Claude Code 2.1.323 adds an experimental Code Mode and tightens Bash and sandbox permission checks

Claude Code v2.1.323, released November 12, 2026, per its release notes, adds:

• Code Mode: an experimental opt-in in which Claude writes JavaScript to call its tools. The docs explain how to turn it on, or off for a whole organization.
• Plugins: plugin.json accepts engines["claude-code"]; a plugin outside its stated Claude Code version range is not installed, updated or loaded, and install and update pick the newest version that fits. claude plugin validate now type-checks a plugin's TypeScript hooks module, with --strict failing on any finding.
• Usage credits: an options menu (stop, switch to usage credits, upgrade) appears when a model needs usage credits that are off or used up. Several fixes cover the Fable weekly limit message and reset time.
• Other additions: CLAUDE_CODE_AUTO_MODE_MODEL in managed settings for Claude Desktop sessions on third-party providers, .docx support in Artifact tool asset uploads, a 30-second progress heartbeat while hooks run long in claude -p and SDK sessions, and a startup warning for Bash allow rules with a * in a variable's value.

Permissions and sandbox. The release fixes a long list of cases where a Bash command could run without a permission prompt or outside the sandbox (allow rules with attached wildcards such as Bash(ls*), combined sudo flags, deny and ask rules missed behind sudo and env, sandbox.excludedCommands, an rm judged from the wrong folder, Write and Edit reaching a path under a Read deny rule). Changes that may affect existing setups:

• --permission-mode auto or defaultMode: auto now starts in Manual mode when auto mode is unavailable.
• A "don't ask again" rule that looks like it holds a secret, or would be saved to a git-tracked settings.local.json, lasts for the session only.
• On macOS, Linux and WSL, the Bash sandbox ignores write access granted through a symlink that leads elsewhere, and git worktree add, move and remove fail read-only inside it.
• Startup stops when a --settings file with a sandbox key is not valid JSON.
• /security-review asks before it runs, and worktree creation refuses checkouts whose .git folders are links or hold hard links.
• The context window assumed for an unrecognized model ID changes from 200K to 1M; CLAUDE_CODE_DISABLE_1M_CONTEXT=1 keeps 200K.
• Messages one session can send to other sessions without a prompt rise from about 20 to 100,000.
• The subagentStatusLine setting is removed, and a plugin's agent setting is deprecated and now warns.

The release also adds Remote Control, Claude Code on the web, VS Code, Claude Tag (including Slack sessions in the Compliance API, in beta on Enterprise plans) and Code Review (a CSV export of review costs) changes, and many fixes to sign-in, MCP, OpenTelemetry export and terminal display.