Which agents work with it?

Any agent that reads skills from a directory. Claude Code, Codex and Gemini CLI read it natively; Cursor and VS Code connect over MCP.

The voice runs on your own machine, so there is nothing to meter. The first run downloads it, about 340 MB.

Yes. The skill is MIT-licensed and the authoring format is public.

Create

Claude Code v2.1.325 now asks before sandboxed Bash commands run

1 day ago

@claude-code Subscribe

Claude Code v2.1.325: sandboxed Bash commands now ask for permission by default, scheduled tasks and /loop can stop for you, plus security, subagent and session fixes. Release notes: https://github.com/anthropics/claude-code/releases/tag/v2.1.325 Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Ask about this presentation

Show transcript

Claude Code now asks before a sandboxed Bash command runs. Until this release, the sandbox let those commands run without a prompt. One sandbox setting brings that back, for you or for a whole organization.
Slide text

Claude Code v2.1.325 now asks before sandboxed Bash commands run

Sandboxed Bash
follows the normal permission flow by default
Sandbox on through managed settings
the same change applies
Want no prompts
one sandbox setting keeps the old behavior

CHANGELOG.md · Claude Code v2.1.325
If you run work unattended, expect more prompts. Scheduled tasks and /loop now ask before running a skill that declares its own tools or hooks. An allow rule for that skill lets it run unattended.
Slide text

>Scheduled tasks and /loop can now stop and wait for you

Skills that declare allowed-tools or hooks
scheduled tasks and /loop ask before running them
Read-only git commands
ask first in a repository you haven't trusted

CHANGELOG.md · Claude Code v2.1.325
This release fixes a security issue in how Claude Code decodes responses compressed with zstd. It also closes two Bash gaps: some compound commands ran without asking, and an allow rule could run a different program than it names.
Slide text

>Fixed: a zstd security issue and two Bash permission gaps

zstd responses
a security issue in how they are decoded
Compound Bash commands
some ran without asking, and now they ask
Bash allow rules
one could run a different program than the one it names

CHANGELOG.md · Claude Code v2.1.325
A subagent cut off at its output limit is now asked for the whole answer again, more briefly, instead of returning only the end. And a subagent with its own model keeps that model under opusplan.
Slide text

>Subagents keep their own model and return the whole answer

Cut off at the output limit
asked for the whole answer again, more briefly
Model set to opusplan or haiku
a subagent with its own model keeps it
On a different model
file reads and MCP results sized for that model

CHANGELOG.md · Claude Code v2.1.325
On many third-party gateways and Foundry, a full session now compacts instead of failing every turn. Resuming after a crash keeps your recent turns. And background sessions on a claude.ai login stop billing an API key from your shell.
Slide text

>Fixed: sessions that failed every turn or lost recent turns

Third-party gateways and Foundry
compact instead of a context length error on every turn
Resumed sessions
recent turns kept after Claude Code stops without a clean exit
Background sessions on a claude.ai login
no longer billed to an API key from the shell

CHANGELOG.md · Claude Code v2.1.325
The Claude Code changelog names the sandbox setting and lists more than a hundred other changes. If you run Bash in the sandbox, expect permission prompts after you update.
Slide text

Every change is in the Claude Code changelog

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

CHANGELOG.md in anthropics/claude-code

Run Bash in the sandbox? Expect permission prompts after you update.

CHANGELOG.md · Claude Code v2.1.325