Claude Code 2.1.321

Claude Code 2.1.321 added Claude Fable 5.2 (claude-fable-5-2) and made it the default Fable model. It has a 1M context window and is priced at $8/$40 per million input/output tokens, with cache reads at $0.20 per million.

The release also adds a --settings flag to claude remote-control. The settings file you pass applies to every session it starts. If that file changes, no new session starts until you restart claude remote-control.

Several security and permission fixes are in this version:

• MCP OAuth requests no longer send secrets, such as refresh tokens, to another host when a server redirects them.
• A read-only Bash command could run outside the sandbox without a permission prompt. That's fixed.
• Bash permission checks could judge a file write from the wrong folder and skip the prompt. That's fixed too.
• Deny rules and protected-file prompts now apply to the file that a cp or mv into a directory writes.

Smaller fixes include the "Draws from usage credits" note no longer showing after a switch to Fable on Enterprise seats whose plan includes Fable, and claude mcp login no longer printing a SEP-2352 issuer warning each time you sign in again to a server Claude Code registered with.