Follow Discord
Sweep 06 Nov 2026 · 01:32Z Build v2.1.319 537 read Stable v2.1.311 Latest v2.1.318 Next v2.1.319 Feeds RSS JSON llms.txt llms-full.txt Unofficial
Home / Reference / CLI flags

auto-mode

cli never mined JSON

A Claude Code CLI flag, read out of the shipped bundle. No mined inventory carries it: everything below comes from what this site has written about it.

A safety rule in the auto-mode prompt got a wrapper tag; the rule text is unchanged.

Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.219.

First seen — never in a mined build
Last seen — never in a mined build
Builds0 / 159on this box, as of v2.1.319
Written about v2.1.74 first named in a changelog, 11 Mar 2026

In the changelogs

198

Releases whose published page names auto-mode.

  1. v2.1.319
    Auto mode's rule on content under review gains extra wording

    The auto-mode rule that treats content under review as data now has extra text added, and results record which rule was cited

    found in this entry's text

  2. v2.1.319
    Server experiment can skip an edit-approval pre-check in auto mode

    A server-controlled experiment can count, or for some calls skip, the accept-edits pre-check for auto-mode tool calls

    found in this entry's text

  3. v2.1.319
    Clearer messages for refused auto-mode actions and region moves

    Auto mode now says when it refuses actions it cannot check, and a session can end because it moved region with your organization

    found in this entry's text

  4. v2.1.312
    Auto mode refuses or asks when its safety check gives no answer

    If auto mode's safety check gives no verdict and none runs locally, Claude Code now refuses the tool call or asks you instead of running it

    found in this entry's text

  5. v2.1.312
    Tool calls with no safety-check verdict outside auto mode are now denied or asked about

    When the automatic safety check returns no verdict outside auto mode, Claude Code now denies the call or asks you instead of letting it through

    found in this entry's text

  6. v2.1.307
    Auto-mode denials now record the command that was refused

    When auto mode refuses certain tools, the record of the refusal now includes the command, and leaving auto mode adds a note about its guidance

    found in this entry's text

  7. v2.1.304
    Upfront consent text for unattended cloud sessions removed

    Three pieces of text asking upfront for consent to let auto-mode cloud sessions run commands without asking each time were removed

    found in this entry's text

  8. v2.1.304
    Subagents under an auto-mode session can fall back to the parent's permission mode

    When the main session is in auto mode, a subagent asking for a mode other than plan now falls back to the main session's mode

    found in this entry's text

  9. v2.1.301
    Usage data now records whether auto mode allowed or blocked an action

    Claude Code's usage data now records the auto-mode safety check's decision, allow or block, and sometimes a category

    found in this entry's text

  10. v2.1.300
    One-time question before cloud sessions run commands on this computer

    Claude Code can ask once per computer whether auto-mode cloud sessions may run commands here without asking each time

    found in this entry's text

  11. v2.1.299
    Auto mode's safety checker gets a shorter conversation view and a note on skipped turns

    The conversation summary that auto mode's checker reads can now be built in a compact form and can note that some turns were left out

    found in this entry's text

  12. v2.1.299
    Auto mode's safety check can reuse context inherited from a parent

    The auto-mode check can now carry context inherited from a parent and counts only the remaining part when measuring its size

    found in this entry's text

  13. v2.1.299
    Refused permission-mode changes are now reported, with a clear auto-mode message

    Claude Code now records when a permission mode change is refused, and a refused switch to auto mode reports that it cannot be set

    found in this entry's text

  14. v2.1.296
    Chrome auto-mode safety floor is decided differently in remote sessions

    For the Chrome auto-mode classifier floor, remote sessions now read the server setting a different way, while CLAUDE_CHROME_CLASSIFIER_FLOOR still overrides it

    found in this entry's text

  15. v2.1.292
    Poll events from a host are refused unless CLAUDE_CODE_POLL_EVENTS is set

    Claude Code now rejects every poll event from its host unless the host set CLAUDE_CODE_POLL_EVENTS for that session

    found in this entry's text

  16. v2.1.292
    SDK output now reports when an automatic permission check is slow

    SDK and -p output gain a status message when a tool call waits about four seconds on the auto-mode permission check

    found in this entry's text

  17. v2.1.292
    A server setting for showing a launch notice is no longer read

    Claude Code stops reading one server-sent setting for a launch notice; the auto-mode start and effort reminder settings remain

    found in this entry's text

  18. v2.1.292
    Chrome grants on allowed sites can skip the auto-mode check unless turned off

    Browser actions on an allowed site with a grant rule can be approved without the auto-mode classifier unless that setting is false

    found in this entry's text

  19. v2.1.290
    claude remote-control can let cloud sessions run commands in a folder unattended

    A new --allow-unattended-tool-calls option lets cloud sessions use the current folder for one run, with auto-mode commands running without asking

    found in this entry's text

  20. v2.1.290
    Status messages for cloud sessions that run commands on your computer

