Claude Code 2.1.321 landed on npm on November 9 at 19:02 UTC, and 2.1.322 on November 10 at 01:58 UTC. The last version I covered was 2.1.319, published on November 6.
Fable 5.2 is now the default Fable
2.1.321 adds Claude Fable 5.2 as claude-fable-5-2 and makes it the default Fable model: 1M token context, $8 per million input tokens, $40 per million output tokens, $0.20 per million cache reads. 2.1.322 adds fast mode on Vertex in the global, us and eu regions, falling back to standard speed if Vertex refuses it.
Three fixes that are about permissions
The first is a single changelog line that carries weight: on an MCP OAuth request that a server redirected, secrets such as refresh tokens were sent to another host. If you run MCP servers written by someone else, you may have handed over tokens without noticing.
The second: a Bash command classified as read-only ran outside the sandbox in one case, with no permission prompt. The third: Bash permission checks judged a file write from the wrong folder and therefore did not prompt. On top of that, deny rules and protected-file prompts now also apply to the file that a cp or mv into a directory writes.
What else stands out
Fallback mode sometimes declined a request or mentioned a stopped response when the first model was blocked before replying. NotebookEdit deleted or overwrote a notebook’s first cell when the call named no cell, on network paths — UNC shares, WSL folders, /net mounts — and Edit had its own set of failures on those same paths, up to replacing a whole file on an empty old_string.
There is also a new --settings <file> for claude remote-control: the file applies to every session the command starts, and if it changes, no new session starts until you restart claude remote-control.
And in /config: it showed Manual as the default permission mode even though new sessions start in auto mode. Pressing Space on “Auto (default)” now saves “Don’t Ask” instead of Plan.
Claude Desktop 4.23118.1 ships 2.1.321 with it
November 9 also brought Claude Desktop v4.23118.1, with Claude Code 2.1.321 bundled. Two items there matter more to developers than the version number. The certificate that signs Claude Code on macOS is now a newer Developer ID certificate from the same Anthropic team (Team ID Q6L2SF6YDW), so rules matching the Team ID keep working while rules pinning the certificate itself need the new one added. And skills in a subfolder’s .claude/skills no longer load during a session when the sandbox is on; the session has to start in that subfolder.
The OAuth line is the reason to update today
The new model is the part that gets written about, and the four permission fixes are the reason to actually do it. Three of them describe cases where Claude Code did something without asking that should have asked. The fourth sent credentials to a host you did not choose. For a tool whose entire value depends on you granting it rights, those are the lines that count.