Claude Code 2.1.316: Opus 4.8 loses fast mode, two permission leaks closed

Claude Code 2.1.316, out October 31, 2026, packs ten additions, six changes, five improvements and thirty-four fixes. Three threads run through it: two permission guardrails that had a gap, a model whose fast mode is retiring with no fallback, and an input bug that cost you an extra press of Enter.

Two permission leaks closed

The first hits anyone behind a Claude apps gateway, the self-hosted deployment companies put in front of Bedrock, Vertex, or Foundry to filter which models developers can reach. The availableModels and deniedModels settings already existed to restrict which models a developer can pick, and to block specific ones even when an allowlist would otherwise permit them. The gap: the gateway wasn't consistently checking every model a request named against availableModels, deniedModels and models. A request could ask for a model that was supposedly blocked and get it anyway. 2.1.316 fixes that check: a request naming a blocked model now gets a 400 error naming the offending field. If your organization relies on these settings to actually keep developers off certain models, that wasn't a hard guarantee until now.

The second hits --restricted mode, built for shared machines where an evaluation harness drives Claude Code without letting it run commands. The docs say it confines file tools to the working directories and loads only managed settings and --settings. Until 2.1.316, a Read allow rule that covered a path outside those directories could still let the session upload files from that path, a hole in a mode whose entire point is to keep file access contained. It's fixed now: confinement to the working directories holds even when a broader Read rule exists. If you run --restricted sessions in a CI pipeline or a test harness, this closes an exit you probably didn't know was there.

Opus 4.8 loses fast mode, Enter stops waiting twice

Fast mode currently runs on three models, per the docs: "Fast mode runs only on Opus 5.5, Opus 5, and Opus 4.8." Opus 5.5 has already been the fast mode default since v2.1.280, and it's the cheapest of the three: $8/$40 per million input/output tokens, versus $10/$50 on Opus 4.8. 2.1.316 announces the end of that trio: fast mode for Opus 4.8 is deprecated as of October 30, 2026, and gets removed on November 30. There's no silent fallback planned: after that date, a fast-mode request on Opus 4.8 returns an error instead of quietly switching to standard mode. If you've got fastMode: true in your ~/.claude/settings.json and you're still on Opus 4.8, the changelog is direct about the fix: move to Opus 5.5 to keep the speedup. The docs still list Opus 4.8, which stays accurate until the November 30 removal, but they don't mention this deprecation yet even though they document the Opus 4.7 one: a lag worth watching, not a contradiction.

A smaller fix, this one. A prompt containing invisible characters used to need a second press of Enter to send. 2.1.316 fixes it: a plain text prompt now sends cleaned on the first Enter. Commands still wait for your review before they go through.

Everything else

On Bedrock and Vertex AI, asking for sonnet, opus, or haiku when the newest model isn't yet available to your account or region used to throw an error mid-session; Claude Code now falls back to an older model instead. An autoMode.allow list without a "$defaults" entry no longer strips out the built-in exception for scheduled-task prompts: until now, writing your own list of exceptions wiped that one out along with the rest. For Team and Enterprise accounts, server-managed settings now apply without a confirmation prompt, and a local copy that fails verification gets rejected instead of used as-is. CLAUDE_CODE_SUBAGENT_EFFORT sets a default effort level for subagents when nothing else names one, instead of having them inherit the main session's. In cloud sessions, a form request from an MCP server now shows up as a card you can fill in or decline, instead of being silently canceled. /model <id> now warns when the identifier isn't recognized by your version and auto-compact will assume a 200K context window by default. On macOS and Linux, shell commands no longer keep running when Claude Code exits on its own, for example after refused credentials or an archived cloud session. And on Windows, Grep and Glob stopped hanging forever when the search process got killed at the timeout but didn't actually exit. The rest of the release, gateway admin features (pooled group budgets, layered policies), VS Code, Claude Tag in Slack, self-hosted runners, is mostly administrative or cosmetic.