1
00:00:00,280 --> 00:00:04,480
Righto, this is The Claude Code Changelog,
brought to you by Jellypod AI.

2
00:00:05,300 --> 00:00:08,940
Last time we talked managed settings and
subagent effort.

3
00:00:09,620 --> 00:00:15,140
Today it's the setting from version
2.1.314, released October 30th,

4
00:00:15,560 --> 00:00:17,900
that locks down the file boundary itself.

5
00:00:18,280 --> 00:00:22,420
It's called permissions dot
blockWritesOutsideWorkingDirectories.

6
00:00:23,788 --> 00:00:24,748
Here's what changed.

7
00:00:25,248 --> 00:00:30,068
When you turn it on, the Write, Edit and
NotebookEdit tools refuse any path outside

8
00:00:30,108 --> 00:00:31,108
your working directories.

9
00:00:31,608 --> 00:00:33,908
The changelog says in every permission
mode.

10
00:00:34,348 --> 00:00:38,588
That includes bypassPermissions and
dontAsk, the modes built to skip approval

11
00:00:38,628 --> 00:00:38,968
prompts.

12
00:00:39,468 --> 00:00:40,568
And it's not on by default.

13
00:00:40,828 --> 00:00:41,608
You have to opt in.

14
00:00:42,818 --> 00:00:43,538
Why does that matter?

15
00:00:44,258 --> 00:00:47,738
The dev dot to writeup from Raxxo Studios
puts it well.

16
00:00:48,338 --> 00:00:52,038
Permission modes were an approval
boundary, not a write boundary.

17
00:00:52,498 --> 00:00:53,978
Those are two different promises.

18
00:00:54,678 --> 00:00:57,998
acceptEdits and bypassPermissions skip the
question.

19
00:00:58,558 --> 00:01:02,758
Neither one, before this release, stopped
an edit landing outside the folder you

20
00:01:02,838 --> 00:01:05,678
opened, as long as your OS user could
write there.

21
00:01:06,218 --> 00:01:09,678
That's my reading of the writeup, not a
line from the changelog itself.

22
00:01:10,870 --> 00:01:12,970
And it bites hardest when nobody's
watching.

23
00:01:13,390 --> 00:01:17,690
Think of a headless run, a CI job, or a
scheduled cloud session going overnight.

24
00:01:18,230 --> 00:01:20,850
You've picked a loose mode so it doesn't
stall on prompts.

25
00:01:21,430 --> 00:01:24,010
Now there's no human to notice an edit to
the wrong place.

26
00:01:24,730 --> 00:01:28,990
Classmethod, the Japanese dev blog, says
it suits people who use bypassPermissions

27
00:01:29,050 --> 00:01:33,210
in CI or headless runs but still want file
editing confined to the working

28
00:01:33,250 --> 00:01:33,810
directories.

29
00:01:34,170 --> 00:01:34,950
That's the use case.

30
00:01:35,742 --> 00:01:37,262
Using it is dead simple.

31
00:01:37,802 --> 00:01:41,182
In your settings dot json, add a
permissions block with

32
00:01:41,262 --> 00:01:44,642
blockWritesOutsideWorkingDirectories set
to true.

33
00:01:45,262 --> 00:01:49,742
That works in your user settings, or in
the project's claude folder if you want the

34
00:01:49,782 --> 00:01:50,682
whole team to get it.

35
00:01:51,523 --> 00:01:53,263
You can also pass it on the command line.

36
00:01:53,703 --> 00:01:55,343
Classmethod does this in their testing.

37
00:01:55,743 --> 00:01:59,143
You give the settings flag a JSON string
with that same permissions block,

38
00:01:59,203 --> 00:02:01,243
so it's one command, no file edits.

39
00:02:01,823 --> 00:02:03,303
For a CI step, that's handy.

40
00:02:03,763 --> 00:02:06,823
Run claude with the settings flag, set the
setting to true,

41
00:02:07,063 --> 00:02:09,023
and keep your permission mode as loose as
you like.

42
00:02:09,463 --> 00:02:11,643
The mode decides when Claude asks.

43
00:02:12,003 --> 00:02:14,063
The setting decides where it's allowed to
write.

