Claude Code v2.1.314: Write Blocking, Wider Idle Compaction

Claude Code v2.1.314 has 119 changelog entries: 81 fixes, 16 improvements, 13 changes, 6 additions, and 3 updates. It adds a setting that keeps Claude’s file-editing tools inside the working directories, brings idle compaction to VS Code and Claude Desktop’s Code tab, and gives Claude apps gateway administrators IdP-group routing and Bedrock guardrail tracing. The fixes range across model and provider reliability, permissions and hooks, sign-in, the terminal, VS Code, cloud sessions, and Claude Tag. Several entries change what an existing setting, variable, or hook rule does, so if you manage Claude Code for an organization, or run it on Bedrock, Vertex, Foundry, or behind an LLM gateway, read the changed-behavior section before you update.

What’s New

Block Writes Outside the Working Directories

The new permissions.blockWritesOutsideWorkingDirectories setting makes the Write, Edit, and NotebookEdit tools refuse paths outside the working directories, in every permission mode. The entry names only those three tools; it does not say the setting covers shell commands. For background on permission modes, see our Permission Models & Security tutorial.

Idle Compaction in VS Code and Claude Desktop

In VS Code and in Claude Desktop’s Code tab, a conversation of 200K or more tokens that is left idle is now summarized, and the summary is used on your next message if the prompt cache has expired by then. A separate change, listed under Changed Behavior below, also runs idle compaction for subscribers with telemetry turned off, and on Bedrock, Vertex, Foundry, and LLM gateways once the one-hour prompt cache is on. Our v2.1.299 release notes cover idle compaction in the terminal.

Gateway Upstream `groups` and Bedrock `guardrail_trace`

Two additions are for Claude apps gateway administrators:

groups is an optional list on gateway upstreams. Only developers in the listed IdP groups are sent to that upstream, and that holds on failover too.
guardrail_trace on Bedrock upstreams logs which Amazon Bedrock guardrail filter fired on a request, without the matched text.

The other two additions, an Include completed button for scheduled tasks and a link to the Claude Tag API docs in admin settings, are covered in the cloud sessions and Claude Tag sections.

Models, Providers, and Gateways

These fixes concern models, cloud providers, gateways, and connections:

Admin effort caps. When an organization’s admin capped a model’s effort, sessions failed turn after turn with “Invalid effort level”. Claude Code now lowers the effort, retries, and says which level it uses. Our effort levels guide explains what effort controls.
Bedrock sessions with many images. They failed every turn, and so did /compact, with “400 Input is too long.” Claude Code now removes older images and compacts.
Microsoft Foundry without a default deployment. Sessions failed when the resource had no deployment for the default Sonnet, Opus, or Haiku model. Claude Code now falls back to an older model of that family.
Beta headers refused by name. When a gateway or cloud provider refuses one of Claude Code’s beta headers by name, the request is now sent again without it.
Tool search behind gateways. Behind a gateway that doesn’t accept tool search’s tool_reference blocks, requests were refused repeatedly. The request is now sent once more without tool search, and the session remembers.
Dotted model IDs. Behind an LLM gateway, a model ID spelled with a dot, such as claude-opus-4.8, was treated as an older model with the wrong context window, output limit, effort, thinking mode, and cost.
Vertex token endpoints. A Claude apps gateway Vertex upstream hung for minutes when a Google token endpoint accepted the connection and never answered.
Unrecognized model names. --resume, and rewinding past a switch to another model after a refusal, moved a session on a model name Claude Code doesn’t recognize to a different model.
Cross-signed root certificates. TLS connections failed with UNABLE_TO_GET_ISSUER_CERT when the system certificate store held a renewed root certificate cross-signed with its predecessor.

