Claude Code v2.1.314: blockWritesOutsideWorkingDirectories and 20+ bug fixes

Claude Code v2.1.314 ships a new filesystem guard plus a long list of stability fixes across Bedrock, Vertex, MCP, VS Code, and the CLI. The headline feature is a permission setting that stops Write, Edit, and NotebookEdit from touching paths outside the working directories.

New permission: blockWritesOutsideWorkingDirectories

Add this to your settings to make the file-editing tools refuse any path outside the working directories — in every permission mode, not just the default:

{
  "permissions": {
    "blockWritesOutsideWorkingDirectories": true
  }
}

If you run agents in CI or on shared machines, this closes the gap where a tool could write to /etc, home dotfiles, or a sibling repo depending on the active mode.

Gateway and admin controls

• Claude apps gateway upstreams now accept an optional groups list. Only developers in the listed IdP groups are routed to that upstream — and that holds during failover too.
• Bedrock upstreams gain guardrail_trace, which logs which Amazon Bedrock guardrail filter fired on a request without logging the matched text.
• Admin TLS trust settings in managed settings now actually apply in Claude Desktop sessions.
• forceRemoteSettingsRefresh set only in remote managed settings no longer stops applying once the stored copy expires — previously a session could start without policy if the server was unreachable.

CLI correctness fixes

• claude -p used to exit 0 with no output when startup failed. It now prints the error and exits 1, so scripts and CI stop treating a broken start as success.
• Sessions behind an org-mandated effort cap no longer fail turn after turn with "Invalid effort level." Claude Code lowers the effort, retries, and tells you which level it used.
• claude ultrareview and claude remote-control no longer ask the workspace trust question when CI is set; they refuse an untrusted folder immediately.
• claude mcp logout no longer reports success when the sign-in wasn't removed (for example, a locked macOS keychain over SSH).
• Remote Control model switches that take over 8 seconds now return the final result instead of a "still pending" error, and worker registration retries with growing waits when the session service is slow.

Bedrock, Foundry, and TLS

• Bedrock sessions with many images no longer fail every turn and /compact no longer returns "400 Input is too long" — older images are dropped before compacting.
• Microsoft Foundry deployments missing the default Sonnet, Opus, or Haiku model now fall back to an older model in the same family instead of failing.
• UNABLE_TO_GET_ISSUER_CERT on TLS connections is fixed when the system cert store holds a renewed root cross-signed with its predecessor.
• Gateways that reject tool search's tool_reference blocks trigger one retry without tool search, and the session remembers the fallback.

UI and background session fixes

• VS Code and Claude Desktop's Code tab now do idle compaction: a 200K+ token conversation left idle is summarized, and the summary is used on your next message if the prompt cache has expired.
• PreCompact hooks have their output truncated at 10,000 characters, so a verbose hook can't make compaction fail or loop.
• Background diff refreshes no longer briefly take the repo index lock, which was breaking concurrent git commands with "Unable to create '.git/index.lock': File exists."
• Markdown tables stop jumping between grid and stacked layouts on half-typed streaming rows; long tables no longer fall back to raw pipes.
• "Continue automatically at usage limit" now stops at three continuations when a task restarts itself between waits.
• Ultracode stays off after being disabled, instead of being re-enabled at the next background or cloud session start.

Smaller fixes

• The /resume picker no longer shows CLAUDE.md or CLAUDE.local.md text as a session title when the session only ran slash commands.
• /btw from a subagent's transcript now answers from that transcript, not the main conversation.
• Pasting an image over SSH to Linux now prints guidance to copy the file and paste its path instead of doing nothing silently.
• Model switching works when a broken user-supplied --plugin-dir or --plugin-url plugin exists alongside managed plugin settings.
• The Bedrock/Vertex model upgrade offer stops reappearing at every start when managed settings pin the model.

Anyone running Claude Code in CI, across multiple cloud providers, or behind a gateway should pull this one — the claude -p exit-code fix alone will catch failures that were being silently swallowed.