Ing. Calogero Bono
Anthropic has published version 2.1.314 of Claude Code on GitHub. Claude Code is the tool that works on code from the terminal, from VS Code and from Claude Desktop. The most concrete change is a new permission setting that stops Claude from writing files outside the working folders. The rest is a long list of fixes, many aimed at people who use Claude Code inside a company, with gateways, cloud providers and centralized rules. The security and management details matter because they decide whether a tool like this gets adopted by a team.
A few terms before we get into the facts. A gateway is an intermediate server that sits between developers and models, and lets a company control who uses what. An IdP (identity provider) is the system that manages identities and user groups. Bedrock, Vertex and Foundry are the cloud services from Amazon, Google and Microsoft through which you can use the models. A compaction is the summary of a long conversation, so that the model's memory does not fill up. A hook is a script that runs at a precise moment, for example before a command.
What does the block on writes outside the folder do?
According to the release notes in the official Claude Code repository, the new setting is called permissions.blockWritesOutsideWorkingDirectories. When it is enabled, the Write, Edit and NotebookEdit tools refuse paths that lie outside the working folders, in every permission mode.
The final detail is the one that matters. Until now, even with strict rules, the behavior depended on the mode you chose. The notes say the refusal applies in every mode, including when the user has chosen to give the agent more freedom. The name of the option makes clear that it is optional and must be turned on.
Some fixes on the sandbox follow the same line. The description of sandbox.excludedCommands said that the listed commands always run outside the sandbox, while it now specifies that every command in a call must match an entry. Also, the sandbox protections did not apply to a worktree opened with claude -p --resume or --continue, and now they do. Another fix concerns a settings file excluded with --setting-sources that kept supplying some settings, such as auto mode rules and consents already saved.
What changes for the gateway and for administrators?
The gateway for Claude apps gets a new feature designed for organizations. Each upstream, meaning each destination to which the gateway routes requests, can have an optional list of groups. Only developers in the listed IdP groups are sent to that upstream, including during failover, meaning when the gateway switches to an alternative after a failure.
For Bedrock upstreams there is guardrail_trace. It records which Amazon Bedrock guardrail filter triggered on a request, without saving the text that set off the filter. It is a useful trade-off for anyone who needs to understand why a request was blocked without keeping sensitive data in the logs.
Several fixes concern settings managed by administrators.
- TLS settings defined by an administrator were not applied in Claude Desktop sessions, and now they are.
- With forceRemoteSettingsRefresh set only in the remote settings, an expired saved copy was no longer applied. Sessions could start without policies if the server was unreachable.
- On machines with managed plugins, the model switch was refused if a personal plugin had a broken manifest or a failed download.
- If an administrator limits the effort level of a model, Claude Code lowers the effort, retries and says which level it is using. Before, sessions failed on every turn.
A Vertex upstream on the gateway could also hang for minutes when a Google token endpoint accepted the connection without responding. This is fixed too.
Which fixes concern Bedrock, Foundry and Vertex?
The release contains many changes for people who do not use the Anthropic APIs directly.
Bedrock
Bedrock sessions with many images failed on every turn, and so did /compact, with an input-too-long error. Claude Code now removes the oldest images and compacts. Another fix concerns the model upgrade offer on Bedrock and Vertex, which came back at every startup even when managed settings blocked the model.
Microsoft Foundry
Sessions failed when the resource had no deployment for the default Sonnet, Opus or Haiku model. Claude Code now falls back to an older model from the same family.
Third-party gateways
If a gateway does not accept tool_reference blocks from tool search, the request is resent once without that feature, and the session remembers it. The same applies when a gateway or provider rejects one of the Claude Code beta headers by name, with a new send that leaves out that header. Model IDs written with a dot, such as claude-opus-4.8, were treated as an older model, with the wrong context window, output limit, effort, reasoning mode and cost. This is no longer the case.
On the certificate side, TLS connections failed with UNABLE_TO_GET_ISSUER_CERT when the system store contained a renewed root certificate cross-signed with its predecessor. This is also fixed.
What changes in everyday use?
For people who write code, the visible change is the idle compaction in VS Code and in the Code tab of Claude Desktop. A conversation of more than 200K tokens left idle is summarized, and the summary is used for the next message if the prompt cache has expired.
Then there is a series of fixes for the terminal and CI.