    Claude Code adds messages saying whether cloud sessions can run commands on this computer, why a folder is unavailable, and when they connect or stop

    found in this entry's text

  21. v2.1.288
    claude auto-mode defaults and claude auto-mode config finish sending usage data before exiting

    The claude auto-mode defaults and config commands now send pending usage data before exiting, and defaults now receives its label filter

    found in this entry's text

  22. v2.1.288
    Auto mode can shorten a long conversation instead of repeatedly blocking actions

    When a conversation is too long for auto mode's safety check, Claude Code can now compact it and tell Claude to retry the action afterwards

    found in this entry's text

  23. v2.1.288
    Plugin, marketplace and login commands wait for usage reporting before exiting

    Marketplace, plugin, login and auto-mode CLI commands now finish recording their result before exiting, and marketplace update notes skipped built-ins

    found in this entry's text

  24. v2.1.287
    Auto mode now records why it did not approve an action

    When auto mode does not approve an action by itself, it now records a reason, without changing what gets approved

    found in this entry's text

  25. v2.1.286
    Gateway guide covers auto-mode safeguards and a new managed settings response format

    Claude Code's built-in LLM gateway guide now covers a safeguards request field for auto mode and requires managed settings wrapped with a uuid and checksum

    found in this entry's text

  26. v2.1.286
    Auto mode's safety check stops testing two wordings

    The two-wording experiment in auto mode's safety check has ended, and the classifier now always uses a single wording

    found in this entry's text

  27. v2.1.284
    VS Code extension refreshes all its feature switches when policy changes

    When the product-feedback policy changes, Claude Code now re-sends every feature switch to the VS Code extension, not just two of them

    found in this entry's text

  28. v2.1.284
    SDK tool results can carry a subagent's full hand-back report

    A new internal handbackReport field carries a subagent's full report and any auto-mode warning for apps to display

    found in this entry's text

  29. v2.1.283
    Messages forwarded to Claude Desktop carry an ID when approved by auto mode

    Sends forwarded to Claude Desktop's messaging tool now include the tool call's ID when auto mode approved the call

    found in this entry's text

  30. v2.1.282
    Reading an artifact's page data now shows when it followed an unattended auto-reply

    The artifact tool's read_page_data action now carries the same "requested after an unattended auto-reply" note that read and verify already had

    found in this entry's text

  31. v2.1.281
    Plan mode no longer counts as auto for served tool calls

    In plan mode, tool calls served for a remote caller no longer take the auto-mode permission path

    found in this entry's text

  32. v2.1.281
    /insights can now suggest switching to auto mode, based on how many permission prompts past sessions hit

    /insights can now suggest switching to auto mode, or running /auto-mode-setup, based on how many permission prompts your sessions would hit

    found in this entry's text

  33. v2.1.281
    Auto-mode server-fallback notice records why it went unanswered

    The auto-mode server-fallback notice now records "unanswered" when it closes without a choice, and the dialog can be cancelled from outside

    found in this entry's text

  34. v2.1.281
    Setting CLAUDE_CODE_AUTO_MODE_SERVER now controls the server-side auto-mode classifier for first-party users, not only third-party

    CLAUDE_CODE_AUTO_MODE_SERVER now also switches the server-side auto-mode classifier on or off for first-party connections

    found in this entry's text

  35. v2.1.281
    poll_event control request handling moved into a shared handler

    Handling of poll_event control requests in headless mode has moved into a shared handler

    found in this entry's text

  36. v2.1.281
    Auto-mode classifier prompt can be built without the user's auto-mode rules

    The auto-mode classifier prompt can now be built with its allow, soft_deny, hard_deny and environment rule lists left empty

    found in this entry's text

  37. v2.1.281
    Auto-mode server-fallback notice: moving on without answering continues unacknowledged

    Moving on past the auto-mode server-fallback notice now continues without recording billing acknowledgement, so the notice can come back

    found in this entry's text

  38. v2.1.281
    New auto-mode classifier cache-break telemetry and debug log

    Auto mode's safety-check model calls now report when their prompt cache breaks, and record what changed since the previous call

    found in this entry's text

  39. v2.1.281
    Auto-mode fallback warning dialog can now appear in SDK hosts (tengu_expressive_galaxy, fallback on)

    The auto-mode fallback warning can now appear inside SDK host apps that support it, when tengu_expressive_galaxy allows

    found in this entry's text

  40. v2.1.281
    Side queries with a deadline fail fast on long Retry-After, behind auto-mode config

    Deadline-bound side queries can now give up at once when the API asks for a wait longer than the time left

    found in this entry's text

  41. v2.1.281
    /insights logs an auto-mode recommendation

    /insights now logs a usage event when it considers recommending auto mode

    found in this entry's text

  42. v2.1.281
    Auto mode can hold locally auto-allowed shell commands for a server-side classifier

