Claude Code's October release run tightened the blast radius: workspace trust, sandboxed writes, and a fast-mode sunset
Looking back through Claude Code's release notes for October, the pattern across three releases — v2.1.309, v2.1.314, and v2.1.316 — isn't a new capability landing. It's the opposite: each one narrows what the tool will do without an explicit, separate signal that you meant it.
v2.1.309 (Oct 22): trust becomes a gate, not an assumption
The biggest change here is a breaking one: ultrareview now requires explicit workspace trust before it runs, meaning scripts invoking it need to pass --trust-workspace or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1 to opt out of the new check. The same release also changed how sed -i is handled: it's now routed through the standard Bash permission prompt like any other write, and — notably — is no longer something /rewind can undo. That second detail matters more than it might look: a destructive-ish in-place edit used to be something you could rewind away from if it went wrong; now it's treated as a real, standing-permission-worthy write that isn't automatically reversible, which is a more honest model of what sed -i actually does to a file.
v2.1.314 (Oct 30): writes outside the working directory become opt-in
This release adds permissions.blockWritesOutsideWorkingDirectories, a setting that makes Write, Edit, and NotebookEdit refuse any path outside the working directory, regardless of which permission mode the session is running under — including modes that would otherwise auto-approve. That "regardless of permission mode" clause is the part worth noting: it's not a prompt you can click through, it's a hard boundary that sits underneath the permission system rather than inside it. The same release also shipped idle-compaction, which automatically summarizes conversations that have grown past 200K tokens and then sat idle, rather than requiring a user to trigger compaction manually or hit a hard context wall mid-task.
v2.1.316 (Oct 31): a keyword gets an off-switch, and a model mode gets a sunset date
The smaller change is a new CLAUDE_CODE_DISABLE_ULTRATHINK environment variable, letting the "ultrathink" trigger keyword be disabled entirely in environments where you don't want a stray mention of it in user text changing model behavior. The larger change is a deprecation notice: Opus 4.8 fast mode was deprecated as of October 30, 2026, with removal scheduled for November 30, 2026 — after which fast-mode requests against Opus 4.8 will error outright rather than silently falling back to standard mode. Anthropic's stated recommendation is migration to Opus 5.5. A hard error instead of a silent fallback is the right call for anyone with fast-mode calls baked into automation — a silent behavior change that only shows up as "responses got slower" would be far worse to debug than a clear failure on a known date.
The throughline
None of these three releases add something Claude Code couldn't do before. What they do is make several previously-implicit trust decisions explicit: running ultrareview against a workspace, writing a file outside the project root, editing a file in place in a way you can't rewind, and depending on a specific fast-mode model path all now require a deliberate opt-in or come with an honest failure instead of a quiet one. For anyone running Claude Code in CI or any other unattended context, the practical takeaway is to audit for all four of these before the Opus 4.8 fast-mode removal date arrives, since that's the one change here with a hard deadline rather than an immediate effect.