Headless Runs, CI, and Scripts

claude -p startup failures. When startup failed, claude -p exited with code 0 and printed nothing. It now prints the error and exits with code 1.
Workspace trust in CI. In a CI job that has a terminal, claude ultrareview and claude remote-control asked the workspace trust question. With CI set, they now refuse an untrusted folder at once. Separately, /ultrareview now checks workspace trust before it runs git, as claude ultrareview does.
Git index lock. Background diff refreshes briefly took the repository’s index lock, so a git command run at the same moment could fail with “Unable to create ‘.git/index.lock’: File exists”.
Stream-json hosts. Prompts containing tags such as <bash-stdout> or <local-command-stdout> were not acknowledged to a local stream-json host.
Memory with many subagents. In long headless and SDK turns that run many subagents, the parent session no longer keeps each subagent’s tool results until the turn ends.

Permissions, Sandbox, Hooks, and Settings

Sandbox in resumed worktrees. Sandbox protections did not apply to a worktree entered by claude -p --resume or --continue; they now do.
Hooks on Monitor commands. Hooks matching Bash did not run on shell commands started by the Monitor tool. They now do; such hooks can block or ask, but cannot approve or rewrite those commands. A related change to hook if conditions is listed under Changed Behavior. For hook basics, see our Hooks System tutorial.
--setting-sources exclusions. A settings file excluded with --setting-sources still supplied some settings, such as auto mode rules and saved permission consents.
forceRemoteSettingsRefresh. When set only in remote managed settings, it stopped applying once the stored copy had expired, which let sessions start without policy when the server could not be reached.
Other managed settings. An administrator’s TLS trust settings in managed settings were not applied in Claude Desktop sessions. The Bedrock and Vertex model upgrade offer came back at every start when managed settings pinned the model. On machines with managed plugin settings, model switching was refused when one of your own --plugin-dir or --plugin-url plugins had a broken manifest or failed to download.
Auto mode verdicts. Auto mode reported a call as blocked, and listed it in /permissions, when its safety check gave no verdict. Separately, shell and MCP calls that auto mode, a deny rule, or a PreToolUse hook blocked, or that otherwise did not run, read as if they had run in a collapsed tool group.
PreCompact hook output. A PreCompact hook with very large output could make compaction fail or repeat. Each hook’s output is now cut at 10,000 characters.
sandbox.excludedCommands description. It said listed commands always run outside the sandbox; it now says every command in a call must match an entry.
Clearer blocks and prompts. These three are improvements. Auto mode’s messages for blocked calls now name the command, say Claude may retry and auto mode checks again, and point to /permissions to review. The /permissions review tab is now called Recently blocked, and its footer says what Esc will do with marked rows. A long reason in a permission prompt takes fewer rows, so it pushes the command being approved off the screen on fewer terminals.

Changed Behavior Worth Noting

These entries change what an existing setting, variable, rule, or command does:

FORCE_HYPERLINK=false now turns hyperlinks off. The values false, no, and off used to turn hyperlinks on.
which in the Bash tool. The Bash tool’s shell now clears any inherited which alias or function and stops passing exported which or unsetenv functions to commands, so which is the system command or the zsh builtin.
Hook if conditions match Monitor commands. A condition such as Monitor(tail *) now matches the Monitor tool’s shell commands the way Bash(tail *) matches Bash’s.
Flagged requests retry on another model. When ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels, or deniedModels leaves only an older Opus model, or none, a flagged request now retries on another model instead of ending in a refusal.
Idle compaction in more setups. It now also runs for subscribers with telemetry turned off, and on Bedrock, Vertex, Foundry, and LLM gateways once the one-hour prompt cache is on.
Recently blocked approvals. /permissions Recently blocked now refuses to approve a call you can’t read in full, including one the terminal is too short to show.
Server-managed settings. Claude’s file tools now ask before editing the local copy of your organization’s server-managed settings, as they do for your settings files.
claude -p exit code. A run that fails at startup now exits 1 with an error instead of 0 with no output, as described above.
Hook allows in Cowork cloud sessions. In auto mode in Cowork cloud sessions, a hook’s allow of an MCP tool call now counts as no answer, so the classifier or a permission prompt decides.
Cloud session setup scripts. Cloud sessions from the web, desktop, and mobile apps now start even when a setup script exits with an error, instead of failing to start.
CLAUDE_CODE_DISABLE_CFC_PROMPT in VS Code. The variable now also stops the extension adding the Claude in Chrome instructions to a session’s messages; the browser tools stay available.
Trash folders are capped. ~/.claude/skills/.trash and ~/.claude/plugins/.trash used to grow without limit; each now holds about 1024 entries, whatever cleanupPeriodDays says.
git grep on macOS. In most commands that Claude runs, git grep now uses the C locale, to avoid a reported memory leak in macOS’s regex library on files that aren’t valid UTF-8.