    In auto mode, shell commands allowed locally by sandbox or read-only rules can now be held for a server-side classifier to review

    found in this entry's text

  43. v2.1.281
    Auto mode sandbox-network classifier passes retryAfterMs when unavailable

    When the auto-mode network classifier is unavailable, its result now includes a retryAfterMs wait time

    found in this entry's text

  44. v2.1.281
    User messages can carry a classifierBoundary marker

    User messages can now carry a classifierBoundary marker that the auto-mode classifier reads

    found in this entry's text

  45. v2.1.281
    Auto-mode server-fallback billing notice gets a description entry for the dialog

    The auto-mode server-fallback billing notice now carries its full text, so remote and headless hosts show the same wording as the terminal

    found in this entry's text

  46. v2.1.281
    Auto-mode classifier treats plan mode as having left the mode unless the host allows it

    The auto-mode classifier's verdict is now discarded in plan mode unless the host allows it

    found in this entry's text

  47. v2.1.281
    Auto-mode permission context: rules dropped when stripped rules are restored

    When auto-mode permissions are swapped back, always-allow rules that no longer exist are dropped

    found in this entry's text

  48. v2.1.280
    New 'Auto mode check unavailable' UI state for the auto-mode server classifier

    Claude Code's UI now shows an "Auto mode check unavailable" message with a retry countdown when auto mode can't get a verdict

    found in this entry's text

  49. v2.1.280
    New speculative execution for the remote-tool auto-mode classifier

    The remote-tool auto-mode classifier can now guess a tool call's permission ahead of time and reuse that guess if it turns out right

    found in this entry's text

  50. v2.1.280
    Auto-mode tool classification requires an explicit 'classifierAllowed' flag

    Auto-mode tool classification now also requires an explicit classifierAllowed flag

    found in this entry's text

  51. v2.1.278
    New telemetry for server-side auto-mode classifier fallback/notice

    New analytics events track when auto mode falls back to local classification and when the billing notice shows

    found in this entry's text

  52. v2.1.278
    Session-scoped 'server classifier refused' latch drives permanent local fallback

    Once the server refuses classification once, auto mode sticks to local classification for the rest of the session

    found in this entry's text

  53. v2.1.278
    Auto mode server status surfaced as Enabled/Disabled

    A new diagnostics row reports auto mode's server classifier as Enabled or Disabled

    found in this entry's text

  54. v2.1.278
    New request-latch state for server-side classifier fallback and gateway tracking

    Session state now tracks the inference gateway seen and any classifier fallback choice made

    found in this entry's text

  55. v2.1.278
    Auto-mode classifier now distrusts unix-socket proxies unless SSH remote

    Sessions using ANTHROPIC_UNIX_SOCKET now lose server-side auto mode classification unless connecting over SSH remote

    found in this entry's text

  56. v2.1.278
    Third-party classifier availability check reworked

    The check for whether the server-side auto-mode classifier can be used was reworked internally

    found in this entry's text

  57. v2.1.277
    Fast-mode toggle behavior adjusted while a background auto-mode setup is in flight

    Fast mode's setting sync now behaves differently while a background auto-mode setup is still running

    found in this entry's text

  58. v2.1.277
    Auto-mode classifier logging no longer includes raw prompt/action text

    Auto-mode classifier logs no longer include raw prompt or error text, only lengths

    found in this entry's text

  59. v2.1.277
    Auto-mode Sonnet-5 classifier probe retained, log wording unchanged but refactored

    Internal refactor of the auto-mode Sonnet 5 classifier fallback, no behavior change

    found in this entry's text

  60. v2.1.275
    New telemetry when auto-mode's decision matches the mode already requested

    New telemetry logs when auto-mode's permission decision matches what was already requested

    found in this entry's text

  61. v2.1.275
    SDK-host (bridge) lane can now apply a model or effort pick sourced from claude_code_args

    SDK-host sessions can now have their model or effort level set from claude_code_args in auto mode

    found in this entry's text

  62. v2.1.275
    Auto-mode classifier telemetry now records root tool surface

    Auto-mode decision logging now records which tools were available at the root level

    found in this entry's text

  63. v2.1.275
    New closed-set decision_reason_code field on permission decisions

    New decision_reason_code field distinguishes specific reasons behind a permission decision

    found in this entry's text

  64. v2.1.275
    Tool execution can now flag a permission decision as classifier-driven auto-mode

    Tool calls now carry a flag noting when permission was auto-approved by the auto-mode classifier

    found in this entry's text

  65. v2.1.275
    Workflow agent() auto-mode classifier call now receives rootToolSurface

    Workflow agents running in auto mode now report their root tool surface to the auto-mode classifier

    found in this entry's text

  66. v2.1.274
    Auto-mode transcript builder gains a 'summary' turn frame

    Auto-mode's transcript reconstruction now handles 'summary' turn frames, not just 'invisible' ones

    found in this entry's text

  67. v2.1.273
    New, separate gate for background-hint/auto-mode timing: tengu_shimmying_stardust

