---
type: "post"
id: "claude-code-2-1-314-adds-blockwritesoutsideworkingdirectories-to-f1f9c2"
slug: "claude-code-2-1-314-adds-blockwritesoutsideworkingdirectories-to-f1f9c2"
title: "Claude Code 2.1.314 adds blockWritesOutsideWorkingDirectories to stop writes outside working directories in every permission mode"
description: "Claude Code 2.1.314 adds `permissions.blockWritesOutsideWorkingDirectories`, a setting that prevents its Write, Edit, and NotebookEdit tools from modifying files outside a session’s working directories."
retrieval_nugget: "Claude Code 2.1.314 adds permissions.blockWritesOutsideWorkingDirectories, a setting that prevents its Write, Edit, and NotebookEdit tools from modifying files outside a session’s working directories. The restriction applies even in bypass permission mode, giving teams a filesystem boundary that does not depend on each individual approval prompt."
published_at: "2026-10-31"
updated_at: "2026-10-31"
record_date: "2026-10-31"
date_kind: "published_at"
topics: ["claude","claude-code","anthropic"]
entities: ["Anthropic","Claude Code","Claude apps gateway","Amazon Bedrock"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "same_event"
what_changed: "Same event as Claude Code 2.1.314 adds blockWritesOutsideWorkingDirectories permission setting"
prior_refs: ["memory:903b6c43-a368-854e-a808-62598775f42b","memory:ef351628-5c34-84cf-a05d-b2fdcd97aeba","memory:83264796-b9ae-8351-a541-1c02e4aa1366"]
source_url: "https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md"
source_urls: ["https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:claude-code-2-1-314-adds-blockwritesoutsideworkingdirectories-to-f1f9c2"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/claude-code-2-1-314-adds-blockwritesoutsideworkingdirectories-to-f1f9c2/","markdown":"https://newruntime.com/posts/claude-code-2-1-314-adds-blockwritesoutsideworkingdirectories-to-f1f9c2.md","json":"https://newruntime.com/posts/claude-code-2-1-314-adds-blockwritesoutsideworkingdirectories-to-f1f9c2.json"}
---

# Claude Code 2.1.314 adds blockWritesOutsideWorkingDirectories to stop writes outside working directories in every permission mode

## Retrieval answer

Claude Code 2.1.314 adds permissions.blockWritesOutsideWorkingDirectories, a setting that prevents its Write, Edit, and NotebookEdit tools from modifying files outside a session’s working directories. The restriction applies even in bypass permission mode, giving teams a filesystem boundary that does not depend on each individual approval prompt.

## Summary

Claude Code 2.1.314 adds `permissions.blockWritesOutsideWorkingDirectories`, a setting that prevents its Write, Edit, and NotebookEdit tools from modifying files outside a session’s working directories. The restriction applies even in bypass permission mode, giving teams a filesystem boundary that does not depend on each individual approval prompt.

## What happened

Anthropic’s Claude Code 2.1.314 was published to npm on October 30, 2026, according to the supplied release material. Its most consequential addition is `permissions.blockWritesOutsideWorkingDirectories`. When the setting is enabled, Claude Code’s Write, Edit, and NotebookEdit tools refuse paths outside the session’s working directories.

The scope matters because the release describes the control as applying in every permission mode, including bypass mode. In ordinary use, permission prompts can require a person to approve an action. Bypass mode removes that interaction friction, but it also removes a frequent point at which an operator might catch an unexpected file operation. The new setting is presented as a hard boundary on the affected editing tools rather than another prompt or advisory instruction.

The change is narrowly about write operations and named tools. It does not claim to sandbox all of Claude Code, validate the safety of a requested change, or govern every possible action an agent can take. Its stated behavior is more bounded: a session may have a defined set of working directories, and edits through Write, Edit, and NotebookEdit outside that set are refused.

The same 2.1.314 release also added an optional identity-provider `groups` list for Claude apps gateway upstreams, `guardrail_trace` logging for Bedrock upstreams, and idle compaction for conversations of 200,000 tokens or more in VS Code and the Desktop Code tab. The release included fixes as well: `claude -p` now exits with status 1 on a startup failure; sandbox protections apply to worktrees entered through `--resume`; and PreCompact hook output is capped at 10,000 characters. Those changes broaden the release, but the working-directory restriction is the clearest operational change for teams giving a coding agent significant editing freedom.

For a team, the immediate question is not whether a model can be trusted to follow a path instruction. It is whether the runtime can enforce the path boundary after a session has been granted autonomy. This release makes that boundary configurable for the tools that change files.

## What the archive adds

This is a new fact on a known Claude Code release thread. In [Claude Code 2.1.312 adds an OIDC user-id claim for the Claude apps gateway and stops overwriting large CLAUDE.md files](https://newruntime.com/posts/claude-code-2-1-312-adds-an-oidc-8c6cf2/), the earlier release added gateway identity information and protected large project-instruction files from being overwritten. Version 2.1.314 shifts the focus to constraining where editing tools can write.

## Trend signal

The release supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). A natural-language instruction not to leave a repository is not equivalent to an enforced capability limit. By making out-of-directory writes fail even in bypass mode, Claude Code places part of the safety boundary in the runtime configuration rather than in the model’s compliance with a prompt.

## Why now

The supplied release material notes that builders discussed the update shortly after a Cursor notice about tampered 2.1.312 and 2.1.313 extension builds. That context does not establish a causal relationship, but it makes the timing legible: teams are paying closer attention to what a coding-agent installation can modify once it has been granted local access. The new setting offers a narrower editable surface without requiring teams to abandon autonomous modes altogether.

## Why it matters

Coding agents are increasingly useful precisely when they can make many related changes without waiting for an approval after every edit. But approval fatigue can turn a permission system into a ritual, while bypass modes can turn a convenience setting into broad filesystem authority. A boundary tied to working directories gives teams a more concrete control: allow the agent to operate freely within the intended project area while refusing edits beyond it.

That can reduce the blast radius of a runaway task, a mistaken path interpretation, or a compromised session for the named write tools. It also creates a clearer deployment question for engineering teams: which directories genuinely belong to a session’s job, and which should remain outside its reach? The control does not eliminate the need for review, backups, repository protections, or sandboxing. It does make one important policy enforceable at the point of file modification.

## Limits and uncertainty

The release material establishes the setting’s stated behavior, but it does not provide configuration examples, default values, compatibility details, or a complete account of how working directories are determined. It also names only Write, Edit, and NotebookEdit, so it does not establish that every mechanism capable of affecting a machine is constrained by this option. There is no supplied evidence about performance overhead, adoption, or how the feature behaves in particular repository layouts and operating environments. Teams should therefore validate it against their own workflows rather than infer a general-purpose sandbox from a write-path restriction.

## Skill to build now

Map the directories that an autonomous coding session actually needs before enabling broad permissions. In a non-production repository, enable the restriction and run representative tasks: edit source files, generate expected artifacts, update notebooks if used, and attempt an intentionally out-of-scope write. Record which paths are legitimate workspace dependencies and which are not. The useful outcome is a reviewed working-directory policy, not merely a setting switched on once.

## Reader takeaway

Claude Code 2.1.314 adds a practical guardrail for autonomous editing: its named write tools can be prevented from touching files outside the session’s working directories, including in bypass mode. For teams using coding agents daily, that is a reason to treat filesystem scope as a deployable runtime policy rather than a request embedded in a prompt.

## Open question

How will teams define working-directory scope for monorepos, generated artifacts, and development workflows that legitimately cross repository boundaries?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude-code topic hub.
- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)