Claude Code 2.1.319 makes unattended runs deny actions they cannot check

The release notes say that with telemetry or feature flags off, including behind LLM gateways, auto mode now asks about or denies calls the server cannot check. It no longer falls back to the built-in classifier. Setting CLAUDE_CODE_AUTO_MODE_SERVER=0 keeps the old behaviour, and Bedrock, Vertex and Foundry are unchanged. A related fix says claude -p used to exit 0 in auto mode when its actions were refused for lack of a safety check; text and JSON output now exit 1.

The same release adds permissions.denyInsteadOfPrompting. A tool call that would wait on a permission prompt is denied and the turn continues, in terminal sessions, subagents and teammates. It also moves MCP tool calls that run as tasks into the background right away and reports the result when they finish; CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND turns that off. Another fix says Bash deny and ask rules had missed commands written with quoted words.

Why it matters: Anyone running Claude Code headless or through a gateway should check what their harness now does when the safety check is unreachable: a nonzero exit on a refused action will show up in scripts that assumed success. The release notes describe the changes; they do not say how many setups relied on the old fallback.