Claude Code 2.1.246: Auto-mode permissions tab and Bash wildcard warnings

Anthropic tagged Claude Code v2.1.246 on 25 August 2026. The GitHub release notes and the in-repo CHANGELOG.md match. The drop is permissions UX, MCP correctness, a stop on sending a third-party gateway API key to Anthropic telemetry hosts, and a long list of session and UI fixes.

The previous changelog entry, 2.1.245, fixed a crash on startup on Linux distributions that ship glibc 2.44, for example Arch Linux, CachyOS, and Fedora Rawhide.

Auto mode rules you can edit

/permissions now includes an Auto mode tab for viewing and editing auto-mode classifier rules. You can inspect them in the same UI as the rest of the allowlist.

Claude Code also warns at startup when a Bash allow rule puts a wildcard before the subcommand. The notes use Bash(git * main) as the example; those patterns also match options inserted before the subcommand. The shipped behavior is a warning when the session starts.

Two nearby permission bugs closed in the same tag. Bash permission checks now always require approval for malformed commands with a dangling && or || operator. MCP tools marked requiresUserInteraction no longer offer "Yes, and don't ask again" in their permission prompt; that option wrote an allow rule the tool then ignored.

On very large sessions, auto mode tool calls could be denied as "temporarily unavailable." The safety-check deadline now scales with prompt size.

MCP reports an interrupt, not empty success

MCP tool calls interrupted by an incoming message in headless or remote sessions were reported to the model as "completed with no output." They now report an explicit interrupted error. When a parameter's schema is empty ({}), arguments were sent as JSON strings instead of their real type.

--strict-mcp-config sessions no longer prompt to approve .mcp.json servers they would never load, which left background sessions waiting at startup. /cd now applies the new directory's project settings, hooks, .mcp.json servers (behind the usual approval prompt), skills, and agents right after the move instead of on --resume.

Gateway credentials stay off Anthropic telemetry

Telemetry and metrics requests to Anthropic were carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL). A credential is now only sent to its own host.

When apiKeyHelper returns short-lived JWTs, an expired cached token is refreshed before the first prompt after idle, and 401/403 auth errors retry quietly. A third-party Anthropic-compatible endpoint that streams a tool_use block without an id no longer stops the UI with a render error on the first tool call. Resumed sessions no longer fail every turn with a 400 when saved history contains tool blocks the Anthropic API does not accept, typically written by a third-party API proxy.

Transcript, background sessions, and subagents

The end-of-turn duration line now includes the turn's completion time, for example ✻ Sautéed for 23s · done 6:05 PM.

Fullscreen mode no longer shows a blank transcript after you resize the terminal and jump to the bottom, until the next keypress. Diffs that contain a very long single line, such as a base64 string, no longer grind the transcript; those lines render truncated with a marker. Jump-to-bottom no longer gets stuck mid-transcript. Memory no longer grows with session length in fullscreen and Ctrl+O views, because each rendered message row no longer retains a full copy of the transcript-wide tool lookups.

Background sessions failed to open after 45 seconds when Claude Code's starting directory had been deleted, the machine had slept, or the host is slow to start processes. They also failed with "Couldn't start the background service … EACCES" when another process was re-installing the npm package at that moment. The background retention sweep no longer removes git worktrees under .claude/worktrees/ that you created yourself when an old background-session record pointed at them.

claude agents listed a backgrounded named session twice; backgrounding the same conversation again now numbers the new row, for example my-session (2). Opening a just-started session while its worker was still booting, common on Windows, no longer stops it with "was stopped while the respawn was in flight." Pressing ← or running /background during a dynamic workflow now asks before restarting finished subagents, and says how many would restart.

A command interrupted mid-run no longer shows as "Ran 1 shell command" with no sign it was cut. A subagent that stops at its maxTurns limit now returns output marked as partial, with a hint to continue via SendMessage, instead of appearing finished. Non-interactive sessions (-p, SDK, cloud sessions) automatically continue a response cut off mid-stream by a server error, connection loss, or stall.

Windows and macOS headless sessions now clean up stale ~/.claude/sessions entries left by unclean exits.

Plugins, themes, and other fixes

Plugin skills whose frontmatter name already includes the <plugin>: prefix no longer show it doubled in the slash menu. claude plugin update works with a bare installed name. claude plugin install <name> reports an error when ~/.claude/plugins/known_marketplaces.json is empty or corrupted, instead of exiting silently or hanging. Hook errors show the resolved plugin path instead of a literal ${CLAUDE_PLUGIN_ROOT}.

/rename no longer replaces the theme's prompt border, including a custom promptBorder, with default cyan. Custom diffAdded/diffRemoved colors are honored. An unknown action in keybindings.json is skipped so the default binding keeps working.

Also fixed: /stats heatmaps one cell off in timezones east of UTC; /fork from an already-forked or backgrounded session starting empty; prompts beginning with /-- rejected as unknown slash commands; the Write tool reporting "Out of memory" or freezing after overwriting a very large file that had already been written. Bash tool latency on bash shells improved by replaying snapshot functions without a base64 subshell per function.

If the client would not start on Arch, CachyOS, or Fedora Rawhide, take the 2.1.245 glibc 2.44 crash fix first, then 2.1.246 for the permissions and MCP work.

Read the v2.1.246 release notes and the 2.1.246 and 2.1.245 sections of CHANGELOG.md. Then open /permissions, check the Auto mode tab, and look for Bash allow rules that put a wildcard before the subcommand.