Back to rankings

Claude Code Turns On the Mods It Writes Without Asking in Auto and Bypass Modes, and Stops Mod Tool Calls From Prompting

Claude CodeView original changelog

Claude Code 2.1.321 changes how the mods Claude writes get permission to run. In auto and bypass modes, a mod Claude writes now turns on without asking, even when managed settings such as allowUnsandboxedCommands: false or allowManagedDomainsOnly are set, and it does not load at all in dontAsk mode. A mod's own tool calls no longer raise a permission prompt, even under the user's own ask rules, though deny rules and organization policy still apply. The release also records the user's answer when Claude Code asks to enable a mod, and makes headless sessions reload mods when their files change.

Key Takeaways

  • Mods Claude writes now turn on without asking in auto and bypass modes, so no approval question appears before they run.
  • This holds even with managed allowUnsandboxedCommands: false or allowManagedDomainsOnly, which is a notable exception to those settings.
  • In dontAsk mode, mods Claude writes no longer load, which keeps no-prompt sessions from running unreviewed new code.
  • A mod's own $.tool.call and $.mcp.call raise no permission prompt, even under the user's own ask rules and in -p runs.
  • Deny rules and organization policy still apply to a mod's tool calls, so blocked tools stay blocked.
  • Claude Code now records the answer to the "turn on this mod" question, and headless sessions reload mods when files change unless CLAUDE_CODE_PLUGIN_DIR_WATCH=0 is set.

What Changed

Mods are small TypeScript or JavaScript hooks that change how Claude Code behaves or looks, and they ship inside plugins. Claude Code 2.1.321 changes the permission rules around the mods that Claude itself writes during a session. The change is easy to miss because it sits among more than a hundred other items in the release notes, but it alters what users are asked and when.

Mods Claude Writes Now Turn On Without Asking in Auto and Bypass Modes

Before this release, Claude Code asked the user to approve a mod that Claude had written before it started running. In 2.1.321, a mod Claude writes turns on without that question when the session is in auto mode or a bypass-permissions mode. The release notes state that this holds even when managed settings such as allowUnsandboxedCommands: false or allowManagedDomainsOnly are in place.

The opposite applies to dontAsk mode. In that mode, the mods Claude writes no longer load at all, which keeps a session that is meant never to prompt from running new code that the user was never asked about.

Claude Code also now records the user's answer when it does ask whether to turn on the mods it writes in a session, so the decision is no longer lost.

A Mod's Own Tool Calls No Longer Prompt

The second change covers what a running mod can do. Calls a mod makes through $.tool.call and $.mcp.call now raise no permission prompt, even when the user has written their own ask rules, and even in dontAsk and -p (headless) runs. Deny rules and organization policy still apply, so a tool the user or an administrator has denied stays denied.

For users, the practical effect is that a mod behaves like a trusted extension of the session rather than as a tool caller that has to be approved call by call. This makes mods smoother to use in unattended runs, and it also means the decision to run a mod carries more weight than it did. Mods run with the user's own permissions and are not sandboxed, so they are best installed or approved only from sources the user trusts.

Related Mods Behavior in the Same Release

  • Headless sessions now reload mods in .claude/skills when their files change. Setting CLAUDE_CODE_PLUGIN_DIR_WATCH=0 turns this off.
  • The 2.1.321 notes also fix a mod's hot reload missing a file that was deleted just after it appeared, and mod hot reload turning itself off in a cloud session when the user typed three messages instead of answering its question.

Why It Matters

Permission behavior around extension code is a trust boundary. A session in auto or bypass mode now accepts a Claude-written mod without a question, and a mod can call tools without prompts. The deny rules and organization policy that still apply are the safeguards that remain, so users who rely on ask rules to review every tool call should know that a mod's calls will not be stopped by them.

Claude Code Mods Skip Prompts in Auto and Bypass Modes | Yet Another Changelog