Key Updates in Claude Code v2.1.314 - Denying Writes Outside the Working Directory and Fixing Gaps in Sandbox and Hook Enforcement

I'm Ishikawa from the Cloud Business Division. Claude Code v2.1.314 (released 2026-10-30) has been released. Version 2.1.313 was not published to npm, so this release follows v2.1.312. Because there are many changes this time, I'll focus on permissions and the sandbox.

The previous update article is here.

https://dev.classmethod.jp/articles/20261028-cc-updates-v2-1-312/

Update Summary

v2.1.314 includes 119 changes. According to the CHANGELOG, there are 81 Fixed, 16 Improved, 13 Changed, 6 Added, and 3 Updated items. In this article, I've grouped 10 of them related to permissions, the sandbox, and settings enforcement under Security, and I treat 4 behavior-changing items as breaking changes. The release also includes changes targeting the VS Code extension (7), cloud sessions (9), and Claude Tag for Slack (7).

Notable Updates

Added a setting to deny writes outside the working directories

The permissions.blockWritesOutsideWorkingDirectories setting has been added. When enabled, Write, Edit, and NotebookEdit deny writes to paths outside the working directories in all permission modes.

Below is a configuration example. In "Trying it out" later, I pass JSON in the same format to --settings.

{
  "permissions": {
    "blockWritesOutsideWorkingDirectories": true
  }
}

I think this setting suits those who use bypassPermissions in CI or headless runs but still want to restrict where Claude's file editing tools can write to the working directories.

Fixed an issue where settings excluded with --setting-sources were partly still in effect

Fixed an issue where settings files excluded with --setting-sources still supplied some settings, such as auto mode rules and saved permission consent.

If you narrow the settings that are loaded with --setting-sources to pin down your execution environment, I think it's worth checking after the update that only the intended settings are in effect.

Fixed gaps in sandbox and hook enforcement

The following two issues were fixed.

• Sandbox protection was not applied to worktrees entered with claude -p --resume or --continue
• Hooks matching Bash did not run for shell commands launched by the Monitor tool (after the fix, these hooks can block or ask about the command, but cannot approve or rewrite it)

For those who use the sandbox or hooks as safety restrictions, this fix means restrictions now apply on paths where they previously did not, so I think updating early is advisable.

Added idle compaction to VS Code and Claude Desktop

Idle compaction has been added to the Code tab in VS Code and Claude Desktop. When a conversation of 200K tokens or more is left idle, it is summarized, and if the prompt cache has expired, that summary is used for the next message. It runs even for subscribers who have turned off telemetry, and also runs on Bedrock, Vertex, Foundry, and LLM gateways if the 1-hour prompt cache is enabled.

I think it's good to know that if you leave a conversation of over 200K tokens open in VS Code or Desktop and step away, and the prompt cache expires, the summary is used for the next message.

Fixed claude -p to return exit code 1 on startup failure

Fixed an issue where claude -p that failed to start exited with exit code 0 without printing anything. After the fix, it shows an error and exits with exit code 1.

If you judge job success in CI by the exit code of claude -p, startup failures may previously have been treated as successes, so I think this is a highly beneficial fix.

Update Details

New Features

• Added groups to Claude apps gateway upstreams: You can specify an optional groups list, and only developers in the IdP groups on the list are routed to that upstream. The same applies during failover.
• Added guardrail_trace to Claude apps gateway Bedrock upstreams: Logs which Amazon Bedrock guardrail filter fired on a request, without including the matched text.
• Added idle compaction to the Code tab in VS Code and Claude Desktop: When a conversation of 200K tokens or more is left idle, it is summarized, and if the prompt cache has expired, that summary is used for the next message.
• [Cloud sessions] Added an Include completed button to the Scheduled tasks page: Shown when the only hidden tasks are completed one-off tasks, letting you display them without opening the Sort menu.
• [Claude Tag] Added a link to the Claude Tag API documentation in admin settings: For Enterprise organizations with Slack connected, a dismissible link has been added to the Bundles and Channels tabs.

Security

• Added the permissions.blockWritesOutsideWorkingDirectories setting: In all permission modes, Write, Edit, and NotebookEdit deny writes to paths outside the working directories.
• Fixed an issue where settings files excluded with --setting-sources still supplied some settings: This covers things like auto mode rules and saved permission consent.
• Fixed an issue where sandbox protection was not applied to worktrees entered with claude -p --resume / --continue
• Fixed an issue where hooks for Bash did not run on shell commands launched by the Monitor tool: These hooks can block or ask, but cannot approve or rewrite.
• Fixed an issue where forceRemoteSettingsRefresh stopped being enforced: When it was set only in remote managed settings, it stopped being enforced once the saved copy expired, and sessions could start without the policy when the server was unreachable.
• Fixed an issue where CI jobs asked for workspace trust confirmation: claude ultrareview and claude remote-control asked for trust confirmation in CI jobs that had a terminal. When CI is set, untrusted folders are now rejected immediately.
• Fixed an issue where TLS trust settings in managed settings were not applied to Claude Desktop sessions
• Changed to ask for confirmation before editing the local copy of server-managed settings: As with settings files, Claude's file tools now ask for confirmation before editing the local copy of the organization's server-managed settings.
• Changed /ultrareview to check workspace trust before running git: This is the same behavior as claude ultrareview.
• Changed to reject approval of calls that cannot be read in full in Recently blocked of /permissions: This also covers calls that cannot be fully displayed because the terminal is not tall enough.

