Claude Code 2.1.186: Bash Auto-Respond and Subagent Permission Escalation Change Your Operator Boundaries

Claude Code 2.1.186 shipped on June 22 with a quiet default-behavior change that will surprise teams running headless or automated pipelines: ! bash commands now automatically trigger Claude to respond to their output. Alongside that, a second governance change alters how multi-agent sessions handle pending permissions: background subagents no longer auto-deny blocked tool calls — they surface the prompt to the main session. Both changes shift operator boundaries without requiring a settings migration, but both require deliberate audit before you update.

What changed in 2.1.186

The release has three clusters of changes relevant to operators.

Bash auto-respond (new behavior, opt-out required):

! bash commands now trigger Claude to respond to the output automatically; set "respondToBashCommands": false in settings.json to keep the previous context-only behavior.

Previously, running !<command> in a Claude Code session added the output to context but did not trigger a new agent turn. Now it does. For interactive development this is a convenience. For headless or CI pipelines where bash output is injected into context intentionally without expecting a follow-up agent turn, this is a breaking default.

Background subagent permission escalation (new governance model):

Changed background subagents to surface permission prompts in the main session instead of auto-denying; the dialog shows which agent is asking, and Esc denies just that tool.

Previously, a background subagent that hit a permission boundary — a tool call requiring human approval that had not been pre-authorized — would auto-deny and move on. Now that subagent pauses and sends the prompt to the main session. The main session shows which agent is asking and allows per-tool approval with Esc to deny. This is a fundamentally more capable governance model, but it changes the expected failure mode for headless deployments.

Agent(type) deny rules security fix (was silently bypassed):

Fixed Agent(type) deny rules and Agent(x,y) allowed-types restrictions not being enforced for named subagent spawns.

If you deployed Agent(type) deny rules to control which subagent types can be spawned by named agents, those rules were not being enforced for named spawns — only anonymous ones. The fix closes that gap. Any named subagent spawn that previously slipped through the deny list will now be blocked. Verify that your allow/deny rules reflect what you actually intend before updating.

CLAUDE_CODE_MAX_RETRIES cap (affects unattended sessions):

Changed CLAUDE_CODE_MAX_RETRIES to cap at 15; for unattended sessions, use CLAUDE_CODE_RETRY_WATCHDOG instead.

If you set CLAUDE_CODE_MAX_RETRIES above 15 to give long-running sessions more resilience against transient API errors, that setting is now capped. Unattended sessions should migrate to CLAUDE_CODE_RETRY_WATCHDOG, which provides watchdog-style retry control better suited to long-horizon work.

claude mcp login/logout CLI (new, SSH-friendly):

Added claude mcp login <name> and claude mcp logout <name> to authenticate MCP servers from the CLI without opening the interactive /mcp menu, with --no-browser stdin redirect support for completing over SSH.

Teams running Claude Code on remote hosts over SSH previously had no clean path to complete MCP server authentication without spawning a browser on the remote. --no-browser with stdin redirect now supports headless MCP credential flows from the terminal.

Why this matters for AI engineering teams

The bash auto-respond change is the highest-urgency item for operators. Any pipeline that uses !<command> to inject context from shell output — log tails, status checks, build outputs, test results — now triggers an agent response turn after each injection. That means additional model calls, additional latency, and potentially additional cost for every automated context injection. It also means the agent may act on injected output without an explicit user prompt.

To preserve the previous behavior, add "respondToBashCommands": false to settings.json before updating in automated contexts.

The subagent permission escalation change requires a policy review. If your deployment relies on background subagents silently failing at permission boundaries — effectively treating auto-deny as a safe default — that assumption breaks in 2.1.186. Subagents will now pause and wait for the main session to handle the prompt. In fully unattended deployments with no human at the main session, this creates a blocking condition. Teams should either pre-authorize tool calls in managed settings, or configure deny policies that prevent subagents from reaching permission boundaries in the first place.

The Agent(type) fix is a security patch. If your access control model relied on Agent(type) deny rules to gate which named agents could spawn specific subagent types, audit whether any named subagent spawns have been slipping through. The fix enforces what was already declared; it doesn't change rules you've set, but it does close a gap that may have masked unauthorized spawns in session logs.

The router/operator angle

For teams running Claude Code sessions through a custom API gateway or AI router, these three changes interact:

Bash auto-respond + gateway metering: Each bash auto-respond turn is a full model request. If your gateway meters per-request or implements per-session token budgets, a session that previously injected five bash outputs per task now generates five additional model turns. Token accounting and cost attribution need to reflect this for billing-accurate reconciliation.

Subagent permission escalation + headless deployment: The safest response for operators running Claude Code in a headless mode (no human at the terminal) is to define explicit tool allow/deny policies in managed settings that eliminate permission prompts rather than relying on subagents to hit and escalate them. The 2.1.186 change removes auto-deny as a silent backstop — which is better for interactive use but requires more deliberate pre-authorization for fully autonomous deployments.

MCP login over SSH: The --no-browser MCP auth flow is directly useful for gateway operators running Claude Code on remote inference nodes. If your deployment pattern includes Claude Code on a remote host authenticating to MCP servers (tool registries, code execution hosts, data connectors), claude mcp login --no-browser enables credential setup without requiring a browser on the remote host.

What to audit before updating

1. Search for !<command> patterns in your Claude Code sessions or automation scripts. If any are used for context injection without expecting a follow-up turn, add "respondToBashCommands": false to the relevant settings.json before updating.

2. Review your subagent deployment policy. If background subagents hitting permission boundaries should fail silently, add explicit deny rules in managed settings. Do not rely on auto-deny as a default going forward.

3. Audit your Agent(type) and Agent(x,y) deny rules. Verify that named subagent spawns are correctly gated. Named spawns that were previously slipping through the fix will now be blocked.

4. Check CLAUDE_CODE_MAX_RETRIES if set. Values above 15 will be capped. Migrate long-running sessions to CLAUDE_CODE_RETRY_WATCHDOG.

5. For SSH-based MCP setups, test claude mcp login <name> --no-browser as a replacement for any workarounds previously used to complete MCP auth on remote hosts.

Update via npm install -g @anthropic-ai/claude-code or your managed deployment path. The --version flag confirms you are on 2.1.186.