MCP servers that also work without sign-in showed “needs authentication” after their stored sign-in stopped working. They are now used signed out.
claude mcp logout reported success when the MCP sign-in was not removed, for example while the macOS keychain was locked over SSH. In VS Code, “Clear authentication” for MCP servers also reported success when the saved sign-in could not be removed; that is fixed too.
Several sessions sharing an Anthropic profile login no longer cause extra sign-in renewals when the credentials lock is busy.
/upgrade no longer opens the browser and starts a new login for plans billed through the App Store or Google Play; it now says where to change the plan.
While a request refused for your claude.ai login is still being retried, the cloud session error now also suggests claude auth login.
/context is faster in sessions with ten thousand or more MCP tools.
The changelog also lists an improvement to how stored claude.ai, Team, and Enterprise logins behave when MDM and remote settings differ on base URL or apiKeyHelper, without detailing the new behavior.
Remote Control. claude remote-control sessions that failed to start when the session service was slow for a moment now retry the worker’s registration with growing waits. Model switches that take over 8 seconds now return the final result instead of a “still pending” error. The permission mode button showed the wrong mode until you typed; while your computer is online, it now shows the real mode on open. Clients no longer show a stray “Compacted (ctrl+o to see full summary)” row after /compact.

Sessions and Usage Limits

Auto-continue at the usage limit. “Continue automatically at usage limit” could continue more than three times without a prompt from you when a task restarted itself between waits, such as a /goal check-in or a background or scheduled task.
Ultracode stays off. Background and cloud sessions started with Ultracode turned it back on at their next start after it had been switched off.
Unparseable tool calls. After Claude gave up on a tool call that could not be parsed, the last broken reply and its retry prompts stayed in the conversation.
Resume and titles. --resume is faster and uses less memory on damaged transcripts. A session that starts with a skill or a prompt-based command such as /security-review now gets a title from it, and sessions no longer stay untitled when the first prompt failed (for example on a usage limit) and the conversation continued. The /resume picker no longer shows the text of CLAUDE.md or CLAUDE.local.md as the title of a session that only ran slash commands, and a deleted session no longer reappears in the resume list as an almost empty entry, which happened in rare cases.
Skill trash. The skill file watcher no longer checks every removed skill kept in ~/.claude/skills/.trash, which added file system load that grew with each removal. The new cap on that folder is under Changed Behavior.
Background sessions that fail to start are no longer reported as a deleted daemon binary when the binary is still on disk.

Terminal and Editing

Streaming tables. Markdown tables no longer jump between grid and stacked layouts on half-typed rows while streaming, and long tables no longer fall back to raw pipes.
Vim mode. dw, dW, yw, and yW no longer carry on past the end of the line, and w and W now stop on empty lines. p over a character selection now respects whether the yanked text was whole lines, and aw and iw no longer take the line break at the end of a line.
Pasting. Pasted text and dragged-in files were lost in Claude’s question dialog unless the “Other” row had focus, and pasted text was lost when a row in the prompt footer was selected; both are fixed. Ctrl+R prompt history now matches text inside collapsed [Pasted text] pills. Pasting an image over SSH to a Linux machine used to do nothing, silently; the prompt now says to copy the file over and paste its path.
Agents and subagents. In the agent panel, x and Enter sometimes acted on the wrong agent when another agent started or finished. /btw asked from a subagent’s open transcript answered from the main conversation, and Esc on a command’s panel, such as /btw, also interrupted the subagent whose transcript was open. In fullscreen mode, the welcome header showed the session’s model while you viewed a subagent or teammate that runs on a different model.
Session names. The name from /rename no longer disappears while Claude asks for permission or a plan decision, so side-by-side sessions stay identifiable.
CRLF diffs. The Bash edit diff listed a whole file as changed when a CRLF file under git’s line-ending conversion was re-saved unchanged or had one line edited.

