Claude Code 2.1.314 hit npm today at 00:12 UTC, two days after 2.1.312. Version 2.1.313 never shipped publicly.
The headline is the first line of the changelog: permissions.blockWritesOutsideWorkingDirectories. With the setting on, Write, Edit and NotebookEdit refuse any path outside the working directories—in every permission mode, Auto and Bypass included. Until now that protection depended on which mode you were in. Now it depends on your config.
Compacting while nothing happens
The second addition is for long sessions. In VS Code and in Claude Desktop’s Code tab, a conversation over 200,000 tokens that you leave idle gets summarized in the background. If the prompt cache has expired by the time you type again, Claude Code uses that summary instead of the full history.
The same mechanism now covers subscribers with telemetry switched off, and Bedrock, Vertex, Foundry and LLM gateways once the one-hour prompt cache is on. If you have ever come back from lunch and waited through a compaction run, you will notice.
Bugs that cost whole sessions
Three fixes stand out because there was no way around them before:
- When an organization caps a model’s effort level, sessions failed turn after turn with “Invalid effort level.” Claude Code now lowers the effort itself, retries, and tells you which level it is using.
claude -pexited with code 0 and no output when startup failed. It now prints the error and exits 1.- On Bedrock, sessions with many images failed on “400 Input is too long.”, including
/compact. Older images are now dropped and the conversation compacted.
Smaller entries carry real weight too. A PreCompact hook with very large output is cut at 10,000 characters instead of making compaction fail or repeat. Background diff refreshes no longer grab the git index lock for a moment, which used to kill an unrelated git command with “Unable to create ‘.git/index.lock’”. And on macOS, git grep in most commands Claude runs now uses the C locale, because of a reported memory leak in the system regex library on files that are not valid UTF-8.
Gateway operators get two new fields: an optional groups list per upstream, so only developers in named IdP groups are routed there—on failover too—and guardrail_trace for Bedrock upstreams, which logs which Amazon Bedrock guardrail filter fired without recording the matched text.
The gaps in Auto mode are being closed
Lay the lines side by side and a pattern shows up. Write restrictions now hold regardless of mode. Sandbox protections apply inside a worktree that claude -p --resume entered. Hooks matching Bash now run on shell commands started by the Monitor tool. And a settings file excluded with --setting-sources no longer supplies auto mode rules anyway.
That is four places where a rule was not where you would have expected it. All four arriving in one release reads less like coincidence and more like the output of a review.