Claude Code Code Mode: one script instead of ten tool calls
Claude Code 2.1.323 shipped twelve minutes into Friday UTC with an experimental switch that changes how the agent acts. Turn on Code Mode with CLAUDE_CODE_EXPERIMENTAL_CODE_MODE=1 and Claude stops making one tool call per turn. It writes a JavaScript program instead, which runs commands in parallel, pipes one result into the next and returns only what Claude actually needs to read. The docs example finds a file with rg, edits it and runs the tests in a single script. Release: https://github.com/anthropics/claude-code/releases/tag/v2.1.323 Docs: https://code.claude.com/docs/en/code-mode
The real change is in permissions. In auto mode, the safety classifier now reviews the code, not each tool call. That is a different trust model: one judgment on a whole program instead of many small approvals. It is faster and it saves context, but a reviewer reading a script has to understand what it will do before it runs. The limits show Anthropic knows this is early. Scripts stop after ten minutes unless backgrounded. No Remote Control, Claude in Chrome or computer use. Not available through gateways, Bedrock, Vertex or Foundry, not with HIPAA or zero data retention, and only in the interactive terminal, so no -p, Agent SDK, VS Code or Desktop. Version 2.1.325 already shipped Code Mode fixes on Friday evening.
The same release also took something away. 2.1.323 removed the subagentStatusLine setting, the per-subagent row showing context, cost, model and effort, with no replacement. Issue #109446 went up a few hours later and gathered reactions fast, and a Hacker News thread called it careless. People who run many subagents built their cost watching on that line. Shipping a feature that hides more work inside one script while removing the gauge that showed what each worker cost is an awkward pairing.
On the open question of the leaked-secrets report from earlier this month: 2.1.323 and 2.1.325 do add credential hardening, stripping tokens and API keys from internal git, ripgrep and sandbox helpers. The release notes do not say this is the fix for that report, so treat it as hardening, not a closed case.
Code-as-action is not new; OpenCode and others got there first. What matters is that the most used coding agent now has it, and that the permission question moved from "may I run this command" to "may I run this program".
Disclosure: clauday is written with Claude.
← Back to all articles
The real change is in permissions. In auto mode, the safety classifier now reviews the code, not each tool call. That is a different trust model: one judgment on a whole program instead of many small approvals. It is faster and it saves context, but a reviewer reading a script has to understand what it will do before it runs. The limits show Anthropic knows this is early. Scripts stop after ten minutes unless backgrounded. No Remote Control, Claude in Chrome or computer use. Not available through gateways, Bedrock, Vertex or Foundry, not with HIPAA or zero data retention, and only in the interactive terminal, so no -p, Agent SDK, VS Code or Desktop. Version 2.1.325 already shipped Code Mode fixes on Friday evening.
The same release also took something away. 2.1.323 removed the subagentStatusLine setting, the per-subagent row showing context, cost, model and effort, with no replacement. Issue #109446 went up a few hours later and gathered reactions fast, and a Hacker News thread called it careless. People who run many subagents built their cost watching on that line. Shipping a feature that hides more work inside one script while removing the gauge that showed what each worker cost is an awkward pairing.
On the open question of the leaked-secrets report from earlier this month: 2.1.323 and 2.1.325 do add credential hardening, stripping tokens and API keys from internal git, ripgrep and sandbox helpers. The release notes do not say this is the fix for that report, so treat it as hardening, not a closed case.
Code-as-action is not new; OpenCode and others got there first. What matters is that the most used coding agent now has it, and that the permission question moved from "may I run this command" to "may I run this program".
Disclosure: clauday is written with Claude.
Comments