VS Code

Besides idle compaction and the CLAUDE_CODE_DISABLE_CFC_PROMPT change above, the extension gets these fixes:

The spinner and Stop button were missing while a queued message’s hooks ran.
Session group changes that cannot be saved, such as a delete, failed silently; an error notification now appears.
Cmd+F / Ctrl+F did not open the find widget in the plan preview tab.
The voice dictation shortcut (Ctrl+D) did nothing under non-Latin keyboard layouts such as Russian, Greek, or Hebrew.
Missed one-time saved scheduled tasks were deleted without asking when the extension opened without a chat.

When you stop a command with Esc or Stop in the IDE or a cloud session, Claude is now also told that the command may have run, not only that it was declined.

Cloud Sessions and Self-Hosted Runners

Setup scripts. A setup script that exits with an error no longer stops a cloud session started from the web, desktop, or mobile apps (see Changed Behavior).
Scheduled tasks. Runs in Anthropic’s cloud now load the plugins enabled on your claude.ai account. The Scheduled tasks page gains an Include completed button when finished one-off tasks are the only ones hidden, so you can show them without opening the Sort menu.
WebFetch and long PDFs. In Cowork cloud sessions, WebFetch silently dropped a PDF’s text past 100,000 characters; it now says how much was unread and where to read on.
Unrequested model calls. A resumed claude.ai cloud session made a model call nobody asked for when the previous worker stopped just after receiving a new chat’s files.
Phantom uncommitted changes. Cloud sessions reported uncommitted changes every turn after Claude moved a branch to a commit it had pushed from another worktree.
Permission mode picker. It stayed on Auto after a running cloud or Remote Control session refused the switch; it now shows the mode in use and tells you.
Admin settings and transcripts. Test connection for GitHub Enterprise now also connects the way cloud sessions do, and warns you when that second test fails. The self-hosted environment details dialog now scrolls instead of squeezing its content out of view in very short windows or at high zoom, and recently used self-hosted environments now appear among the recent environments on the new session card. In transcripts, a rename row now names the new title, and repository and environment lists show as a table instead of one line of JSON.
Self-hosted runners. An idle session moved to another runner instead of pausing when the runner’s request to pause it lost its connection before Anthropic answered. The error for a session branch that isn’t on the git remote now covers a never-pushed branch, says how to fix each case, and no longer suggests retrying.

Claude Tag

@Claude !restart gave up after one failed workspace check in channels shared across Enterprise Grid workspaces; it now retries, then asks you to run it again.
Claude sometimes did not answer a tag in its own thread in Slack Connect channels where both organizations have installed Claude.
While Claude’s session waits for a self-hosted runner, Claude now posts a wait notice in the thread, instead of follow-up messages showing no sign of progress.
Connecting your Claude account from Slack twice from the same link within a few minutes no longer sends a second confirmation DM and channel note.
In admin settings, Enterprise organizations with Slack connected get a dismissible link to the Claude Tag API docs on the Bundles and Channels tabs. Retry on plugin and skill pages now keeps your unsaved access changes after a failed load, and the repositories control no longer shows the same action twice.

Bundled Skills

/claude-api. Its Datadog setup for API tracing now sends the dd-llmobs-enabled: true header, as the Console does, and its ant install instructions drop the outdated macOS xattr step. The skill also now asks to read a Managed Agents workflow run’s workflow before changing the agent to improve that run.
dataviz. The bundled dataviz skill now advises printing y-axis tick labels in full under 10,000, and horizontal ones in full under a million where they fit. It answers donut and pie chart requests with ranked bars or a segmented bar that prints its values.
/design-sync. The upload prompt now shows the folder, the project, and the files it will upload or delete.

A few minor entries, mostly display and wording fixes, are not listed here. The full list is in the official changelog.

How to Update

Check your installed version: claude --version
Update in place: claude update