Friday roundup: 30 Oct 2026

A new permissions.blockWritesOutsideWorkingDirectories setting makes Write, Edit and NotebookEdit refuse any path outside your working directories, in every permission mode.

Gateway upstreams for Claude apps get an optional groups list for routing by IdP group, Bedrock gateway upstreams get guardrail_trace, and VS Code and the Desktop Code tab now compact idle conversations over 200K tokens.

Fixes cover an "Invalid effort level" loop when an admin caps effort (it now lowers effort and retries), claude -p exiting 0 with no output after a failed startup (it now exits 1), gateways that reject tool_reference or beta headers (now retried without them), dotted model IDs like claude-opus-4.8 being misread behind gateways, and sandbox protections not applying to worktrees under -p --resume. Version 2.1.313 is folded into this release.

New /v1/organizations/analytics/usage and /cost endpoints, behind the beta header analytics-usage-cost-2026-08-24, are available to Console and Enterprise organisations. They support filtering and grouping by model, workspace, API key, and user or service account.

The older Usage and Cost API and the Enterprise usage and cost report endpoints are now legacy but still supported.

The maximum request size for the Messages and Token Counting APIs on the first-party API went from 32 MB to 128 MB.

This release adds keyboard-driven transcript selection with word, line and page motions, search and configurable shortcuts, and consistent Markdown in async questions and answers.

GPT-6.1 Terra is added to the bundled, Vertex AI and Amazon Bedrock model catalogs. There is also codex invoke --resume for unloaded threads, clearer explanations when a request is blocked for safety reasons with safer follow-up prompts, and codex doctor --network-only for config, connectivity and WebSocket checks.

Fixes keep approval and permission settings and reasoning-token accounting across resume and fork, so threads don't compact early, and TUI reconnection is more robust.