Claude Code opens network hosts one command at a time

Claude Code 2.1.271, released on September 14, lets a sandboxed command in auto mode carry its own list of network hosts, which the safety classifier reviews together with the command and opens for that command only. The rest of the release notes on Github rework other parts of auto mode, Bash permission checks and organization policy handling.

One command, its own hosts

The new entry reads:

Added per-command allowed_domains to Bash, PowerShell and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone; other hosts are refused

Auto mode handles calls in a fixed order. Your own deny, ask and allow rules come first. Routine local work, such as reading files or editing them inside the project folder, is approved without the classifier. Everything else, including shell commands, network requests and actions outside the folder, goes to the classifier and is judged against block and allow rules. The sandbox works at a different level: it sets, at the OS level, which files and network a command can reach once it runs.

Anthropic’s auto mode documentation describes the default: the classifier trusts only the working directory and the current repo’s configured remotes. Pushing to a company’s source-control org or writing to a team cloud bucket stays blocked until it is added to autoMode.environment. A GitHub docs issue points out that the v2.1.97 changelog said “Improved auto mode and bypass-permissions mode to auto-approve sandbox network access prompts,” while the sandboxing docs still said new domain requests trigger a permission prompt unless allowManagedDomainsOnly is on, which blocks domains not on the allowed list.

Admins of Claude Code on the web get a Custom network access option in the Cloud environments editor in admin settings, with the same allowed-domains list the environment dialog on claude.ai/code offers.

What else moved in auto mode

The inline ! shell commands in skills and slash commands now follow default-mode permission rules instead of going to the classifier. A command that no rule decides runs as a reviewed tool call. A subagent in auto mode now reports back to its caller through a dedicated hand-back call that the classifier reviews; until now, its last message was reviewed after the fact.

Monitor watches change from open-ended to timed. Before, a watch could be set persistent with no timeout. That option is gone: every watch now has a deadline of at most 30 minutes, or 10 in single-prompt -p runs, and when it runs out Claude is notified to re-arm it.

One fix closes a gap in permissions.blockReadsOutsideWorkingDirectories. In bypass and auto mode, Bash commands with two directory changes, a subshell or a cd+git chain had been skipping the prompt.

Dynamic workflows now pause when you hit your usage limit and continue automatically when it resets, where before the affected agents were dropped. On Pro plans the default workflow size is now small, and the guideline for medium drops from 15 agents to 10.

Bash checks

Three more entries cover the Bash permission checker. It missed the file that fmt, column and similar commands read when that file came after an option the checker did not recognize. It skipped the files a wildcard expands to when the wildcard sat in a command’s pattern or option value; the notes give grep -v dir/* file as the example. And shell variable declaration flags could misrepresent the command being run. The checker has had fixes of this kind before: in August, a crafted Bash command could hide part of itself from the permission check.

On Linux, a sandboxed command that failed to start could leave behind a stale .git/config.lock, which broke git checkout -b, git push -u and git config for the rest of the session. That is fixed.

Agents, plugins, runners

A new omitClaudeMd field in agent frontmatter and --agents JSON lets custom and plugin subagents run without user, project and local CLAUDE.md files. Managed policy files still load. claude plugin install and claude plugin update get --accept-command <sha256>, which accepts exactly the command an earlier --json run displayed, in place of -y.

A session can now watch up to 10 published artifacts at once for republishes made elsewhere, up from 5. Markdown files published as artifacts render as styled document pages, with a title header and syntax-highlighted code. claude mcp serve sends a progress update every 30 seconds during a running tool call, so clients show it is still running and idle timeouts don’t abort a long command that prints nothing. The /config panel in fullscreen mode takes the mouse: the wheel scrolls the settings list, and a click on a value changes it.

Self-hosted runner sessions silently lost all host config (settings, skills, plugins, MCP servers) when the host config directory exceeded 64 MiB. That is fixed, and the release adds --host-config-snapshot disk|memory. A second runner flag, --drain-marker-file <path>, makes the runner report its exit to the server as a host drain when that file exists at a SIGTERM drain; it is telemetry only.

The other surfaces get their own entries, among them:

• VS Code: an Attach Open File setting that, when off, stops the open file from being added to messages; selected text is still attached.
• Claude Code on the web: a cloud session that sometimes took about ten minutes to respond after its process exited now restarts as soon as you send a message.
• Claude Tag: Claude in a channel where it stays active no longer loses its working context about once an hour when the conversation is mostly in threads.
• Code Review: the same findings are no longer posted two or three times when GitHub reported an error for a review it had in fact created, and follow-up reviews no longer re-post a security finding a person already resolved.

Fast mode and organization policy

Fast mode now works in Claude Code Remote sessions on cloud and self-hosted runners, through the host’s fast-mode setting or /fast typed in the session, where your organization allows it. /fast off used to answer “Fast mode unavailable” when the organization had fast mode disabled; now it turns fast mode off. Sessions started with CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK kept re-sending fast requests every turn after the API rejected fast mode; now the rejection stands and its reason is shown. Under CLAUDE_CODE_RETRY_WATCHDOG, a usage-credits limit or an overload now makes fast mode fall back to standard speed, where before the turn failed on the limit or the overload was retried at fast speed.

For billing, the modelPricing managed setting and the Claude apps gateway pricing block accept a multiplier above 1, up to 10, for marked-up internal chargeback rates. Sessions on the Claude apps gateway, Bedrock, Vertex AI and Foundry no longer refresh a leftover claude.ai login the session doesn’t use.

Organization policy gets four fixes. A cached policy was reused after switching accounts, organizations or API keys, and when the credential changed mid-session the policy did not refresh until the hourly check. The tool and command lists did not update when the policy finished loading after startup or changed mid-session. Third-party local proxies set via ANTHROPIC_UNIX_SOCKET had org policy fetched through them and rejected; they are again treated like other custom gateways, including for Remote Control.

The fourth concerns an enterprise managed-mcp.json that can’t be read or parsed. It used to be ignored. Now it keeps exclusive MCP control: user, project and plugin servers don’t load, and Claude Code warns at startup.