives gateway operators more levers, and fixes many problems that long lurked under edge conditions. If your team relies on MCP, self-hosted runners, or multi-tenant gateways, this release is worth evaluating and upgrading soon.

claude -p is Claude Code's non-interactive (print) mode, commonly used in scripts and CI pipelines: the prompt is passed as an argument, the program outputs the result and exits, and the caller judges success or failure by exit code. In Unix convention, exit code 0 means success and non-zero means failure. Previously in auto mode, when an action was refused for lack of an available safety check, the program had not completed the task but still exited with 0 — effectively lying to the script about success, which could cause a pipeline to continue without actually executing. This version changes it to exit with code 1, so failures can be correctly caught by set -e, && chains, or CI steps. Scripts that branch on exit codes need to be adjusted accordingly — for example, changing logic that treats "exit code 0 as complete" to also check output content or explicitly handle the new semantics of exit code 1.

One-line Summary

Claude Code v2.1.319 tightens auto mode permission boundaries, enhances MCP and gateway management, and fixes multiple security vulnerabilities.

Paragraph Summary

Claude Code v2.1.319 is an iteration focused on containing risk and filling in the management surface. Auto mode no longer falls back to the built-in classifier when telemetry or feature flags are disabled — calls the server cannot verify are asked about or refused; the terminal adds MCP task support so long tool calls can run in the background, with an environment variable controlling whether to wait. On the enterprise side, permissions.denyInsteadOfPrompting and several gateway pooled-budget, login notice, and JSON log configurations are added, and /usage can show spending for uncapped developers. Security fixes cover Bash permission bypass, skipped sed permission checks, worktree sandbox escape, and hook isolation for self-hosted runners. In addition, multiple defects in high-frequency commands like /diff, /context, and /tasks have been fixed, and claude -p now exits with code 1 instead of 0 when auto mode refuses to execute.