Claude Code 2.1.314 can block file writes outside the working directories

The release notes list a new setting, permissions.blockWritesOutsideWorkingDirectories. With it on, the Write, Edit and NotebookEdit tools refuse paths outside the working directories "in every permission mode." The notes name those three tools and say nothing about Bash, and they do not state the setting's default.

Two fixes in the same release touch the same boundary. Sandbox protections were not applying to a worktree entered by claude -p --resume or --continue; that is now fixed. And hooks matching Bash were not running on shell commands started by the Monitor tool. The notes say such hooks can now block or ask, but not approve or rewrite those commands.

The release also adds idle compaction in VS Code and Claude Desktop's Code tab: a conversation of 200K or more tokens left idle is summarized, and the summary is used on the next message if the prompt cache has expired. A later line in the notes says idle compaction also runs for subscribers with telemetry turned off, and on Bedrock, Vertex, Foundry and LLM gateways once the one-hour prompt cache is on.

Why it matters: For anyone running agents unattended, this is a configuration-level bound on where the file tools can write, and it holds even in permission modes that skip prompts. It is not a full sandbox: the notes cover three file tools, so shell commands still need their own controls. The worktree and Monitor fixes are worth checking against any setup that resumes headless sessions or relies on Bash hooks as a gate.