44
00:02:14,715 --> 00:02:18,835
Now the caveats, because a boundary people
overtrust is worse than none.

45
00:02:19,575 --> 00:02:21,435
First, read the wording closely.

46
00:02:21,875 --> 00:02:26,295
The changelog names three tools: Write,
Edit and NotebookEdit.

47
00:02:26,895 --> 00:02:27,735
That's what it promises.

48
00:02:28,375 --> 00:02:31,515
It doesn't say it covers a shell command
run through the Bash tool,

49
00:02:32,035 --> 00:02:35,355
so don't assume a redirect in a bash
command is stopped by this.

50
00:02:35,935 --> 00:02:38,715
If you need that covered, look at your
sandbox and your hooks.

51
00:02:39,523 --> 00:02:42,403
Second, the boundary is your declared
working directories.

52
00:02:42,903 --> 00:02:46,943
If your task legitimately edits a sibling
package, and that folder isn't one of your

53
00:02:46,983 --> 00:02:49,163
working directories, the edit gets
refused.

54
00:02:49,783 --> 00:02:53,103
Add it as an additional directory first,
with the add dir flag.

55
00:02:53,683 --> 00:02:57,323
Test that on a real task before you push
the setting into an unattended pipeline,

56
00:02:57,703 --> 00:02:59,603
so the first refusal isn't at three in the
morning.

57
00:03:00,012 --> 00:03:05,832
Worth a mention, 2.1.316 landed the next
day and fixed something nearby.

58
00:03:06,452 --> 00:03:11,152
Sessions started with the restricted flag
were uploading files from outside the

59
00:03:11,212 --> 00:03:14,492
working directories when a Read allow rule
covered them.

60
00:03:14,952 --> 00:03:17,572
So if you lean on boundaries, stay
current.

61
00:03:18,312 --> 00:03:21,592
A few smaller things from 2.1.314.

62
00:03:22,072 --> 00:03:27,992
If you use print mode, claude with the p
flag, in CI: a run that failed at startup

63
00:03:28,072 --> 00:03:30,712
used to exit with code zero and print
nothing.

64
00:03:31,292 --> 00:03:33,832
Now it prints an error and exits with code
one.

65
00:03:34,372 --> 00:03:38,972
So any pipeline that judges success by
exit code may start showing failures it was

66
00:03:39,032 --> 00:03:39,892
hiding before.

67
00:03:40,312 --> 00:03:42,012
That's a good thing, but know it's coming.

68
00:03:42,888 --> 00:03:44,128
Hooks got tighter too.

69
00:03:44,688 --> 00:03:49,228
Hooks matching Bash didn't run for shell
commands launched by the Monitor tool.

70
00:03:49,808 --> 00:03:54,448
Now they do, and they can block or ask,
though they can't approve or rewrite the

71
00:03:54,508 --> 00:03:54,968
command.

72
00:03:55,628 --> 00:04:01,988
A hook condition like Monitor with tail
star now matches the way Bash with tail star

73
00:04:02,048 --> 00:04:02,328
does.

74
00:04:03,220 --> 00:04:03,620
Two more.

75
00:04:04,300 --> 00:04:08,260
Idle compaction reached VS Code and the
Claude Desktop Code tab.

76
00:04:08,780 --> 00:04:12,640
A conversation past 200K tokens that sits
idle gets summarized,

77
00:04:13,040 --> 00:04:17,300
and the summary is used on your next
message only if the prompt cache has expired.

78
00:04:18,060 --> 00:04:22,960
And the Bash tool's shell now clears any
inherited which alias or function,

79
00:04:23,420 --> 00:04:27,600
so which resolves to the real command, not
whatever your dotfiles redefined.

80
00:04:28,532 --> 00:04:29,372
So the takeaway.

81
00:04:29,872 --> 00:04:34,312
Update, open your settings, and add that
one line to anything running in a loose

82
00:04:34,372 --> 00:04:36,172
mode, especially unattended.

83
00:04:36,732 --> 00:04:40,932
Five minutes, and your file boundary stops
depending on a prompt nobody's there to

84
00:04:41,032 --> 00:04:41,312
answer.