Back to rankings

Claude Code Closes Restricted-Mode Upload, PowerShell Hook and Managed Auto Mode Gaps in 2.1.316

Claude CodeView original changelog

Claude Code 2.1.316 fixes cases where the agent could act outside what a user or organization authorized. --restricted sessions no longer upload files from outside the working directories when a Read allow rule covers them, and PowerShell hooks now block on exit code 2 for commands beginning with a type cast, param, using or an attribute. A managed autoMode.allow list without "$defaults" also stops getting built-in exceptions back from other sources.

Key Takeaways

  • --restricted sessions no longer upload files from outside the working directories, even when a Read allow rule covers them.
  • PowerShell hooks now block on exit code 2 for commands that begin with a type cast, param, using or an attribute.
  • A managed autoMode.allow list without "$defaults" no longer regains built-in exceptions from --settings, /permissions or /auto-mode-setup.
  • The built-in rule on scheduled-task prompts is no longer removed by an autoMode.allow list without "$defaults".
  • Server-managed settings for Team and Enterprise logins now apply without an approval prompt, and unverified stored copies are refused.
  • The common thread is guardrails that existed but did not hold, so security-minded teams should upgrade.

A cluster of boundary fixes

Claude Code 2.1.316 includes several fixes that share one question: can the agent do something the user or the organization did not authorize? Each closes a path where a protection existed but did not hold.

Restricted sessions and file uploads

--restricted sessions could upload files from outside the working directories when a Read allow rule covered those files. A restricted session is meant to limit what leaves the machine, so an allow rule reaching beyond the working directories undermined that. The release fixes it, and restricted sessions no longer upload such files.

PowerShell hooks that did not block

PowerShell hooks did not block on exit code 2 when the command began with a type cast, param, using or an attribute. Exit code 2 is how a hook tells Claude Code to stop an action, so a hook that returned it but was ignored let the action proceed. The release makes these hooks block as written. Teams that wrote PowerShell hooks as guardrails on Windows should confirm the commands those hooks inspect begin in one of the affected forms.

Managed auto mode rules regaining defaults

A managed autoMode.allow list without "$defaults" was getting the built-in exceptions back from three places: a host app's --settings, a first rule added in /permissions, and /auto-mode-setup. An organization that deliberately left "$defaults" out of its list could therefore find auto mode more permissive than the policy said. The release stops that.

A related change goes the other way for one rule: an autoMode.allow list without "$defaults" no longer removes the built-in rule on scheduled-task prompts.

Managed settings fetched from the server

For Team and Enterprise logins, settings fetched from Anthropic's API now apply without an approval prompt, and a stored copy that does not verify is refused.

Takeaway

None of these is a headline feature. Together they mean restricted sessions, PowerShell guardrail hooks and organization-managed auto mode rules behave the way their documentation says.