Claude Code 2.1.281 adds Bedrock guardrails to its gateway

Claude Code 2.1.281 gives the Claude apps gateway two new options on Bedrock upstreams: it can call Amazon Bedrock under an IAM role it assumes, and it can apply an Amazon Bedrock guardrail to every request. Both are listed in the September 23 release notes on GitHub.

Most of the rest of the release covers sessions that run behind a proxy, sessions that get resumed, and destructive shell commands that turn up when nobody is watching.

How the gateway reaches Bedrock

The gateway is a self-hosted service that sits between developers’ Claude Code clients and the model provider, Anthropic’s documentation explains. Developers sign in through the corporate identity provider and never hold API keys or cloud credentials. The gateway holds the upstream credential, decides which models each IdP group may use, and sends usage telemetry to the company’s own observability stack. It ships inside the claude binary and starts with claude gateway --config gateway.yaml. Clients speak the Anthropic Messages API to it, and the gateway translates each request for the upstream it routes to: Bedrock, Claude Platform on AWS, Google Cloud’s Agent Platform, Microsoft Foundry or the Anthropic API.

In AWS’s reference deployment, the gateway authenticates to Bedrock with the IAM role assigned to its Fargate task.

The new assume_role option adds another way in. With it, the gateway calls Bedrock as an IAM role it assumes through STS, the AWS service that hands out temporary credentials. That role can live in another AWS account if needed, and the gateway can optionally open one session per developer.

The second option, guardrail: {id, version}, applies an Amazon Bedrock guardrail to every request sent through a Bedrock upstream. It comes with one rule: set it on all Bedrock upstreams or on none.

Three smaller gateway changes ship with it. telemetry.resource_attributes puts fixed labels on the telemetry of Claude Desktop and /login sessions. Desktop policy blocks now accept newer Claude Desktop keys, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode. And the gateway now refuses to start when a managedMcpServers entry’s envHelper path begins with \??\ or /??/, a path form that current Claude Desktop refuses to run.

Behind a proxy

Several fixes deal with responses that pass through a proxy or gateway. If a proxy closed the stream cleanly before the response was finished, Claude Code used to show the cut-off response as complete, with no warning, and duplicated stream events could make tool calls run twice. If a proxy dropped an event mid-response, the request failed with “Content block not found”. Now the partial response is kept, and web search keeps the results that had already arrived. A trailing usage-only frame could also lose the stop reason, and a proxy’s HTML 429 or 502 page was printed as raw markup or shown without its HTTP status.

Retries got fixes too. Sessions using CLAUDE_CODE_RETRY_WATCHDOG failed on the first 5xx or dropped connection after a run of 429/529 waits, and they slept silently, with no cap, on a long Retry-After from a 5xx. Fast mode retried rate-limited requests back to back when the server sent Retry-After: 0. The prompt cache was lost when an MCP server disconnected mid-conversation, or was still connecting after a resume, with tool search off. The notes give running behind a proxy or gateway as an example of that setup.

Resumed sessions

Resumed sessions sometimes re-sent earlier turns in a changed form: a parallel tool-call turn, for example, or an MCP tool call’s input while its server was still reconnecting. When that happened, the API could drop the conversation’s earlier reasoning. Restarting a session while a permission prompt was pending changed the history it sent, and that broke the prompt cache from then on. Sessions holding an advisor result the API could no longer read failed one request every turn. Now the history is repaired once.

A session that ended during a tool call now comes back with the call visible to Claude and a note that its outcome is unknown, and a manual resume no longer adds a hidden “Continue” message. Very large sessions no longer come back with only their last few messages. After a resume in a new process, auto mode’s permission classifier can reuse its earlier prompt cache rather than rewriting it.

What to change in existing setups

The new "attribution": false setting in settings.json hides all commit and PR attribution. Older CLI versions skip any settings file that contains it, so files shared across versions should keep the object form.

Self-hosted runners now pass system prompts to Claude Code as private files instead of command-line text, so large prompts no longer fail the launch. Any wrapper or command hook that appends --system-prompt or --append-system-prompt has to switch to --system-prompt-file or --append-system-prompt-file. The send-now shortcut (ctrl+enter or ctrl+x ctrl+s) now moves running tools to the background instead of cancelling the turn.

Auto mode and rm

Where auto mode’s classifier review runs on the server, read-only and sandboxed shell commands now wait for that review too, and are blocked when it flags them. CLAUDE_CODE_AUTO_MODE_SERVER, which already opted out on Bedrock, Vertex, Foundry and gateways, now applies on a direct Anthropic API connection as well. Setting it to 0 turns off the server-side classifier, and the local classifier then counts toward usage. Setting it to 1 turns it on. In the VS Code and JetBrains panels, a Continue/Stop prompt now appears when auto mode falls back to billed classifier requests, in place of a warning line that could not be answered.

Before this release, a recursive rm whose target was only command-substitution output, such as rm -rf "$(pwd)", ran without a prompt in auto mode and under --dangerously-skip-permissions. It now asks even when a Bash allow rule covers it, unless CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1 is set. The dangerous-rm check also flags a shell variable followed by a top-level directory name, a variable derived from the working directory, and a target made only of backslashes. A permission rule containing a NUL byte, which used to expand into a wildcard match, now matches nothing.

In both of those modes, the dangerous-rm prompt now waits two minutes for an answer. After that it denies the command and gives Claude a hint on how to rewrite it, so an unattended session keeps going, unless CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns the timeout off.