Claude Code's July Pivot: Background Agents Deliver PRs, Manual Mode Is the New Default

The first week of July 2026 produced more behavioral change in Claude Code than the entire previous month. Six releases — v2.1.197 through v2.1.204 — shipped between July 1 and July 8, and two of them rewrite how you should think about your daily agent workflow: background agents no longer pause at the finish line, they commit, push, and open a draft PR; and the permission model now defaults to Manual everywhere, meaning automation requires an explicit decision, not an absence of one.

Neither change is cosmetic. Together they define a new posture: Claude Code runs in the background, delivers work as reviewable PRs, and asks for your explicit sign-off before touching anything dangerous. This post covers every release in the wave, what actually changed, and how to reconfigure your workflow to take advantage of it.

The week in releases

Here is the sequence, compressed: v2.1.197 (July 1) made Claude Sonnet 5 the default model with its native 1M-token context and locked promotional pricing through August 31. v2.1.198 (July 2) shipped the auto-PR behavior for background agents and put Claude in Chrome into general availability. v2.1.200 (July 3) changed the default permission mode to Manual and stopped AskUserQuestion dialogs from auto-continuing. v2.1.202 (July 6–7) added the dynamic workflow size setting. v2.1.203 (July 7) swept through 25+ reliability fixes. And v2.1.204 (today) fixed hook event streaming in headless sessions.

Background agents now ship PRs

Before v2.1.198, a background agent running in a worktree would stop when it finished coding — it had done the work but left it sitting in a git worktree you hadn't looked at. In practice, most teams added a manual step at the end of every task: attach, verify, commit, push, open PR. Four actions that should not require a human.

From v2.1.198 onward, that sequence is automatic. When a background agent launched via claude agents completes a coding task in a worktree, it commits the diff, pushes the branch, and opens a draft PR — without pausing for confirmation. The draft PR is the delivery artifact. You review the PR, not the agent.

# Launch a background agent against a specific task
claude agents --task "Add pagination to the /skills API endpoint" \
  --worktree                  # isolate in a fresh git worktree
  --model claude-sonnet-5

# Agent runs, finishes, opens draft PR:
# https://github.com/yourorg/repo/pull/147  [DRAFT]
# Title: "feat(api): add cursor-based pagination to /skills"
# Branch: agent/pagination-skills-2026-07-08

Notification hooks: always know what your agents need

Also in v2.1.198: two new hook events — agent_needs_input and agent_completed — fire on the Notification hook. Wire these to desktop notifications, Slack, or any webhook to stop checking the terminal for agent status.

{
  "hooks": {
    "Notification": [
      {
        "matcher": "agent_needs_input|agent_completed",
        "hooks": [
          {
            "type": "command",
            "command": ".claude/hooks/notify.sh",
            "async": true
          }
        ]
      }
    ]
  }
}

#!/usr/bin/env bash
# Reads agent event JSON from stdin, sends a system notification
INPUT=$(cat)
EVENT=$(echo "$INPUT" | jq -r '.event // empty')
AGENT=$(echo "$INPUT" | jq -r '.agentDescription // "background agent"')

if [[ "$EVENT" == "agent_needs_input" ]]; then
  osascript -e "display notification \"$AGENT needs input\" with title \"Claude Code\""
elif [[ "$EVENT" == "agent_completed" ]]; then
  osascript -e "display notification \"$AGENT finished — draft PR open\" with title \"Claude Code\""
fi

On Linux, replace the osascript calls with notify-send. On Windows, use powershell -Command New-BurntToastNotification. The hook fires regardless of whether your terminal window is open.

Manual is the new default

This is the change with the longest tail. Until v2.1.200, the permission mode shipped under the label "default" — which in practice meant "auto-approve most things, ask about dangerous ones." From July 3, that mode is gone as the shipped default. The new default is Manual, which means every tool call that touches the filesystem or executes shell commands requires your approval unless you have an explicit allowlist rule.

The config key did not change — "defaultMode": "manual" or --permission-mode manual are both accepted, alongside the old "defaultMode": "default" which continues to work as an alias. What changed is which mode you get if you do nothing. If you were relying on the old "default" behavior for autonomous runs, you need to switch to "defaultMode": "auto" explicitly in your config.

Anthropic's rationale is legible: as background agents become more capable and more autonomous, the safe default is "ask," not "proceed." The auto-PR feature is powerful enough that gating it behind explicit opt-in is the right call. The v2.1.203 footer badge — a grey ⏸ symbol when in Manual mode — makes the active permission posture visible at a glance.

Dynamic workflow sizing

v2.1.202 adds a "Dynamic workflow size" setting in /config that controls how many agents Claude spawns when it builds a dynamic workflow. Three options: small, medium, and large. This is advisory — the model weighs it against the task complexity — but it prevents runaway fan-outs on simple tasks and unlocks more aggressive parallelism on large ones.

The same release wired workflow.run_id and workflow.name into OpenTelemetry spans, so if you are exporting traces to Datadog, Honeycomb, or any OTel collector, you can now correlate agent activity back to the specific workflow that spawned it.

The v2.1.203 reliability sweep

v2.1.203 is the release most teams will feel most acutely, even though it ships no new features. It resolved 25+ bugs, the majority targeting background agent stability. The three that matter most in practice:

• Stale daemon tokens — background sessions that went unresponsive to attach, replies, and stop because the daemon's session token expired now recover automatically without a restart.
• Worktree subagent wrong directory — worktree- isolated subagents were sometimes running shell commands in the parent checkout instead of their isolated worktree, corrupting both environments. Fixed.
• macOS memory detection regression — the false low-memory detection introduced in v2.1.196 was causing background sessions to stall for 15–20 seconds on macOS when resuming. Fixed with corrected memory sampling logic.

Wiring the async daily workflow

The July releases collectively describe a workflow pattern that did not exist cleanly before this week: dispatch agents in the morning, review PRs by afternoon. Here is how to wire it up.

{
  "defaultMode": "manual",
  "model": "claude-sonnet-5",
  "hooks": {
    "Notification": [
      {
        "matcher": "agent_needs_input|agent_completed",
        "hooks": [{ "type": "command", "command": "~/.claude/hooks/notify.sh", "async": true }]
      }
    ]
  }
}

# Start three background agents, each in an isolated worktree
claude agents --task "Migrate users table to UUID primary keys" --worktree
claude agents --task "Add OpenTelemetry spans to all API routes"  --worktree
claude agents --task "Write integration tests for /auth/refresh"  --worktree

# Each agent will:
#  1. Clone the repo into a fresh worktree
#  2. Implement the task
#  3. Commit, push, and open a draft PR
#  4. Fire agent_completed → desktop notification lands

# Later: open GitHub, review the three draft PRs, promote when satisfied

The key insight is that the worktree-per-agent pattern prevents conflicts even when three agents touch different parts of the same repo. Each agent has its own branch, its own working directory, and its own draft PR. You review three diffs independently. None of them know about the others.

If you want to install a skill that configures this entire setup in one step — notification hooks, Manual mode docs, and draft-PR-ready worktree patterns — the background-agent-pr-driver skill on skills-hub.ai covers it end to end.

npx @skills-hub-ai/cli install background-agent-pr-driver