Claude Code 2.1.314 adds a setting to block writes outside the working directories and idle compaction

Claude Code v2.1.314, released October 29, 2026, per its release notes:

• Permissions: new permissions.blockWritesOutsideWorkingDirectories makes Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode. Claude's file tools now also ask before editing the local copy of an organization's server-managed settings.
• Idle compaction: in VS Code and the Claude Desktop Code tab, a conversation of 200K+ tokens that is left idle is summarized, and the summary is used on the next message if the prompt cache has expired. It also runs for subscribers with telemetry off, and on Bedrock, Vertex, Foundry and LLM gateways once the one-hour prompt cache is on.
• Claude apps gateway: an optional groups list on upstreams sends only developers in the listed IdP groups to that upstream, on failover too; guardrail_trace on Bedrock upstreams logs which Amazon Bedrock guardrail filter fired, without the matched text.
• Changes in behavior: FORCE_HYPERLINK=false (also no, off) now turns hyperlinks off instead of on; the Bash tool's shell clears any inherited which alias or function; flagged requests retry on another model instead of ending in a refusal when settings leave only an older Opus model, or none; cloud sessions start even if a setup script exits with an error.
• Fixes include claude -p exiting 0 with no output when startup failed (it now prints the error and exits 1), Bedrock sessions with many images failing on every turn, Microsoft Foundry sessions with no deployment for the default model, and sandbox protections not applying to a worktree entered by claude -p --resume or --continue.

The release also adds Claude Tag admin and Slack fixes, many vim-mode and TUI fixes, and updates to the bundled skills.