Claude Code 2.1.314 adds write fence, IdP groups, compaction

Claude Code 2.1.314, listed in Anthropic’s release notes on GitHub on October 30, adds a setting, permissions.blockWritesOutsideWorkingDirectories, that makes Write, Edit and NotebookEdit refuse any path outside the working directories in every permission mode. If your team needs an agent’s file edits to stay inside the project whatever mode a developer picks, this is the setting to turn on. Teams running the Claude apps gateway can now tie an upstream to identity-provider groups, and that rule holds on failover too.

Where the write fence stops

The setting covers three tools: Write, Edit and NotebookEdit. A shell command that writes somewhere else goes through Bash, and Bash isn’t on that list. That gap counts most in bypass mode. Since 2.1.311, Anthropic’s Daisy Hollman announced, one environment variable can switch off the last checks on commands like rm -rf ~, a change the 2.1.311 changelog itself does not list. The new fence keeps Claude’s file tools inside the project in that mode, but it only covers those file tools, so commands are still a matter for the sandbox and deny rules.

Three related changes in the same release tighten what the agent can touch:

• Claude’s file tools now ask before editing the local copy of your organization’s server-managed settings, as they already do for your own settings files.
• Sandbox protections now apply to a worktree entered by claude -p --resume or --continue. Before this fix they didn’t.
• A settings file excluded with --setting-sources could still supply some settings, such as auto mode rules and saved permission consents. That is fixed.

Hook authors get a matching change. Hooks that match Bash now run on shell commands started by the Monitor tool, and they can block or ask but cannot approve or rewrite those commands. An if condition such as Monitor(tail *) now matches Monitor’s shell commands the way Bash(tail *) matches Bash’s.

Upstreams by IdP group

The Claude apps gateway sits between Claude Code or Claude Desktop and the model provider. In AWS’s reference deployment, developers sign in through an OpenID Connect identity provider, and the gateway authenticates to Amazon Bedrock with its own IAM role, so no upstream credentials sit on developer machines. Upstreams can now take an optional groups list: only developers in the listed IdP groups are sent to that upstream, and failover respects the list.

Bedrock upstreams also get guardrail_trace. It logs which Amazon Bedrock guardrail filter fired on a request, without the text that matched.

Several fixes target traffic behind a gateway or a cloud provider. Model IDs written with a dot, such as claude-opus-4.8, were being treated as an older model with the wrong context window, output limit, effort, thinking mode and cost. When a gateway or provider refuses one of Claude Code’s beta headers by name, the request is now sent again without that header. Gateways that reject tool search’s tool_reference blocks get one retry without tool search, and the session remembers that. A Vertex upstream used to hang for minutes when a Google token endpoint accepted the connection and never answered; that is fixed too.

Idle compaction

In VS Code and the Code tab of Claude Desktop, a conversation of 200K tokens or more that sits idle is now summarized ahead of time. On your next message, Claude Code uses that summary if the prompt cache has expired. It also runs for subscribers who have telemetry turned off, and on Bedrock, Vertex, Foundry and LLM gateways once the one-hour prompt cache is on.

Compaction itself got two fixes. On Bedrock, sessions with many images used to fail every turn, and /compact failed with “400 Input is too long.”; Claude Code now removes older images and compacts. A PreCompact hook with very large output could make compaction fail or repeat, so each hook’s output is now cut at 10,000 characters.

Scripts and CI

When startup failed, claude -p used to exit with code 0 and print nothing. It now prints the error and exits 1, so a pipeline that read an empty, successful run as a pass will start failing. In a CI job that has a terminal, claude ultrareview and claude remote-control used to stop and ask the workspace trust question; with CI set, they now refuse an untrusted folder at once. And FORCE_HYPERLINK=false (also no and off) now turns hyperlinks off, where before it turned them on.

Admin caps and managed settings

Sessions where an admin caps a model’s effort no longer fail turn after turn with “Invalid effort level”: Claude Code lowers the effort, retries and says which level it is using. Flagged requests now retry on another model, where they used to end in a refusal, when ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels or deniedModels leaves only an older Opus model, or none.

The policy fix with the widest reach concerns forceRemoteSettingsRefresh. Set only in remote managed settings, it stopped applying once the stored copy had expired, which let sessions start without policy when the server could not be reached. In 2.1.314 that setting applies again.