Claude Code 2.1.323 landed on npm last night at 20:29 UTC. The first entry in the changelog is also the most interesting one: Code Mode, an experimental opt-in where Claude writes JavaScript to call its tools instead of sending every call separately as a tool call.
That single line is all the changelog gives you. It points at code.claude.com/docs/en/code-mode to turn the feature on, or to turn it off for an organization. Fetched this morning, that path answers with a 404, and it does not appear in the docs navigation either. The page is clearly still coming.
Why this is more than a rename
An agent that wants to read twenty files and run three commands currently sends twenty and three tool calls, with a model response between each one. Write a small script that holds all the calls instead, and loops, conditions, and intermediate results run in a single pass. That saves tokens, and it saves the waiting in between. I wrote about 2.1.321 three days ago, where the topic was still which model is the default. This one is about how the agent works at all.
The price shows up in the wording: experimental, opt-in, and switchable off for organizations. Code that calls tools is harder to review than a list of calls.
Two lines more likely to hit you than Code Mode
The assumed context window for a model ID Claude Code does not recognize goes from 200,000 to one million tokens. That sounds harmless and is not. Sessions on other vendors’ models with a smaller window can fail on every turn once the window fills, until you hit /clear. If you run such models, set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 first.
And the number of messages your sessions on the same machine may send each other without asking you goes from roughly 20 to 100,000. The same applies to Claude Desktop. Anyone running agents in groups just lost the brake that used to kick in after twenty messages.
Plugins get a version boundary
plugin.json now takes engines["claude-code"]. A plugin outside its stated range is not installed, not updated, and not loaded, and install and update pick the newest version that fits. claude plugin validate additionally type-checks a plugin’s TypeScript hooks module. Each finding is a warning, and --strict turns it into a failure. The subagentStatusLine setting is gone, and a plugin’s agent field still applies but warns at startup.
On the MCP side, the first-generation client is removed. MCP_SDK_GENERATION=v1 now runs the v2 client in a compatibility mode with the earlier handshake and relaxed OAuth checks.
Permission checks tighten in several places
/security-review asks before it runs. Artifact updates ask first, even under an allow rule, when people outside your organization can see the artifact or Claude cannot tell. In the Bash sandbox, write access no longer counts when it comes through a symlink in a writable folder that leads somewhere else. git worktree add, move, and remove now fail read-only there. And --permission-mode auto starts in Manual mode when auto mode is unavailable, where before the session landed in a mode that would have allowed more.
On top of that come roughly 200 fixes, from Remote Control through cloud sessions to OpenTelemetry. The Artifact tool also accepts .docx as an asset now.
Code Mode is the most interesting switch you cannot find yet
One changelog line, a 404, no blog post: that is how Anthropic ships things when it is still open whether they stay. If you watch the token bill of an agent fleet, keep an eye on that docs page anyway. Once an agent writes its approach as a script, the question moves from how many calls it made to what the script says — and no allow list answers that one.