Claude Code 2.1.323 Adds Experimental Code Mode, an Org-Level Off Switch, and a Batch of Sandbox and Permission Fixes

Anthropic published Claude Code v2.1.323 on GitHub on 12 November. The first line of its notes adds Code Mode, “an experimental opt-in in which Claude writes JavaScript to call its tools.” The same line says organizations can turn it off. The rest of the release is a long list, and several items in it matter more to admins than the headline does: the default context window for unrecognized model IDs, plugin version gating, and more than a dozen sandbox and permission fixes.

What Code Mode is, and what we could verify

The release notes say only that Claude writes JavaScript to call its tools, and they point to a Code Mode documentation page for turning it on, or off for an organization. That docs page returned an error when we tried to fetch it. So this article doesn’t describe the enable steps, which tools Code Mode can reach, or how its scripts are sandboxed. Secondary write-ups from AI/TLDR and Creators Toolbox repeat the same facts and add nothing about the mechanics.

The general idea is familiar from other harnesses, including OpenCode 2.0’s Code Mode. The model writes one program that makes several tool calls, so it doesn’t have to spend a model turn on each call. That can save turns and context on tool-heavy work. It also means a script, not a single tool call, becomes what you review. Until Anthropic’s docs are readable, treat these points as open:

• Permissions. The tools reference says tool names are “the exact strings you use in permission rules, subagent tool lists, and hook matchers.” Before you enable Code Mode widely, confirm that your deny rules and PreToolUse hooks still fire on each tool call a script makes.
• Fleet default. Code Mode is opt-in, and the release names an organization-level off switch. If your organization doesn’t want an experimental execution path yet, turn that switch off now. Don’t count on nobody opting in.

The default change that can break gateway sessions

This change is less visible and affects more people. Claude Code now assumes a 1M-token context window for any model ID it doesn’t recognize, up from 200K. The release warns that sessions on other vendors’ models with smaller windows “can fail every turn until /clear” once they fill up. If you route Claude Code through a gateway or a custom model name, set this before upgrading:

{
  "env": {
    "CLAUDE_CODE_DISABLE_1M_CONTEXT": "1"
  }
}

The release also points to /autocompact if you want compaction to start earlier. AI/TLDR also picks this out as the change teams should check. For background on how the window fills up, see our context window explainer. For where to put the variable, see Claude Code environment variables.

Plugin version gating

Plugins can now declare engines["claude-code"] in plugin.json. Claude Code won’t install, update or load a plugin outside its stated version range. Install and update pick the newest plugin version that fits. claude plugin validate also type-checks a plugin’s TypeScript hooks module now. Findings are warnings, and --strict turns them into failures. If you publish internal plugins, add the range so an older client doesn’t load a plugin it can’t run.

Sandbox and permission fixes worth reading closely

The release notes list a long run of permission and sandbox corrections. These are the ones where Claude Code previously allowed more than its configuration said it should:

Area	What was wrong before 2.1.323
Sandbox	sandbox.excludedCommands could let a command it doesn’t name run outside the sandbox. The sandbox could also switch off mid-session
Headless	claude -p and the Agent SDK ran Bash unsandboxed when settings that turn the sandbox on failed validation. Now Claude Code stops at start-up and names the invalid setting
Deny rules	Bash deny and ask rules missed some commands run through sudo, env and similar wrappers. Write and Edit could write to a path covered by a Read deny rule
Allow rules	Rules with an attached wildcard such as Bash(ls*) sometimes skipped the prompt. Rules that name a variable, such as Bash(NODE_ENV*), now ask
Modes	--permission-mode auto started in a mode that could allow more when auto mode was unavailable. It now starts in Manual mode
Sandbox reads	Sandboxed commands could read Claude Code’s file checkpoint copies
Windows	A .cmd or .bat wrapper next to a program’s .exe in the same PATH folder ran instead of the .exe

The Read-deny fix matches documented behavior. The tools reference says a Read(...) deny rule “also blocks the Edit and Write tools on the same path.” If you relied on that rule to protect secrets directories, earlier builds had a gap.

Several changes also tighten defaults:

• Internal git and ripgrep commands now run without most sign-in tokens and API keys.
• The tool that finishes an MCP server sign-in now asks you to confirm, even in bypass and auto modes.
• When you choose “don’t ask again” on an allow rule that looks like it holds a secret, the rule lasts for the session only and isn’t saved. The same applies when the rule would be saved to a settings.local.json that git tracks.
• Approvals for project .mcp.json servers must match the server’s exact name.
• In the sandbox, git worktree add, move and remove now fail read-only.

One change goes the other way. Each session on a machine can now send other sessions about 100,000 messages without a prompt from you, up from about 20. If you run cross-session messaging unattended, decide whether that cap still matches your policy.

What to do

1. If you run models behind a gateway, set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 before rolling out 2.1.323, or confirm that the model really has a 1M window.
2. Decide on Code Mode at the organization level now. Use the off switch until you’ve checked how its scripts interact with your permission rules and hooks.
3. Add engines["claude-code"] ranges to plugins you maintain.
4. Review any headless jobs that depend on sandbox settings. Invalid settings now stop start-up instead of silently running unsandboxed.

For sandbox configuration, see our Claude Code sandbox setup guide. To pin or roll back, see how to update Claude Code by install method.