    Background-hint timing for sync subagents now uses its own separate, oddly-named gate

    found in this entry's text

  68. v2.1.273
    Bridge session spawn: session-tag prefetch broadened to more triggers

    More conditions now trigger a session-tag prefetch before spawning a Remote Control bridge worker

    found in this entry's text

  69. v2.1.273
    Auto-mode-environment check factored into a reusable async helper

    The auto-mode-environment check was pulled out into a reusable helper checked at more points

    found in this entry's text

  70. v2.1.273
    Dropped auto-mode-environment now records a reason when tags are missing/unread

    Dropping a bridge child's inherited auto-mode environment now records why, instead of a plain yes/no

    found in this entry's text

  71. v2.1.273
    Bridge server-config gains an explicit 'drop auto mode environment' knob and user-configured tracking

    Bridge configuration can now explicitly drop the 'auto mode environment' setting, and tracks if you'd configured your own

    found in this entry's text

  72. v2.1.273
    Bridge child auto-mode gate flips its own default this release, and one caller gets swapped to a different, off-by-default flag

    Bridge child auto-mode logic re-plumbed to a new flag, while the old flag moves to a different caller and defaults on

    found in this entry's text

  73. v2.1.271
    Bridge child process kill is now correctly classified as "interrupted" even on nonzero exit

    Deliberately killed bridge child processes are now correctly logged as interrupted, not failed

    found in this entry's text

  74. v2.1.271
    Bridge child auto-mode permission defaulting, gated off

    Bridge-spawned child sessions may be defaulted to auto permission mode, gated off

    found in this entry's text

  75. v2.1.271
    SubagentHandback default flipped on (tengu_lively_waffle)

    Auto-mode subagents reporting back via SubagentHandback moves from an off-by-default flag to on-by-default in code

    found in this entry's text

  76. v2.1.271
    Auto-mode permission rules editor UI: internal refactor only

    The auto-mode permission rules editor was refactored internally with no visible change to its behavior

    found in this entry's text

  77. v2.1.271
    New auto-mode guard: subshells and multi-directory-change commands can't bypass the read block

    With blockReadsOutsideWorkingDirectories on, Bash subshells and multi-cd commands are now refused instead of evaluated

    found in this entry's text

  78. v2.1.271
    Auto-mode permission classifier context can now shed 'artifacts' before erroring

    Auto mode's permission classifier can now drop 'artifacts' from its context before it errors on being too large

    found in this entry's text

  79. v2.1.271
    New third-party MCP server classifier gate

    A new gate controls whether a third-party MCP server classifier is enabled, defaulting on

    found in this entry's text

  80. v2.1.269
    New "arbiter" mode for the server-side auto-mode classifier

    Auto-mode's safety classifier gained a new 'arbiter' mode that can skip some server checks

    found in this entry's text

  81. v2.1.269
    Auto-mode classifier: GrowthBook init call carries cache/telemetry params

    Auto-mode's GrowthBook setup call now passes caching and telemetry parameters and reuses its result

    found in this entry's text

  82. v2.1.269
    Auto-mode classifier: no-input early return extracted to helper

    Auto-mode's no-classifier-input check moved into its own helper function

    found in this entry's text

  83. v2.1.269
    ExitPlanMode tool rewritten to lazy create() factory

    ExitPlanMode tool internally restructured into a factory pattern, no behavior change

    found in this entry's text

  84. v2.1.269
    New autoModeSettingsJson passed to spawned CLI sessions when auto-mode environment is configured

    Spawned CLI sessions now include auto-mode settings computed from any configured auto-mode environment

    found in this entry's text

  85. v2.1.269
    New auto-mode-environment check before spawning a bridge (remote-control) session

    Bridge sessions re-check local auto-mode environment settings before spawning when the work item requests one

    found in this entry's text

  86. v2.1.268
    New allowed_domains parameter for sandboxed Bash commands, gated dark by tengu_flickering_rain

    A new allowed_domains parameter lets the model tell a sandboxed Bash command which network hosts it needs, feature-flagged and not yet confirmed live

    found in this entry's text

  87. v2.1.268
    Startup now logs auto-mode availability and guards context-metrics collection against failure

    Startup now logs auto-mode availability and won't crash if context-metrics collection fails

    found in this entry's text

  88. v2.1.268
    Sandbox system-prompt text rewritten to describe allowed_domains / auto-mode network review

    Sandbox instructions shown to the model were rewritten to explain listing needed hosts and reacting to blocked-host violations

    found in this entry's text

  89. v2.1.268
    New "auto mode" diagnostic snapshot function sEt()

    A new internal function assembles a full diagnostic snapshot of Claude's "auto mode" state

    found in this entry's text

  90. v2.1.268
    Commands carrying allowed_domains now force an 'ask' via the auto-mode classifier

    Commands with allowed_domains now always prompt for approval instead of being auto-allowed

    found in this entry's text

  91. v2.1.268
    Auto-mode permission telemetry now tags MCP tool calls with connection/ambiguity info