Improvements

• Improved memory usage in headless and SDK turns that run many subagents: The parent session no longer holds each subagent's tool results until the end of the turn.
• Improved the message for calls blocked by auto mode: It shows the command name, tells you that auto mode will check again if Claude retries, and points you to /permissions to review.
• Changed hook if conditions to match the Monitor tool's shell commands: A specifier like Monitor(tail *) now matches in the same way that Bash(tail *) matches Bash.
• Changed to retry with a different model when only older Opus models remain: When ANTHROPIC_DEFAULT_OPUS_MODEL, availableModels, and deniedModels leave only older Opus models or none at all, flagged requests are retried with a different model instead of ending in a rejection.
• Expanded the scope of idle compaction: It runs even for subscribers who have turned off telemetry, and also runs on Bedrock, Vertex, Foundry, and LLM gateways if the 1-hour prompt cache is enabled.
• [Cloud sessions] Improved scheduled tasks to load the account's plugins: Scheduled tasks running in Anthropic's cloud load the plugins you enabled for your claude.ai account.
• In addition, there are minor improvements such as prompt history search with Ctrl+R, the Recently blocked tab in /permissions, automatic session titles, the speed of --resume and /context, and updates to bundled skills (/claude-api and dataviz).

Fixes

• Fixed claude -p exiting with exit code 0 on startup failure: It now shows an error and exits with exit code 1.
• Fixed "Invalid effort level" persisting under an effort cap: When an organization admin set a cap on model effort, sessions failed on every turn. It now lowers the effort and retries, and shows the level in use.
• Fixed "400 Input is too long." in image-heavy Bedrock sessions: Every turn and /compact were failing. It now strips old images and compacts.
• Fixed failures on Microsoft Foundry when no deployment exists for the default model: When there is no deployment for the default Sonnet, Opus, or Haiku model, it falls back to an older model in the same family.
• Fixed model IDs containing dots being treated as older models under LLM gateways: For IDs like claude-opus-4.8, the context window, output limit, effort, thinking mode, and cost were wrong.
• Fixed compaction failing with large PreCompact hook output: Failures and repeats were occurring. Each hook's output is now truncated to 10,000 characters.
• Fixed .git/index.lock conflicts caused by background diff updates: Concurrently running git commands could fail with "Unable to create '.git/index.lock': File exists".
• Fixed "Continue automatically at usage limit" continuing more than 3 times: When a task resumed on its own between waits (/goal check-ins, background tasks, scheduled tasks), it continued without a user prompt.
• A quietly welcome fix: The issue where ~/.claude/skills/.trash and ~/.claude/plugins/.trash grew without bound has been fixed, and each now keeps up to about 1024 entries regardless of the cleanupPeriodDays value. For those who frequently swap skills and plugins, I think it's a quietly welcome fix that .trash entries no longer pile up endlessly.
• In addition, many minor bugs have been fixed, including requests through gateways and cloud providers (beta headers, tool search), TLS certificates, MCP sign-in, vim mode, the VS Code extension, cloud sessions, and Claude Tag.

Breaking Changes and Deprecations

In this article, I treat the following 4 behavior-changing items as breaking changes. No items are newly deprecated in this version.

FORCE_HYPERLINK=false turns hyperlinks off

With FORCE_HYPERLINK=false (same for no and off), hyperlinks are now turned off rather than on. Below is an example.

Before (up to v2.1.312):

# Hyperlinks are turned on
FORCE_HYPERLINK=false claude

After (v2.1.314 onward):

# Hyperlinks are turned off (same for no and off)
FORCE_HYPERLINK=false claude

Hook allow is treated as "no answer" in Cowork cloud sessions

In auto mode of Cowork cloud sessions, a hook's allow for an MCP tool call is now treated as "no answer," and the classifier or the permission confirmation prompt makes the decision. Below is an example of the behavior. The behavior before the change is inferred from the CHANGELOG wording "now counts as no answer".

