Claude Code 2.1.302 flips headless defaults: permission mode and fork subagents

Two defaults flipped

Anthropic tagged Claude Code 2.1.302 on October 16. According to a dev.to write-up of the release, most of the roughly 60 changelog lines are fixes, but two alter what a headless run does when a script leaves the choice unspecified: the permission mode a claude -p or Agent SDK session starts in, and whether Claude may fork its conversation into subagents. The changelog tracker gradually.ai lists the same release with the same two changes. Neither entry is marked as breaking, but any unpinned script inherits the new behavior automatically.

Permission mode falls back to Manual

Before this release, a -p or Agent SDK session that could not fetch feature flags — for instance on a third-party provider such as Bedrock, Google Cloud's Agent Platform or Microsoft Foundry, or with telemetry switched off — started in auto mode from v2.1.285 onward, meaning a classifier model approved actions instead of a person. Version 2.1.302 moves those sessions back to default, which the CLI calls Manual mode. A fresh install is a third trigger, and the dev.to author points out that this one can reach CI even on the Anthropic API: a runner that installs Claude Code at the start of every job, with no saved configuration, looks like a first run each time.

In Manual mode, reads go through without asking, but most edits and shell commands prompt for approval. Nobody is present to answer in a headless run — Anthropic's own headless documentation states such requests are denied. The practical effect is that a job which relied on the built-in default to edit files may now finish without a diff, with the denials recorded silently rather than raised as an error.

Fork subagents on by default

A fork subagent inherits the entire conversation so far instead of starting fresh, sharing the parent's system prompt, tools and model, and only its final result returns. Until 2.1.302 that behavior was a terminal-only default. It is now on by default in claude -p, the Agent SDK, the desktop app and VS Code; claude mcp serve never offers it.

The dev.to post highlights consequences beyond forks themselves. With fork mode enabled, Claude Code runs every subagent Claude spawns in the background — fork and non-fork alike — and removes the Agent tool's run_in_background parameter. Background subagents receive a smaller built-in toolset than foreground ones, forks excepted, and a -p run stays open until they finish, because their output counts toward the final result.

How to keep the old behavior

For permissions, name the mode explicitly. Hands-off jobs can pass --permission-mode auto together with --permission-prompts none, which stops Claude from retrying requests nobody can approve; the prompts flag requires v2.1.259 or later. Anthropic's docs note that on the cloud providers, auto mode only works with certain models — Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5 and the Fable models — and the session falls back to Manual otherwise. Locked-down pipelines can use dontAsk, which denies anything that would prompt, paired with --allowedTools entries for the tools the job genuinely needs. Setting permissions.defaultMode in settings files works too.

To catch silent denials, read the stream: with --output-format stream-json, the final result message lists them under permission_denials. To disable forks, set the environment variable CLAUDE_CODE_FORK_SUBAGENT=0 for that job. To keep fork mode but stop Claude from spawning forks, add an Agent(fork) entry to the permissions deny list.

Smaller changes

The dev.to post flags a few more behavioral lines in the release: prompt and agent hooks now run at most 12 of one event concurrently; CLAUDE_CODE_AUTO_MODE_MODEL selects the model for the client-side auto-mode classifier; the Read tool refuses image sources over 128 MB instead of loading them into memory; and the standalone Claude Design product closes on December 14, 2026 according to Anthropic's migration article, after which public project links stop working.

One caveat: as of October 18, Anthropic's permission-modes and subagents documentation pages still described the older defaults, so the release notes are the newer word. The dev.to author also notes he has not verified the behavior against Bedrock directly — the analysis rests on the release notes and docs.

Why it matters

This is quiet CI breakage. Neither change carries a breaking label, yet a headless job that never pinned its permission mode can start returning runs where every edit was denied — failing softly instead of loudly. The fork default adds background execution, a reduced toolset for some subagents and longer-running -p sessions to pipelines that never asked for them. Both fixes are one-line flags, but only for teams that know the defaults moved.