    Auto-mode telemetry now tags MCP tool calls with which server they connect to and whether that's ambiguous

    found in this entry's text

  92. v2.1.268
    Auto-mode classifier now also skips its fast path when a tool declares per-call sandbox network lists

    Auto-mode's classifier now runs on tools that declare per-call network allow/deny lists, instead of skipping them

    found in this entry's text

  93. v2.1.268
    NAe (proactivity-related gate used by shortcut/auto-mode logic) now hardcoded to return false

    A proactivity-related check used by shortcut keys and auto-mode is now hardcoded to always say no

    found in this entry's text

  94. v2.1.267
    New auto-mode verdict message for tool calls truncated by the server

    Auto-mode now explains when a tool permission check is missing because the model's reply was cut off

    found in this entry's text

  95. v2.1.267
    New tengu_fizzy_bonbon gate branches the auto-mode tool-permission-context flow

    A new feature flag branches how auto-mode establishes tool permission consent

    found in this entry's text

  96. v2.1.267
    SubagentHandback protocol for auto-mode subagents, gated off by default

    Subagents running in 'auto' mode may need to report back via a new SubagentHandback tool instead of plain text, gated by an unread flag

    found in this entry's text

  97. v2.1.267
    Sub-agent auto-mode classification now skips or clears output based on a 'handback' outcome

    Sub-agent output classification in auto mode now depends on a new handback outcome

    found in this entry's text

  98. v2.1.265
    auto-mode CLI subcommands fixed to attach to the right command object

    Fixed a bug that stopped the claude auto-mode defaults, reset, config, and critique subcommands from working

    named in this entry, found in this entry's text

  99. v2.1.265
    New 'classifier-only' tool category: some tools can only be allowed by the auto-mode classifier, never by saved rules or hooks

    Some tools can now only be allowed by the auto-mode classifier, ignoring saved allow rules and hooks

    found in this entry's text

  100. v2.1.265
    Auto-mode classifier call gains an extra parameter

    Auto-mode's classifier call now passes one additional argument alongside the existing transcript and host rules

    found in this entry's text

  101. v2.1.265
    Auto-mode permission pipeline wired to honor classifier-only tools' onBlock behavior

    Auto-mode permission logic now honors what a classifier-only tool wants to happen when it's blocked

    found in this entry's text

  102. v2.1.261
    New telemetry for auto-mode context being withheld entirely

    New telemetry fires when auto-mode context is too large and gets withheld entirely.

    found in this entry's text

  103. v2.1.261
    Auto-mode permission checks get finer-grained unavailable reasons

    Auto-mode's 'action pending' message now explains the specific reason instead of a generic unavailable notice.

    found in this entry's text

  104. v2.1.261
    New system-prompt flag: autoModeContextEnabled

    A new system-prompt flag controls auto-mode context injection.

    found in this entry's text

  105. v2.1.261
    Auto-mode classifier fallback now records a fallbackCause

    Auto-mode fallback telemetry now records why a fallback model was used.

    found in this entry's text

  106. v2.1.261
    Auto-mode server-classifier context now has a size budget with progressive truncation

    Auto-mode classifier context now trims progressively to stay within a byte budget.

    found in this entry's text

  107. v2.1.261
    Server-side auto-mode dangerous-tool-use classifier

    Auto mode's dangerous-action classifier now runs server-side and blocks actions it flags or can't reach.

    found in this entry's text

  108. v2.1.259
    Skill-invoked model overrides now respect auto-mode/fast-mode compatibility

    A model override declared by a skill or command is now ignored when the model isn't supported under the current auto or fast mode.

    found in this entry's text

  109. v2.1.259
    New destructive-MCP auto-mode gate added alongside the existing one

    Destructive MCP calls under remote auto mode can now be allowed by either the existing gate or a new flag.

    found in this entry's text

  110. v2.1.259
    Auto-mode gate fallback notification on plan exit

    Exiting plan mode when auto mode is unavailable now tells you it is falling back to the default mode instead of doing it silently.

    found in this entry's text

  111. v2.1.257
    Auto-mode edit classification no longer overridable by env var

    An env var no longer overrides whether edits get classified for auto mode; only remote config decides.

    found in this entry's text

  112. v2.1.251
    Permission mode corrected when feature flags arrive late

    Your permission mode is re-checked once remote settings load, so startup no longer sticks on the wrong one.

    found in this entry's text

  113. v2.1.248
    Dialog impressions logged once per showing

    Dialog view events are recorded once per showing rather than on every redraw.

    found in this entry's text

  114. v2.1.248
    Auto-mode default prompt stays up when an answer is refused

    The auto-mode default prompt stays visible when a keypress is refused.

    found in this entry's text

  115. v2.1.248
    Remote machines can send their own auto-mode rules with a tool-call approval request

    A remote machine's permission rules can now influence approvals for tool calls it asks about.

