Intel / repo

claude-code v2.1.325

Source: github.com
Author: claude-code-publisher[bot]Top Viber
Date: Published Nov 13, 2026

Context

The change in Claude Code 2.1.325 most likely to alter an existing setup is a new default for its sandbox. Anthropic's coding can run Bash commands inside a sandbox that limits which files they can write and which network hosts they can reach. Until this release, turning the sandbox on also let sandboxed commands run without asking. Now they follow the normal permission flow, so a sandboxed command gets the same permission checks and prompts as any other Bash command. The release notes say to set `sandbox.autoAllowBashIfSandboxed: true` to keep the old behavior, and organizations that turn the sandbox on through managed settings need to set it in their highest-ranking managed source.

For work that runs while nobody is watching, a new prompt means the run waits for a person. A scheduled task or `/loop` run that relied on the sandbox to skip prompts would need that setting, or allow rules for the commands it runs, to keep running unattended. The same release removes other automatic approvals in that direction: scheduled tasks and `/loop` now ask before running a that declares `allowed-tools` or hooks unless `Skill(name)` is in `permissions.allow`, and read-only git commands now ask first in a repository that is neither the project's nor a trusted one. It also closes gaps in its Bash permission checks, including some compound commands that ran without asking and a case where a Bash allow rule could run a different program than the one it names.

Anthropic's Agent SDK for TypeScript made the matching sandbox change in its version 0.3.325, which separate Context explains for apps that approve tool calls in their own code.

Key takeaways · AI-distilled

Claude Code v2.1.325 sends sandboxed Bash commands through the normal permission flow by default; users who want them to keep running without prompts must set sandbox.autoAllowBashIfSandboxed: true.
Scheduled tasks and /loop now ask before running a skill that declares allowed-tools or hooks, so unattended jobs that rely on such a skill will wait unless Skill(name) is added to permissions.allow.
The release closes permission gaps: some compound Bash commands could run without asking, a Bash allow rule could run a different program than it named, and relative deny rules like Read(./.env) stopped applying after a cd.
Subagents cut off at the output token limit are now asked to give their whole answer again more briefly, where previously only the end of the answer came back.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
agent skill — A reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
multi-agent — Using several AI agents on one problem — splitting work in parallel, checking each other, or filling different roles like planner and reviewer.

Read the source github.com