Claude Code 2.1.200: Manual Permission Mode Shifts Security Left

Claude Code 2.1.200: Manual Permission Mode Shifts Security Left
📑 Table of Contents

Anthropic shipped Claude Code 2.1.200 on July 3, 2026 — and while it looks like a routine point release, it contains two behavioral changes that will quietly break unattended CI pipelines and background agent workflows if operators don’t act fast.

Manual becomes the default

The headline change is a permission model rename: what was previously labeled "default" is now officially called “Manual” across the CLI, VS Code, and JetBrains integrations. This is more than cosmetic. The previous "default" label was ambiguous — it suggested out-of-the-box safety when in reality it meant “ask before every tool call.” The new "Manual" label makes the contract explicit: human approval is required.

Existing configurations using "defaultMode": "default" or --permission-mode default still work as compatibility aliases, but teams should migrate to "manual" to stay aligned with current documentation.

AskUserQuestion no longer auto-continues

The higher-urgency change: AskUserQuestion dialogs no longer auto-advance by default. Previously, when Claude Code posed a clarifying question during an unattended run, the dialog would time out and continue. In 2.1.200, it waits indefinitely for a human response.

This is a breaking change for teams running Claude Code in CI, background daemon mode, or as a subagent under an orchestrator. Any AskUserQuestion trigger in the tool execution path will now stall the downstream job. Teams must either suppress clarifying questions via system prompts, pre-approve tools so the question never fires, or opt into an idle timeout via /config.

Daemon hardening for production fleets

Beyond the permission changes, the release ships twelve background-agent and daemon reliability fixes. A particularly nasty bug involved the daemon.lock PID-reuse issue: after a crash, the OS could recycle the daemon’s PID, and a stale lockfile would prevent agents from ever restarting. The fix introduces build-recency checks so a reinstalled older binary can no longer hijack the daemon.

Other fixes address background sessions silently stopping after sleep/wake, orphan cleanup corruption, and transient rate-limit errors now retrying with backoff instead of failing turns. For teams running Claude Code at scale, these are stability improvements that matter.

Accessibility and screen reader support

The release also takes a meaningful step on accessibility: decorative glyphs are now hidden from screen readers, transcript symbols read as short labels, and nested tables render as Header: value lines. The /mcp server list now properly tracks focus for screen readers and magnifiers.

What to do now

If you run Claude Code in production — especially in CI or as background agents — audit your config for AskUserQuestion triggers and migrate "defaultMode": "default" to "defaultMode": "manual". The compatibility alias won’t last forever, and the auto-continue change will bite the next time your pipeline hits a clarifying question.

Install with npm install -g @anthropic-ai/claude-code and run claude --version to confirm you’re on 2.1.200 or later.