    found in this entry's text

  116. v2.1.248
    Auto-mode setup wizard cannot carry a stale accept timestamp

    Reopening the auto-mode wizard can no longer let a stray keypress confirm instantly.

    found in this entry's text

  117. v2.1.247
    Bash permission prompt explains auto mode and reports the right prompt type

    The Bash permission prompt now suggests auto mode and correctly reports which option you picked.

    found in this entry's text

  118. v2.1.247
    Workflow failures recorded through one function

    Workflow failures are now recorded in one place, so logging decisions are consistent.

    found in this entry's text

  119. v2.1.247
    Artifact-consent rule in the auto-mode permissions prompt can be switched off remotely

    The rule stopping Claude publishing artifacts you didn't ask for can now be removed remotely.

    found in this entry's text

  120. v2.1.246
    Auto mode can decline an unattended artifact comment reply, and now says so

    If auto mode declines an unattended artifact comment reply, the reply is dropped and you get one notice.

    found in this entry's text

  121. v2.1.246
    Auto-mode permission classifier retries get an explicit time ceiling

    The auto-mode permission classifier now has a hard overall deadline, so slow checks can't drag on.

    found in this entry's text

  122. v2.1.246
    New prompts and dialogs in the interactive session

    New automatic prompts appear: a first-time auto mode warning, a spending threshold dialog and a worktree tip.

    found in this entry's text

  123. v2.1.246
    Auto-mode classifier dump mirroring is compiled out

    A function for shipping auto mode's classifier inputs elsewhere returns immediately and nothing calls it.

    found in this entry's text

  124. v2.1.246
    Hook approvals can be sent back through the auto-mode classifier

    Hook-approved tool calls could still be checked by the auto-mode classifier, but the flag is off.

    found in this entry's text

  125. v2.1.246
    Hosts can turn off the auto-mode handback classifier

    A host can set classifyHandoff false to skip the classifier deciding whether a subagent hands control back.

    found in this entry's text

  126. v2.1.246
    Settings entries cannot smuggle auto-mode region markers

    Settings entries containing auto-mode region markers are refused so they can't pose as classifier structure.

    found in this entry's text

  127. v2.1.242
    A stale on-disk auto-mode killswitch no longer keeps auto mode off

    A stale local file can no longer keep auto mode switched off; startup re-checks the server.

    found in this entry's text

  128. v2.1.242
    Chrome navigation classifier for auto mode moved to remote config

    An env var for the Chrome navigation classifier is gone; a server setting now controls it.

    found in this entry's text

  129. v2.1.242
    Remote-settings kill switch renamed, and stale reads are discarded

    The auto-mode fallback warning now names which kill switch stopped it, and stale settings reads are ignored.

    found in this entry's text

  130. v2.1.242
    Shape rules for Claude in Chrome batched actions, off without server config

    Browser batch calls get strict shape rules with denials, but only under server config.

    found in this entry's text

  131. v2.1.237
    Auto-mode classifier reads poll events by sender

    The turn-handling classifier now splits queued events into separate turns depending on whether a human or another agent sent them.

    found in this entry's text

  132. v2.1.236
    PostToolUse hooks can pass context to the auto-mode permission classifier

    Your PostToolUse hooks can send extra context to the classifier that decides permissions in auto mode.

    found in this entry's text

  133. v2.1.236
    One-time prompt offering to make auto mode your default permission mode

    Claude can offer once to make auto mode your default permission mode, switched off in this build.

    found in this entry's text

  134. v2.1.236
    Four small robustness fixes

    Socket path comparisons and error handling in cross-session messaging got tightened.

    found in this entry's text

  135. v2.1.235
    Auto-mode environment setup onboarding now counts denials

    Auto-mode environment setup onboarding now waits for repeated denials before offering again

    found in this entry's text

  136. v2.1.234
    New setting useAutoModeDuringPlan, on by default

    Plan mode now uses auto-mode permission rules by default; turn it off in /config under Permissions.

    found in this entry's text

  137. v2.1.234
    Auto-mode classifier failures write a debug dump that ages out with the session

    When auto mode's classifier errors, a debug dump lands beside your transcript and gets cleaned up later.

    found in this entry's text

  138. v2.1.234
    The remote kill switch for bypassPermissions mode is gone

    A remote switch can no longer force you out of bypassPermissions mode mid-session; only the admin setting does.

    found in this entry's text

  139. v2.1.234
    The stdin transport now answers the remote-transport questions

    Plain stdin sessions now declare they are not remote, so remote-only delivery acks and one auto-mode capability skip out.

    found in this entry's text

  140. v2.1.234
    Auto-mode decisions are cached by how long they stay valid

    Cached auto-mode verdicts now expire by how long they stay valid, and long-transcript outcomes get reused.

    found in this entry's text

  141. v2.1.233
    Auto-mode denials moved into a React context

    Recent auto-mode denials, capped at twenty, now live in their own shared provider.

