Claude Code v2.1.314: Writes Outside Your Project Can Now Be Blocked in Every Mode

Version 2.1.314 (October 30) is a big one by line count: 6 additions, 15 changes, 16 improvements and 81 bug fixes, per the official changelog. I have not run it, so everything below is the changelog’s claim, not my measurement. The changelog also skips 2.1.313 entirely; I only found 2.1.312 and then 2.1.314.

The headline: a write fence that survives every mode

#

The new setting is permissions.blockWritesOutsideWorkingDirectories. When on, Write, Edit and NotebookEdit refuse paths outside the working directories “in every permission mode.”

That last clause matters. Until now, how far an agent could write depended heavily on the mode you were in and the allow rules you had accumulated. A fence that holds regardless of mode, including auto mode and bypass, is the kind of invariant you want when you run agents unattended. It is a cheap, declarative answer to “what if it edits ~/.ssh/config or a sibling repo?”

Two caveats from reading the changelog line closely:

• It names the file tools. Shell commands are a different surface. A Bash call can still write wherever the sandbox and your deny rules allow, so this complements the sandbox rather than replacing it.
• I have not verified how it treats additional directories you add with --add-dir. The wording says “working directories,” so presumably those count. Test before relying on it.

If you manage settings centrally, this is a good candidate for your managed baseline.

Hardening that arrives in the same release

#

Several other changes point the same direction:

• File tools now ask before editing the local copy of your organization’s server-managed settings, the same way they already do for your own settings files.
• /ultrareview checks workspace trust before it runs git, matching claude ultrareview. In CI, with CI set, claude ultrareview and claude remote-control now refuse an untrusted folder immediately instead of asking a question nobody can answer.
• The Bash tool’s shell clears an inherited which alias or function and stops passing exported which/unsetenv functions to commands. That closes a small way for a shell profile to change what a command resolves to.
• /permissions “Recently blocked” refuses to approve a call you cannot read in full, including one the terminal is too short to show. Approving something you cannot see is how prompt-injected commands get through.
• In Cowork cloud sessions, a hook’s allow of an MCP tool call now counts as no answer in auto mode, so the classifier or a permission prompt decides.
• Fixed: forceRemoteSettingsRefresh set only in remote managed settings stopped applying once the stored copy expired, which let sessions start without policy when the server was unreachable. That is a real policy gap, now closed.
• Fixed: sandbox protections did not apply to a worktree entered by claude -p --resume or --continue.
• Fixed: hooks matching Bash did not run on commands started by the Monitor tool. Such hooks can now block or ask, but not approve or rewrite those commands. Related, hook if conditions like Monitor(tail *) now match the way Bash(tail *) does.

If you rely on Bash hooks for policy, that Monitor fix is worth a look. Before it, a monitored command could sidestep them.

Idle compaction

#

VS Code and Claude Desktop’s Code tab now summarize a conversation of 200K+ tokens that has been left idle. The summary is used on your next message if the prompt cache has expired. Idle compaction also runs for subscribers with telemetry off, and on Bedrock, Vertex, Foundry and LLM gateways once the one-hour prompt cache is on.

The reasoning is cost. Return to a huge session after the cache expires and you pay to reprocess the whole thing. Compacting while idle lets the next message start from a smaller context. The tradeoff is the usual one with compaction: detail is lost in the summary. For long sessions you care about, keep decisions in a spec or CLAUDE.md, not only in the transcript.

Gateways, providers and model fallbacks

#

Several changes target enterprise setups:

• Claude apps gateway upstreams accept an optional groups list. Only developers in the listed IdP groups are sent to that upstream, on failover too.
• Bedrock upstreams gain guardrail_trace, which logs which Amazon Bedrock guardrail filter fired, without the matched text.
• Flagged requests now retry on another model instead of ending in a refusal when ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels or deniedModels leaves only an older Opus model, or none.
• Foundry sessions no longer fail when the resource has no deployment for the default Sonnet, Opus or Haiku model; Claude Code falls back to an older model in that family.
• Bedrock sessions with many images no longer fail every turn with “400 Input is too long”; older images are removed and compaction proceeds.
• Model IDs spelled with a dot behind a gateway, such as claude-opus-4.8, were treated as an older model with the wrong context window, output limit, effort and cost. Fixed.
• Sessions no longer fail turn after turn with “Invalid effort level” when an admin caps a model’s effort; Claude Code lowers the effort, retries, and says which level it uses.

The pattern across these is that gateway and cloud-provider setups are now a first-class path, and the failure modes people hit there (aliases, caps, missing deployments) are being fixed one by one.

Smaller items worth knowing

#

• claude -p used to exit with code 0 and no output when startup failed. It now prints the error and exits 1. If you script headless runs, that is a bug fix that can change your pipeline’s behavior for the better.
• FORCE_HYPERLINK=false (also no and off) now turns hyperlinks off instead of on.
• A PreCompact hook with huge output no longer breaks compaction; each hook’s output is cut at 10,000 characters.
• Subagent-heavy headless and SDK turns use less memory, because the parent no longer holds each subagent’s tool results until the turn ends.
• The bundled dataviz skill now answers pie and donut requests with ranked bars or a segmented bar that prints its values.
• Cloud sessions start even when a setup script exits with an error, instead of failing to start. Convenient, but check your setup script’s logs if you rely on it succeeding.

The takeaway

#

The write fence is the item to act on today. Agents become easier to trust when the limits are structural and independent of mode, not a pile of per-command approvals. Pair blockWritesOutsideWorkingDirectories with the sandbox, a deny list for secrets, and Bash hooks, and you have defense in depth that does not depend on someone clicking carefully. Then read the other 80 bug fixes, because several of them were policy gaps.

Sources

#

• Claude Code changelog, v2.1.314 (October 30, 2026)