Claude Code 2.1.319 changes auto mode without telemetry, adds MCP tasks in the terminal and fixes permission bypasses

Claude Code v2.1.319, released November 6, 2026, per its release notes:

• Auto mode: with telemetry or feature flags off, including behind LLM gateways, calls the server cannot check are now asked about or denied, with no fallback to the built-in classifier. Setting CLAUDE_CODE_AUTO_MODE_SERVER=0 keeps the classifier; CLAUDE_CODE_AUTO_MODE_SERVER=1 turns the server-side check on behind a gateway even when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set. Bedrock, Vertex and Foundry are unchanged. A project's settings files or a plugin can no longer switch the server-side check back on once the user has switched it off outside the project. claude -p now exits 1, not 0, in auto mode when actions are refused because no safety check was available.
• MCP tasks: when an MCP server runs a tool call as a task, Claude Code moves it to the background and reports the result when it finishes. CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND makes it wait instead, and CLAUDE_CODE_DISABLE_MCP_TASKS=1 turns the feature off.
• New settings and commands: permissions.denyInsteadOfPrompting denies a tool call that would wait on a permission prompt and lets the turn continue; CLAUDE_CODE_DISABLE_FEATURE_FLAGS stops feature-flag fetching without turning off telemetry; /claude-api latency-optimize looks for where Claude API code makes people wait; /tasks gains an "Earlier in this session" row for finished subagents.
• Behavior changes: self-paced /loop now ends when a turn finishes without rescheduling (CLAUDE_CODE_LOOP_KEEPALIVE=1 keeps the old behavior); the Bash tool asks before running which with unusual flags; --add-dir directories register plugin marketplaces only after their trust dialog is accepted; with the Bash sandbox on, nested skills load only when Claude Code is started or /cd'd into their folder; the /model picker groups older models under "More models"; the Chrome tools shortcuts_list and shortcuts_execute are removed.
• Security fixes: a Bash permission bypass through a crafted environment prefix; a sed command that could skip the permission check in accept-edits and auto mode; Bash deny and ask rules missing commands written with quoted words; a sandbox escape when creating a worktree; /rewind restoring or deleting a file through a directory symlink; and --trust-workspace false on self-hosted runners now also stops hooks and skills in the repository's settings from running.
• Claude apps gateway: /usage shows spend for today, this week and this month for developers without a spend limit; new admin.pooled_conflict_rule, admin.pooled_priority_order, login_notice and CLAUDE_GATEWAY_LOG_FORMAT=json options; start-up warnings for some policies ahead of Claude Desktop's November 10 change.

The release also carries many other fixes for the VS Code extension, cloud sessions, self-hosted runners, Remote Control and Claude in Chrome.