    found in this entry's text

  142. v2.1.232
    disableAutoMode setting can switch off the auto permission mode fallback

    Set disableAutoMode to "disable" to stop Claude Code ever falling back to auto permission mode.

    found in this entry's text

  143. v2.1.232
    Session flags, scheduled tasks and terminal probes moved into grouped stores

    Plan-mode flags, scheduled tasks and terminal probes moved into grouped per-session stores.

    found in this entry's text

  144. v2.1.232
    Auto-mode setup scan fails cleanly when no model is available

    Auto-mode setup now stops with a clear message when no model is available to you.

    found in this entry's text

  145. v2.1.232
    IDE and SDK clients can receive auto-default-nudge events

    Editor and SDK hosts can react to the auto-mode default prompt being shown or answered.

    found in this entry's text

  146. v2.1.232
    Non-interactive /auto-mode-setup no longer needs the onboarding flag

    Non-interactive /auto-mode-setup now just needs a resolved model and no remote flag.

    found in this entry's text

  147. v2.1.232
    Auto-mode setup picks its own model and retries on a fallback

    Auto-mode setup picks its own scan model, retries a fallback, and names the failure.

    found in this entry's text

  148. v2.1.232
    IDE hosts can drive the auto-mode default nudge

    Your editor can show and answer the prompt offering auto as your default permission mode.

    found in this entry's text

  149. v2.1.232
    Auto-mode setup picks its own model instead of the session's

    Auto-mode setup uses the auto-mode model and fails clearly when none is configured.

    found in this entry's text

  150. v2.1.232
    A proactivity level is threaded through sessions but does nothing yet

    A proactivityLevel setting is passed around sessions but changes nothing about Claude's behaviour yet.

    found in this entry's text

  151. v2.1.229
    /login warns if an OAuth token is set in your environment

    After logging in, you're warned if an OAuth token in your environment will override it later.

    found in this entry's text

  152. v2.1.229
    Retry for auto-mode classifier calls that come back unavailable

    Auto mode's model-picking call can retry when unavailable, but the retry count defaults to zero.

    found in this entry's text

  153. v2.1.229
    Auto-mode setup confirmation is now a single keyboard form

    Auto-mode setup confirmation is now one keyboard form with a picker and checkboxes.

    found in this entry's text

  154. v2.1.229
    Auto-mode side queries always send the billing attribution header

    Auto-mode's side queries send billing attribution metadata even if you set the opt-out variable.

    found in this entry's text

  155. v2.1.228
    Twelve more caches moved onto the session object

    A dozen caches now hang off the session and are inherited when a session forks.

    found in this entry's text

  156. v2.1.227
    Subagent handoff review now reads the subagent's answer

    The auto-mode safety check now reads what a subagent actually said before handing results back.

    found in this entry's text

  157. v2.1.227
    Final answers from workflow subagents get an extra auto-mode check

    In auto mode, what a workflow subagent reports back can now get a warning attached.

    found in this entry's text

  158. v2.1.227
    Subagent hand-back text is checked by the safeguard review

    A subagent's final text is now treated as untrusted and screened for prompt injection.

    found in this entry's text

  159. v2.1.227
    Auto mode can treat linked git worktrees as already-approved directories

    Auto mode could stop asking about sibling git worktrees of the same repo, but it is off.

    found in this entry's text

  160. v2.1.225
    Auto-default nudge actually flips the mode, and reports the outcome

    Saying yes to the auto-mode prompt now actually saves auto as your default permission mode.

    found in this entry's text

  161. v2.1.225
    VS Code-owned sessions get their own settings defaultMode handling

    In VS Code sessions, unsafe default permission modes from settings are refused and fall back to normal.

    found in this entry's text

  162. v2.1.225
    Auto-mode classifier now falls back when the primary model refuses

    When the auto-mode model refuses a request, a backup model now gets a try instead of failing.

    found in this entry's text

  163. v2.1.225
    Auto mode denies safeguard-refused classifier calls without recording a verdict

    A safety refusal during auto mode denies the action but no longer counts against your denial limit.

    found in this entry's text

  164. v2.1.225
    Shared "auto mode unavailable" message and a warning-kind notice

    The "auto mode unavailable" message is now consistent everywhere and shown as a warning.

    found in this entry's text

  165. v2.1.225
    Auto-mode nudge dialog simplified

    The auto-mode suggestion dialog now just dismisses itself instead of switching your session to auto.

    found in this entry's text

  166. v2.1.225
    Auto-mode default nudge requires the session to actually support auto

    The auto-mode suggestion would only appear in sessions where auto mode can actually be used.

    found in this entry's text

  167. v2.1.225
    Auto-mode nudge now switches the running session, or explains why it can't

    Saying yes to the auto-mode prompt would switch your current session too, not just future ones.

    found in this entry's text

  168. v2.1.225
    Auto-mode classifier failures are distinguished from classifier denials

    When the auto-mode classifier can't decide, you no longer get a bogus denial message or permission-rule hint.

