Which Claude Code version changed this permission behaviour?
claude --versionFind your row first. Most "it works differently for me" reports are a version, not a setting.
Answer
The permissions documentation records what changed in which version as inline "before v2.1.x" notes, spread over a dozen sections. This page collects them, oldest first, from auto mode arriving on Bedrock in 2.1.158 to bypassPermissions being dropped from project settings in 2.1.257. Run claude --version, find the rows above yours, and you know which of the behaviours on this site you do not have yet.
What it does
The official documentation describes current behaviour and marks older behaviour inline: "before v2.1.211, only pushes to the branch you started on were allowed". Those notes are accurate and scattered. Collected in one place, they answer a question the documentation itself does not pose: is the difference between what I see and what the page says my version?
Everything below is taken from those notes, with the version the docs name. A row says what changed at that version and what held before it. Rows about the auto mode classifier's block list are summarised; the full lists are on the documentation page this site cites.
| Version | What changed | Before |
|---|---|---|
| 2.1.158 | Auto mode reached Bedrock, Google Cloud's Agent Platform, Foundry and the Claude apps gateway, but only with CLAUDE_CODE_ENABLE_AUTO_MODE=1 set, through 2.1.206 | Not available on those providers |
| 2.1.178 | The classifier evaluates a subagent's task description before the subagent starts | Only its actions and its final history were reviewed |
| 2.1.193 | Some sessions run a classifier that writes a short explanation for a block; autoMode.classifyAllShell recognised | Earlier versions ignore the key and carry narrow shell allow rules into auto mode |
| 2.1.195 | The classifier blocks more by default: secret managers, DNS and TLS, merging unapproved PRs, feature flags, protected IaC scopes, tunnels, printing live credentials, registry bypass, --insecure, launching an unattended agent loop. It also allows more: deleting jobs it created, security work, inter-agent messages, data flow to trusted infrastructure | Shorter block list |
| 2.1.198 | Blocks wildcard deletes in shared scratch directories, sensitive details in outbound content, keystrokes to its own tmux pane, and git commit --amend on a pushed commit; reuses a network verdict per host instead of re-checking every connection | Each connection was checked; amend of a pushed commit was not singled out |
| 2.1.199 | dontAsk denies MCP tools marked requiresUserInteraction | The tool's approval card had no answer and the mode did not deny it explicitly |
| 2.1.200 | The mode that asks is labelled Manual and manual is accepted as an alias for default; a remote added mid-session with git remote add is no longer trusted; new blocks for tampering with security tests, deleting stateful resources, repointing API base URLs, changing push remotes, pushing secrets to public repositories, PRs against other repositories | Mid-session remotes were trusted; the mode had no Manual label |
| 2.1.202 | Remote Control sessions report their permission mode to claude.ai and the mobile app | The app could show a mode the session was not in; prompts were still correct |
| 2.1.203 | Blocks content from sensitive local stores, session transcripts and credential folders among them, entering a commit, push, PR, gist or package publish; a dotfiles repository is the one exception for personal data | Personal data was grouped with confidential material; any direct push to the default branch was blocked |
| 2.1.205 | Blocks writes to Claude Code's own session transcripts and recursive forced deletes whose target is an unresolved shell variable | Not blocked |
| 2.1.207 | The classifier stops reading autoMode from .claude/settings.local.json; CLAUDE_CODE_ENABLE_AUTO_MODE has no effect, auto mode is on by default on the cloud providers | The local file was read; the variable was required on those providers |
| 2.1.208 | The block reason is the fixed text Blocked by classifier in most sessions; claude auto-mode defaults --label reads one rule | A written reason, where the classifier produced one |
| 2.1.211 | Pushes to any branch of the working repository are allowed by default, and the secrets check applies on every branch; the protected-branch environment entry is removed | Only your branch, branches Claude created and routine pushes to the default branch; the secrets check was scoped to the default branch |
| 2.1.212 to 2.1.217 | Plan mode prompted for every command outside the read-only set, whether or not auto mode was available | The classifier reviewed planning commands; restored after 2.1.217 |
| 2.1.218 | rm and rmdir on a critical path go to the classifier in auto mode even when an allow rule matches | An allow rule could approve them |
| 2.1.222 | The classifier reviews each SendMessage to another agent before delivery | Not reviewed |
| 2.1.228 | Pro, Max and Team terminal sessions start in auto mode by built-in default on macOS, Linux and WSL; /auto-mode-setup drafts environment entries | The built-in default was Manual everywhere |
| 2.1.229 | The classifier-unavailable message names the failure category, such as (rate-limited) | It read "Wait briefly and then try this action again" |
| 2.1.233 | The built-in auto default and /auto-mode-setup on native Windows | Manual on Windows |
| 2.1.234 | A deny caused by the classifier's context overflowing is reused until new content arrives or compaction shrinks it | Re-evaluated on every connection |
| 2.1.236 | Monitor allow rules are dropped on entering auto mode, like Bash(*) | A whole-tool Monitor rule approved its commands without review |
| 2.1.246 | A session that ended in plan mode resumes in plan mode on the -p and VS Code paths, under conditions | Plan mode was not restored there |
| 2.1.247 | A Bash permission prompt in Manual or acceptEdits offers Yes, and switch to auto mode | Auto mode was reached only through Shift+Tab, the flag or a setting |
| 2.1.248 | --restricted: refuses bypassPermissions and stops the classifier approving protected-path writes | No such flag |
| 2.1.251 | A running auto-mode session leaves the mode when a managed disableAutoMode reaches it, with auto mode disabled by settings | It kept the mode until it ended |
| 2.1.257 | bypassPermissions no longer takes effect from .claude/settings.json or .claude/settings.local.json; blockReadsOutsideWorkingDirectories prompts even in auto and bypass; new blocks for instance-metadata credentials, tunnels and reverse shells, host credentials, sibling containers | The mode applied from any file |
Two rows are not on the permissions page but change what it describes: 2.1.229 is from the error reference, and 2.1.246 from the sessions page.
How to check
Your version first:
claude --versionThen read the table from your row upwards. Everything above your version is behaviour you do not have, however the documentation phrases it. Two rows deserve a second look because they are the ones people report as bugs: the 2.1.212 to 2.1.217 window, where plan mode prompted for everything, and 2.1.257, where a bypassPermissions default in a project file stopped working.
For the current behaviour of any row, the documentation's own "before" note sits next to it; this site's pages link to the section each time they rely on one.
Example
You are on 2.1.240. A colleague says the Bash prompt now offers to switch into auto mode. The table says that arrived in 2.1.247; you are seven versions short, not misconfigured.
You are on 2.1.257 and the project's .claude/settings.json has "defaultMode": "bypassPermissions", which worked last month. The 2.1.257 row says it no longer applies from that file; the not-applied page says where to move it.
Common mistakes
Reading the documentation as your version. It describes the newest one. Every "before v2.1.x" note is a version boundary, and this table is nothing but those boundaries.
Reporting a 2.1.212 to 2.1.217 symptom on a later version. Plan mode prompting for every command was that window. On a later version the cause is elsewhere: auto mode unavailable, or useAutoModeDuringPlan turned off.
Assuming the block list only grows. 2.1.211 removed a default, the protected-branch entry, and made pushes to any branch allowed. A block you relied on may have moved to something you now have to configure, with an ask rule or an environment entry.
Treating this page as the changelog. It is the permissions documentation's version notes, nothing else. Release notes cover everything; this covers one topic, with the "before" preserved.