Claude Code 2.1.314 adds a block on writes outside working directories, IdP group routing for the apps gateway, and idle compaction in VS Code and Desktop

Background and pain point

Once coding agents reach enterprises, the usual worries are whether the agent can touch files outside the project, and how to control which model routes each team can use. Claude Code has mostly relied on permission modes and deny rules to limit writes, but in auto or bypass modes admins had no single hard rule that says never write outside the project. Claude Code v2.1.314, published by Anthropic on GitHub on Oct 30, mainly fills in these governance controls and clears a large batch of stability bugs.

How it works

With the new permissions.blockWritesOutsideWorkingDirectories setting on, Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode. Claude apps gateway upstreams can take a groups list, so only developers in the listed IdP groups are routed to that upstream, including on failover. Bedrock upstreams gain guardrail_trace, which logs which Amazon Bedrock guardrail filter fired on a request without the matched text. Idle compaction, already in the terminal, now also runs in VS Code and the Code tab of Claude Desktop: a conversation above 200K tokens left idle is summarized, and the summary is used on the next message if the prompt cache has expired.

Benchmarks and results

This is a client release, and Anthropic has not published benchmarks or performance figures. The CHANGELOG has 119 entries, more than half of them fixes, such as sessions now lowering effort and retrying when an admin caps a model's effort, and claude -p no longer exiting 0 silently when startup fails.

Getting started

Upgrade with claude update or your package manager. Teams can turn on blockWritesOutsideWorkingDirectories in managed settings as a floor against out-of-project writes in auto mode, and CI scripts using claude -p can now rely on the non-zero exit code to detect failures. Teams on a self-hosted gateway with Bedrock can use groups to send departments to different upstreams and guardrail_trace to see why a request was blocked.