Claude Code 2.1.314: writes outside your directory get blocked, sandbox hardened

Claude Code 2.1.314, out October 30, 2026, is a dense release: sixteen improvements and eighty-one bug fixes in a single drop. Two threads run through it: isolation tightens further, with a new lock on writes outside your working directory and a closed sandbox gap, and context management keeps getting more automatic, with idle compaction leaving the terminal for VS Code and Claude Desktop.

Two more locks on files and the sandbox

An existing setting, permissions.blockReadsOutsideWorkingDirectories, could already force read tools to refuse any path outside your working directories, in every permission mode. 2.1.314 adds its write-side counterpart, permissions.blockWritesOutsideWorkingDirectories: turn it on and Write, Edit and NotebookEdit also refuse any path outside those directories, in manual, auto or bypass mode alike. The settings reference doesn't carry its own entry for the new key yet, but its read-side twin shows how it works: turn it on if you want a hard guarantee instead of a confirmation prompt, useful when a hook or subagent has its hands on paths you don't want touched by accident.

The second lock is smaller but real. The sandbox already protects certain paths by design, including inside a linked git worktree, where it allows shared writes to .git but still denies hooks/ and config inside it. 2.1.314 fixes a case where that protection didn't apply at all: a session resumed inside a worktree with claude -p --resume or --continue restarted without sandbox protections, a blind spot for anyone scripting session resumes on a working branch. If you automate that kind of resume, it's fixed with nothing to change on your end.

Idle compaction leaves the terminal

Automatic compaction of idle sessions has existed since 2.1.299: a conversation that passes 200,000 tokens and sits idle gets summarized before the prompt cache expires, so your next message doesn't reprocess the whole history. Until now, that only ran in the terminal. 2.1.314 extends it to the Code tab in VS Code and Claude Desktop: a conversation over 200,000 tokens left idle there gets summarized too, and the summary feeds your next message if the cache had time to expire in between. The same release also runs it for subscribers who turned telemetry off, and on Bedrock, Vertex, Foundry and LLM gateways once the one-hour prompt cache is on. The settings reference confirms the idleCompaction key turns this off in the terminal and both of these surfaces alike, and that the mechanism can spend tokens in the background even while you're typing nothing. In practice, if you leave a long session open in VS Code between tasks instead of closing it, expect to come back to part of its history already summarized, exactly as the terminal has done for two weeks.

The rest

A bug that broke every TLS connection with UNABLE_TO_GET_ISSUER_CERT, on a certificate store holding a renewed root cross-signed with its predecessor, is fixed: affected machines were losing access to Claude Code for a purely network reason. "Continue automatically at usage limit" no longer continues more than three times without your say-so when a task restarted itself between waits (a /goal check-in, a background or scheduled task). In auto mode inside Cowork cloud sessions, a hook's allow of an MCP tool call now counts as no answer, so the classifier or a permission prompt decides. In long headless and SDK turns that run many subagents, the parent session no longer keeps their tool results in memory until the turn ends. And claude -p no longer exits with code 0 and no output when startup fails: it prints the error and exits 1. The rest, the Claude apps gateway for enterprises, Claude Tag in Slack, VS Code shortcuts, is admin work or cosmetic.