Claude Code's Latest Update Fixes Three Ways Agents Fail in Silence

On November 6, Anthropic made Claude Code 2.1.319 the default download. Its release notes run past 140 lines, and a handful of them fix the same kind of problem: an agent running with nobody watching that fails, and says nothing about it.

Here is the biggest one. When Claude Code runs from a script in auto mode (where an automatic safety check reviews each action in place of a person), some actions get refused because no safety check is available. Until now, the run still ended with exit code 0, the signal scripts read as "it worked." It now exits 1. A second fix does the same for claude remote-control, which used to quit silently with 0 when a first-run question got no answer. A third fixes background shell commands that finished almost instantly losing their output while being reported as completed.

The release also adds a setting aimed at stuck sessions: permissions.denyInsteadOfPrompting. With it on, a tool call that would wait on a permission prompt is denied, and the turn carries on, in the main session, subagents and teammates. That speaks to the worst case in this week's story about Claude Code's new email check, where one user reported a session that waited about 8.7 hours for an approval nobody saw.

Fixes for permission and sandbox holes ride along too, among them a crafted prefix that could hide part of a shell command from permission checks, a sed command that could skip the check, and a sandbox escape when creating a worktree. Behind an LLM gateway (a company's own proxy in front of the API), auto mode now asks or denies when the server-side check can't reach the session, instead of falling back to the built-in one.

Jon's agents are Claude Code sessions that run on a schedule, and the machine they run on had 2.1.319 the same day it became the default. The fleet already keeps its own receipt for every run instead of trusting an exit code. Now the exit code tells the truth more often too.

How to use it

• Update: claude update, then claude --version should say 2.1.319.
• Turn on the new permissions.denyInsteadOfPrompting setting for machines where nobody answers prompts. It sits with the other permissions keys in a settings file; the release notes give only its name. The catch: a denied step is skipped, not done, so read the run's permission_denials, which the headless docs list in the final result.
• Behind a gateway, CLAUDE_CODE_AUTO_MODE_SERVER=0 brings back the built-in check. Bedrock, Vertex and Foundry are unchanged.
• Self-paced /loop now ends when a turn finishes without scheduling itself again. CLAUDE_CODE_LOOP_KEEPALIVE=1 keeps the old behavior.

What nobody knows yet

Whether the email check got narrower in practice. The notes don't mention it. On the evening of November 5, Anthropic published the check's code. A contributor who tested that code in the bug report found it lets harmless local commands through; the bug's reporter says the 2.1.317 and 2.1.318 builds blocked them. Nobody has yet reported running those cases on 2.1.319 itself.

What to watch

The open bug report on the email check, and the next release notes. Claude Code ships a release most days.