    found in this entry's text

  169. v2.1.224
    AskUserQuestion dialog fallback cannot fire in this build

    A fallback to the question dialog when auto-classification is unavailable can never fire here.

    found in this entry's text

  170. v2.1.224
    Auto-mode telemetry marks MCP tools

    Auto-mode approval events now note whether the tool came from an MCP server.

    found in this entry's text

  171. v2.1.224
    Auto-mode telemetry records whether the tool was MCP

    More auto-mode permission events record whether the tool was from an MCP server.

    found in this entry's text

  172. v2.1.224
    SendMessage skips the auto-mode classifier

    Messaging another agent skips the auto-mode classifier and no longer counts toward denials.

    found in this entry's text

  173. v2.1.222
    Destructive MCP tools can be included in remote auto-mode

    Destructive MCP tools could stop skipping permission prompts in remote auto mode, but that is off.

    found in this entry's text

  174. v2.1.221
    Artifact tool: replies validated, and comment text stripped from stored transcript

    Artifact reviewer comment text is no longer kept in stored transcripts, and blanket allow rules skip several artifact actions.

    found in this entry's text

  175. v2.1.221
    Auto mode bash-first prompt variant

    Auto mode can be told to do file reads, searches and edits through Bash, but it's off by default.

    found in this entry's text

  176. v2.1.221
    Auto mode can be told to do its work through Bash ("thrifty sonic")

    Auto mode can be told to use Bash for reads and edits if you set the env var.

    found in this entry's text

  177. v2.1.221
    Auto-mode outcome-code visibility moved behind a wrapper with a dead conditional

    The switch controlling outcome codes in auto mode now runs through a wrapper with an empty branch.

    found in this entry's text

  178. v2.1.220
    Classifier beta-rejection latch still keys off a null placeholder

    The automatic retry that would drop a rejected classifier beta can never trigger in this build.

    found in this entry's text

  179. v2.1.220
    Reworded the classifier beta-rejection warning

    A warning message about a rejected classifier beta was reworded, though you can't reach it.

    found in this entry's text

  180. v2.1.219
    Cross-session safety rule wrapped in a named tag

    A safety rule in the auto-mode prompt got a wrapper tag; the rule text is unchanged.

    found in this entry's text

  181. v2.1.219
    Auto-mode permission rules are wrapped in their own prompt tag

    Auto-mode permission rules are now wrapped in their own tag inside the prompt.

    found in this entry's text

  182. v2.1.219
    Auto-mode permission classifier can emit a numeric severity instead of a yes/no block

    Auto-mode permission checks can score risk 0-100 instead of yes/no, but only for configured models.

    found in this entry's text

  183. v2.1.218
    Permission Mode Race Condition Handling

    found in this entry's text

  184. v2.1.213
  185. v2.1.212
    Auto-mode Setup (/auto-mode-setup)

    found in this entry's text

  186. v2.1.208
    Auto-mode opt-in dialog removed

    found in this entry's text

  187. v2.1.205
    Auto-mode repo visibility lookup

    found in this entry's text

  188. v2.1.198
    Auto-Mode Setup

    found in this entry's text

  189. v2.1.178

    found in this entry's text

  190. v2.1.174
  191. v2.1.166
  192. v2.1.136
    Auto Mode Hard-Deny Rules

    found in this entry's text

  193. v2.1.124
    Auto-mode classifier timeout cleanup

    found in this entry's text

  194. v2.1.90
    Auto-Mode Opt-in Logging

    found in this entry's text

  195. v2.1.89

    found in this entry's text

  196. v2.1.81
    Auto Mode Rule Critique CLI

    found in this entry's text

  197. v2.1.75
    Auto Mode Circuit Breaker

    found in this entry's text

  198. v2.1.74

    found in this entry's text

First cited

14

The earliest release whose published evidence quoted auto-mode was v2.1.90, 1 Apr 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.

ReleaseDateThe span that was quoted
v2.1.901 Apr 2026[auto-mode] hasAutoModeOptIn
v2.1.17411 Jun 2026Org admin's per-tool ceiling. Drives the auto-mode isOrgAskCeiling gate
v2.1.21822 Jul 2026Permission mode changed while the auto-mode classifier call was queued
v2.1.23213 Aug 2026No model is available for the scan in this session's auto-mode configuration.
v2.1.23213 Aug 2026No model is available for the scan in this session's auto-mode configuration. Check with whoever manages your organization's Claude models, or re-run after it changes.
v2.1.23619 Aug 2026Host-asserted context shown to the auto-mode permission classifier alongside this tool call's result.

8 further spans in the ledger name it. The list above is the earliest first and stops at 6.

Presence across releases

0

The miner has never read a build containing this name. It is here because a changelog entry of ours names it, which is evidence that it existed and not evidence of which releases carried it. The inventory starts at v2.1.138 and everything older than that was never mined.

Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the CLI flag does. All CLI flags.

Feedback