Claude Code 2.1.219: Three Governance Changes Every Operator Must Audit Before Deploying

Three changes in Claude Code 2.1.219 land quietly in a changelog full of bug fixes, but each one changes what an operator's deployment is actually allowed to do — without requiring any code change to trigger the new behavior.

What changed, with the specific settings

sandbox.network.strictAllowlist — new, off by default.

Before 2.1.219, Claude Code's sandbox would prompt the user when a sandboxed command tried to reach a network host not yet on the allowlist. The user could approve or deny. With strictAllowlist: true, denials happen silently: any host not already in sandbox.network.allowedHosts is blocked without a prompt. The permission dialog disappears from the path entirely.

This matters for headless operator deployments. If you run Claude Code in a CI environment or behind an API gateway where no human is watching the terminal, the old behavior meant unrecognized hosts would queue up permission requests that nobody would ever approve — stalling the agent. With strictAllowlist, you declare the network perimeter in settings and every outbound call is checked against that list at the OS level, with no fallback to prompting.

To enable it:

// .claude/settings.json or managed settings
{
  "sandbox": {
    "network": {
      "strictAllowlist": true,
      "allowedHosts": [
        "api.anthropic.com",
        "registry.npmjs.org",
        "github.com"
      ]
    }
  }
}

What this changes operationally: any agent that tries to reach an undeclared endpoint — say, an MCP server that resolves to a cloud domain you haven't seen before, or a package registry the model decided to pull from — will fail silently rather than stall. You get a cleaner failure mode, but you also take on the maintenance burden of keeping the allowlist current as the agent's tool set evolves.

Nested subagents now reach depth 3 by default — and you need an explicit setting to roll back.

Before 2.1.219, Claude Code subagents could not spawn their own subagents. The depth ceiling was 1: a main agent could spawn workers, but those workers ran in a flat single level. As of 2.1.219, the default ceiling is depth 3: the main agent can spawn a subagent, that subagent can spawn its own subagents, and those can spawn one more level.

The budget implication is real. At depth 1, a single orchestrator prompt spawning 10 subagents produces 11 Claude API calls. At depth 3, each of those 10 can spawn 10 more, and each of those can spawn 10 more — a theoretical ceiling of 1,111 API calls before the orchestrator's turn finishes. In practice workflows don't saturate this ceiling, but the blast radius of a misconfigured agentic prompt grows by an order of magnitude.

To restore the old depth-1 behavior:

# In your shell environment or managed-settings env
export CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1

Or in managed settings, pass it as an env var for the settings file's env resolution. The CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH env var is the only current control.

For operators routing Claude Code through a gateway: each spawned subagent makes independent API calls to the upstream provider. Depth-3 nesting means you may see burst patterns in your token metering that don't map 1:1 to top-level orchestrator sessions. If you are using per-session cost attribution for billing or chargeback, this breaks the assumption that one CLI invocation = one session's worth of API traffic.

Dynamic workflow size now defaults to "medium" — fewer than 15 agents — rather than unrestricted.

Claude Code's Dynamic Workflow feature lets the model orchestrate a variable number of parallel agents to complete a task. Before 2.1.219, the size guideline was advisory only, and the default was "unrestricted" — the model could spin up as many agents as it thought the task required.

The 2.1.219 default is now "medium": aim for fewer than 15 parallel agents. This is still advisory (the model can exceed it for good reason), but it anchors the model's planning against a concrete number.

From the operator perspective: if you were using Dynamic Workflows for large-scale code analysis or repository-wide refactors and seeing unpredictable agent counts, you now have a control surface.

To change the default:

// In any settings file (project, user, or org/managed)
{
  "workflowSizeGuideline": "large"   // "small" | "medium" | "large" | "unrestricted"
}

Or navigate to /config → "Dynamic workflow size" in the interactive session. The current active guideline also now appears in the running-workflow status line, so you have visibility into what's governing the current run without opening the settings file.

The cross-provider view: where these settings live vs. where they're enforced

All three settings are configured in Claude Code's settings layer — project-level .claude/settings.json, user-level, or organization managed settings. None of them live in the Anthropic API request itself. That means:

• Teams routing Claude Code through Bedrock, Vertex AI, or a custom gateway see the same behavior as direct Claude API users. The sandbox and subagent controls are enforced client-side, before any request reaches the routing layer.
• Gateway-level observability: your routing proxy sees individual API calls but cannot see the depth or network allowlist state at the Claude Code client. If you want visibility into subagent depth, instrument at the SDK level or read the agent_turn events in the stream-json output (the new --forward-subagent-text flag in 2.1.219 surfaces depth-2+ subagent text, keyed by the spawning tool_use id).
• Managed settings: for teams using managed settings delivered via the CLAUDE_CODE_SETTINGS_URL env var, all three settings can be centrally controlled and will resolve at startup — no per-project file needed.

The comparison to other coding agents: Cursor's Automations feature and Grok Build both enforce agent-spawn governance at the cloud control plane, where the operator can see and cap agent counts in a dashboard. Claude Code's governance lives at the CLI/SDK edge — which is more flexible but requires deliberate managed-settings deployment to enforce across a fleet of developer workstations or CI runners.

What to audit before 2.1.219 reaches your fleet

If you run Claude Code in CI or headless mode:
Enable sandbox.network.strictAllowlist: true and build out your allowlist. Without it, failed network calls will fall through to silent denial once you opt in — but prompting in unattended environments was already a dead end. Build the allowlist from your existing logs before enabling.

If you run Dynamic Workflows on large codebases:
Check whether your workflows routinely spawned more than 15 agents. If yes, add "workflowSizeGuideline": "large" or "unrestricted" to your managed settings before deploying 2.1.219, or accept the behavioral change and monitor token consumption for the first few runs.

If you do per-session cost attribution:
The depth-3 subagent default means top-level session attribution no longer captures all costs from an agentic run. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 if you need strict session-level cost boundaries, or update your attribution logic to aggregate across the tree of API calls generated by one CLI invocation.

One more item: Opus 4.7 fast mode now errors.
claude-opus-4-7 with speed: "fast" returns an error in 2.1.219. Unlike Opus 4.6, it does not silently fall back to standard speed. If any of your Claude Code configurations pin the Opus 4.7 model and call fast mode explicitly, those calls will fail. Migrate to Opus 5 or Opus 4.8 for fast mode access.