Yesterday's Claude Code release train ended on 2.1.201, but the line worth reading sits in 2.1.200, dressed up as housekeeping: 'Changed the "default" permission mode to "Manual"'. Nothing about the mode changed. Same behaviour, same approval prompts, new name.
A rename is the cheapest thing a product team can ship. It's also the most honest, because names are where a product admits what it thinks is normal.
There's a word for what happened here: retronym. "Acoustic guitar" only became a phrase when electric guitars took over. Nobody said "manual transmission" while every car had a clutch. The unmarked thing gets a name at the exact moment it stops being the assumption.
Claude Code just gave approving your own tool calls a name.
A strong week of releases
The train itself earns its version numbers. 2.1.197 made Claude Sonnet 5 the default model, with a native 1M-token context window and promotional pricing of $2 in, $10 out per million tokens until the end of August. The patches around it are one long reliability sweep: partial output now survives a mid-stream server error, subagents cut off by a rate limit report it instead of pretending they finished, and the background-agent daemon on Linux no longer takes itself down every fifty seconds after an unclean shutdown.
Unglamorous fixes, the kind you only make when people run the tool hard. I did a longer walkthrough of an earlier train like this after the London event.
Read the defaults, not the features
The feature list tells you what the tool can do. The defaults tell you who the tool thinks is sitting in front of it. This week, the defaults all moved the same way.
- Subagents now run in the background by default. Claude keeps working while they run and picks up the results when they finish. You're not expected to watch either of them.
- Agents finish code work by opening a draft PR. Background agents now "commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask". That last clause is the changelog saying the quiet part out loud: stopping to ask is now the exception worth naming.
- The Explore agent got promoted. It used to run on Haiku. Now it inherits the session's model, capped at Opus. Delegated work is expected to carry real weight, so it gets the real model.
- The
/agentswizard is gone. The release notes suggest you "ask Claude to create or manage subagents" instead. Even configuring your agents is now something you delegate to the agent.
Each of these is defensible on its own. Add them up and the assumed operator has drifted: from someone reviewing each step to someone who checks in later. The tool's mental picture of a normal session no longer includes you for most of it.
Which is why "default" needed a new name. You can't keep calling supervision the default when every other default assumes you've left the room.
The one change pointing the other way
The same release stopped AskUserQuestion dialogs from auto-continuing. Until yesterday, an unanswered question would eventually carry on by itself. Silence counted as consent. Now the dialog waits until you actually answer.
That looks like it contradicts a week of autonomy defaults. It's the same philosophy seen from the other side. When the agent runs unattended, a question that answers itself after a timeout was never really a question.
The changes sort interactions into two clean piles: things the agent should just do, and things that genuinely block on a human. Fewer questions, and the ones that remain now mean it.
The draft-PR default follows the same logic. Autonomy runs up to a reviewable artefact and stops there. A draft PR is a boundary you can actually hold: a diff, CI, a review. That's a better checkpoint than a mid-session "may I?" you were going to rubber-stamp between meetings anyway.
Defaults are policy
Most people never change a default. That makes shipped defaults the real specification for how a tool gets used, whatever the docs say. I made this argument when Microsoft turned Work IQ on by default: the friction was the feature. Every checkpoint you remove was doing some quiet safety work, and removing it by default removes it for everyone who never thinks about it.
So decide on purpose:
- Pick your permission mode deliberately. Manual still exists and works exactly as before. If you were reviewing each step because you chose to, nothing changed. If you were relying on it being the assumption, that assumption now has a name and a settings entry.
- Move guardrails from attention to enforcement. If sessions run while you're away, the rules that lived in "I'll catch it when it asks" have to live somewhere deterministic. That's what hooks are for.
- Keep blocking questions blocking.
/configlets you opt back into an idle timeout for questions. Don't. A question that resolves itself if you ignore it long enough protects nothing. - Treat the draft PR as the contract. Let autonomy run to the reviewable boundary, then actually review. Never ship code you don't understand, least of all code that was written, committed and pushed while you were at lunch.
The rename changed no behaviour and admitted everything. Give it a year and "manual mode" will sound the way "manual transmission" does now: a preference, something for enthusiasts, the box you have to tick because the world stopped assuming it. Driving yourself is becoming the option with the name on it. Make sure you're the one deciding whether to take it.