- claude -p exited with code 0 and no output if startup failed. It now prints the error and exits with 1, which matters for scripts.
- claude ultrareview and claude remote-control no longer ask the folder trust question in a CI job with a terminal. With CI set, they refuse an untrusted folder right away.
- A PreCompact hook with very large output made compaction fail or repeat. Each hook's output is now cut to 10,000 characters.
- Background diff updates briefly took the repository index lock, which could make a git command run at the same moment fail.
- Hooks that intercept Bash did not fire on commands started by the Monitor tool. They now fire, but they can block or ask for confirmation, not approve or rewrite those commands.
The rest is interface polish, including markdown tables, vim mode, agent selection, pasting text and images, session titles and permission dialogs.
Limits to know
The release notes we have are cut off at the end, so we cannot rule out other entries. We do not have the publication date, and there is no extended documentation for the write setting. We do not know whether it is on by default, and the text suggests it is not. We also do not know exactly how a working folder is defined, for example with symbolic links or linked repositories.
These are statements from the vendor, not independent tests. A block on write tools says nothing about what a shell command can do, which follows the sandbox rules. The sentence about hooks on Monitor should also be read with care, because it changes what a hook can promise.
What changes for people who work in digital
If you manage a team, the first thing to do is read the list and work out which fixes affect your case. Those who use Bedrock with many images, Foundry with partial deployments or a corporate gateway will find direct fixes. Those who work alone on the basic plan will mainly see the idle compaction and the polish.
For an agency or a software house, the write rule is a point to bring to clients. It shows that an agent can be confined to the project, which is useful when several repositories or configuration files sit on the same computer. The core principle still holds, namely that an agent should be treated as a collaborator with minimal access. We saw it in the case of the trojanized Claude Code extension on Cursor with an SSH backdoor, where the risk came from the tool's surroundings.
If you run scripts with claude -p in CI, double-check the exit codes. An error that used to pass as a success will now stop the pipeline, which is the right behavior but can be surprising. If you also run development environments on your own servers, remember that the machine matters too, which is why you need managed servers with security updates.
Our take
This release says a lot about where programming agents are right now. There are few new features, while most of the work is fixes for edge cases, proxies, certificates, policies and fallbacks. It is a sign of a tool leaving the laptop of the individual developer and entering contexts where nothing can be ambiguous.
The block on writes outside the folder is the right choice, but it leaves two doubts. The first is that it is optional. A protection you must know about to enable mainly protects people who are already careful. The second is that permissions needed so many fixes, among excluded settings that kept applying and hooks that did not fire. This is no fault in itself, but it is a reminder that controls must be verified and not taken for granted.
The question of who checks the generated code remains. A more confined agent does not replace human review, which is why pull request and code review practices on GitHub and AI tools for code review stay useful.
Frequently asked questions
What does permissions.blockWritesOutsideWorkingDirectories do?
It makes Write, Edit and NotebookEdit refuse paths outside the working folders. According to the release notes, it applies in every permission mode. We have no details on how special cases such as symbolic links are handled.
Is the block on by default?
The notes do not say so explicitly. They describe a newly added setting, so it is wise to check it in your configuration. Read the official documentation before assuming the protection is active.
Should people using Bedrock or Foundry upgrade?
If you ran into the problems described, yes. The release fixes Bedrock sessions with many images and the Foundry case with no deployment for the default model. Before updating every machine on the team, test the version on one computer.
What are the groups on gateway upstreams?
They are an optional list of IdP groups tied to each upstream. Only developers in those groups are routed there, including during failover. It is a way to separate who can use which destinations.
Can idle compaction be used everywhere?
No, according to the notes it was added to VS Code and to the Code tab of Claude Desktop. It applies to conversations over 200K tokens left idle. The summary is used only if the prompt cache has expired.
What to watch in the coming months, between permissions and agents in business
The point is not this release but the direction. Agents will have more and more centralized controls, and it is worth preparing now.
- Check your permissions configuration and decide whether to turn on the block on writes outside the folder, perhaps first on a test project.
- Review CI scripts that use claude -p, because a startup error now exits with code 1 and can stop the pipeline.
- If you use a gateway or a cloud provider, reread the full list of fixes and compare the cases with your logs. To understand the costs of different vendors, also read the comparison between Claude and OpenAI, and keep in mind that ongoing errors across several models can also hit you.
