Claude Code v2.1.314 adds a write block outside working directories

The new permissions.blockWritesOutsideWorkingDirectories setting makes the Write, Edit and NotebookEdit tools refuse paths outside the working directories in every permission mode. Claude apps gateway upstreams also accept an optional groups list, so only developers in the listed identity-provider groups are sent to that upstream, including during failover. Gateway Bedrock upstreams gain guardrail_trace, which logs which Amazon Bedrock guardrail filter fired without recording the matched text.

In VS Code and the Code tab in Claude Desktop, idle compaction now summarizes a conversation left idle above 200K tokens, and the summary is used on the next message if the prompt cache has expired. The release also changes startup failures in claude -p, which now print the error and exit with code 1 instead of exiting 0 with no output. Microsoft Foundry sessions fall back to an older model in the same family when the resource has no deployment for the default model.

Other fixes cover TLS failures caused by a renewed root certificate cross-signed with its predecessor, and claude mcp logout reporting success when the sign-in was not removed. The release also changes how auto mode reports blocked calls, naming the command and pointing to /permissions for review.

Scripts that call claude -p can now detect startup failures from the exit code, so a failed run no longer looks like a clean empty result.

Teams running agents through a gateway can restrict which developers reach each upstream by identity-provider group, and can restrict file writes to the working directories.

Agent builders should check whether their setup relies on writes outside the project folder, since those calls will now be refused.