Before (up to v2.1.312, inferred):

Cowork cloud session (auto mode)
MCP tool call → hook allows → allow is treated as the decision

After (v2.1.314 onward):

Cowork cloud session (auto mode)
MCP tool call → hook allows → treated as no answer
→ classifier or permission confirmation prompt decides

The Bash tool's shell clears an inherited which

The Bash tool's shell now clears any inherited which alias or function, and no longer passes exported which/unsetenv functions to commands. which becomes the system command or zsh's built-in command. Below is an example. The behavior before the change is inferred from the CHANGELOG wording "clear any inherited which alias or function".

Before (up to v2.1.312, inferred):

# An inherited which alias or function remains in the Bash tool's shell
which <コマンド名>

After (v2.1.314 onward):

# The inherited which alias or function is cleared, and
# the system which command or zsh's built-in command is used
which <コマンド名>

Cloud sessions start even if the setup script fails

Cloud sessions started from the web, desktop, and mobile apps now start even if the setup script exits with an error, instead of failing to start. Below is an example of the behavior.

Before (up to v2.1.312):

Starting a cloud session (web, desktop, mobile app)
Setup script exits with an error → session fails to start

After (v2.1.314 onward):

Starting a cloud session (web, desktop, mobile app)
Setup script exits with an error → session starts

Trying Out the Denial of Writes Outside the Working Directories

What are working directories?

Working directories are the directories that Claude Code treats as the scope in which it may handle files. The official documentation describes them as the directory where Claude Code was launched plus any directories you have added.

When you enable permissions.blockWritesOutsideWorkingDirectories, writes by Write, Edit, and NotebookEdit to paths not included in any of these are denied.

Note that for the read-side permissions.blockReadsOutsideWorkingDirectories, directories added only through repository settings (such as .claude/settings.json) are not counted as working directories.

Verification method

I compared, with and without the setting, whether a Write outside the working directories is denied even in bypassPermissions mode when permissions.blockWritesOutsideWorkingDirectories is enabled.

In the following commands, I put the absolute path of the verification directory into the shell variable V. For this verification, I used a directory created under a temporary directory for the Claude Code session. If you try this yourself, create an empty directory as in the example below and put its path into V before running the commands. If V stays empty, $V/work is treated as /work.

# Example: create an empty directory for verification and put its path into V
% V="$(mktemp -d)"

The verification conditions are as follows.

• Run claude -p with $V/work as the working directory and instruct it to create a file in the neighboring $V/outside (no directories are added, so the working directory is only $V/work)
• Limit available tools to Write only with --tools Write, and do not load MCP servers with --strict-mcp-config
• Use --permission-mode bypassPermissions to put it in a mode that skips permission prompts

With the setting

% mkdir -p $V/work $V/outside
% cd $V/work

% claude -p --max-turns 1 --tools Write --strict-mcp-config \
  --permission-mode bypassPermissions \
  --settings '{"permissions":{"blockWritesOutsideWorkingDirectories":true}}' \
  --output-format stream-json --verbose \
  "Write ツールで $V/outside/on.txt を作成し、内容を hello にしてください" | jq -r 'select(.type == "system" and .subtype == "permission_denied") | {type, subtype, tool_name, tool_use_id, decision_reason_type, decision_reason}'
{
  "type": "system",
  "subtype": "permission_denied",
  "tool_name": "Write",
  "tool_use_id": "toolu_01UM1dXiXLpiotsBuC75vewv",
  "decision_reason_type": "other",
  "decision_reason": "Writes outside the working directories are blocked (permissions.blockWritesOutsideWorkingDirectories). Add the directory with /add-dir, or remove that setting."
}

This is the leading part of the line showing the permission denial in the stream-json output. I confirmed that Write was not executed.

Without the setting

% claude -p --max-turns 1 --tools Write --strict-mcp-config \
  --permission-mode bypassPermissions \
  --output-format stream-json --verbose \
  "Write ツールで $V/outside/off.txt を作成し、内容を hello にしてください"

Here Write succeeded, and the tool result began with File created successfully at:. After the two runs, I checked the contents of $V/outside.

% ls -1 $V/outside
off.txt

on.txt with the setting was not created, and only off.txt without the setting was created. Both exited with exit code 1, but this was because they hit the --max-turns 1 limit (the result's terminal_reason is max_turns). I did not check Edit, NotebookEdit, or writes via shell commands this time.

I confirmed that even when running with bypassPermissions, file editing tools are prevented from rewriting anything outside the working directories. This is quite reassuring.

Conclusion

With the added setting to deny writes outside the working directories and the fixes for inconsistencies in the sandbox, hooks, and settings-source exclusion, I feel this version makes it easier to control the scope you entrust to Claude Code as intended.

If you manage permission restrictions through settings, or run Claude Code in CI or automation, why not update and give it a try?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://code.claude.com/docs/en/permissions

https://code.claude.com/docs/en/settings-reference

https://dev.classmethod.jp/articles/20261028-cc-updates-v2-1-312/