Claude Code Can Now Refuse to Write Outside Your Repo, Codex Gets a Network Doctor, and Copilot Plugins Install Themselves Per Repository

At a glance

• Claude Code can now refuse file writes outside your working directories, in every permission mode.
• A claude -p run that fails at startup now exits 1 instead of passing silently.
• Codex adds a network-only doctor check and explains why a safety check blocked you.
• Repos can ship default Copilot plugins, and enterprises can require or block them.

Codex v0.166.0 landed on GitHub at 3:47 PM ET Thursday and Claude Code v2.1.314 reached npm at 8:12 PM ET, while the GitHub plugin news dates from Universe on Wednesday and was easy to miss among the bigger Copilot announcements. It is a quieter day, and the useful changes are about limits rather than new features. Our read: each one moves a decision about where an agent may act out of your head and into a setting, which is only safer if someone on the team actually turns it on.

Treat today as a boundaries check day: turn on the Claude Code write guard in one repo, make sure your scripts notice when claude -p fails, and decide who in your org chooses Copilot plugins before contributors start picking them up from repositories.

Top Stories

1. Claude Code v2.1.314 can block writes outside your working directories

The headline addition is a new setting, permissions.blockWritesOutsideWorkingDirectories. When it is on, the Write, Edit and NotebookEdit tools refuse any path outside the working directories in every permission mode, so a session running with broad approvals cannot quietly edit a dotfile in your home folder or a file in a sibling project. It joins an older twin, permissions.blockReadsOutsideWorkingDirectories, which the settings reference documents as a boolean that any settings file can turn on. The changelog names the new write key but not its value, and the settings reference does not list it yet. Our read: it probably takes true the same way, so test it in one repo before you roll it out to a team.

The same release fixes a scripting trap. claude -p used to exit with code 0 and print nothing when startup failed, which made a broken CI step look like a successful one. It now prints the error and exits 1. Sessions that failed turn after turn with "Invalid effort level" because an admin capped a model's effort now lower the effort, retry and say which level they used.

The smaller fixes are worth a skim. Sandbox protections now apply to a worktree entered with claude -p --resume or --continue, background diff refreshes no longer grab the repository's git index lock, and MCP servers that also work without sign-in are used signed out instead of showing "needs authentication" after a stored login stops working.

Practical dev impact: If any pipeline calls claude -p, check that a non-zero exit fails the job, because startup failures that used to pass silently will now stop the run.

2. Codex v0.166.0 adds a network doctor and explains its safety blocks

Codex v0.166.0 is mostly about making the terminal client easier to trust and debug. codex doctor --network-only runs focused configuration, connectivity and WebSocket diagnostics, which is the check you want when Codex works at home but stalls on a work network. When a safety check blocks an action, the TUI now gives a clearer explanation of why and offers safer follow-up prompts you can select instead of rewording the request yourself.

The transcript gained keyboard selection with word, line and page motions, built-in search and configurable shortcuts, and Markdown now renders the same way in questions, choices, answers and replies. codex queue --resume resumes unloaded threads after you queue a message, and GPT-6.1 Terra joins the bundled model catalog. Fixes keep acknowledged approval and permission settings when you resume or fork a thread, keep reasoning-token counts across resume and fork so compaction does not start early, and keep local image attachments when restoring killed composer text.

Practical dev impact: Because resumed and forked threads now keep the approval settings you already accepted, review those settings before you fork a thread into riskier work rather than assuming a fork starts fresh.

3. Copilot repository plugin defaults and enterprise plugin controls are GA

GitHub made repository plugin defaults and enterprise-managed plugin controls generally available in VS Code, Copilot CLI and the GitHub Copilot app. Trusted repositories can install and enable default plugins for contributors. A maintainer defines a plugin marketplace and default plugins, so contributors get the same Copilot setup without repeating it for each project, and contributors can turn those defaults off where policy permits. A plugin can bundle skills, custom agents, hooks and MCP server configurations, so one default can add a lot.

Enterprise administrators can supply approved marketplaces, restrict installation to them, and require or block plugins through managed settings. Required plugins are installed and enabled automatically and users cannot disable them, and managed settings take precedence over repository and personal choices. Repository defaults are available to individual Copilot users and to Copilot Business or Enterprise users, while the managed controls need GitHub Enterprise Cloud with Copilot Business or Enterprise licenses issued by the enterprise or one of its organizations.

Practical dev impact: Since a trusted repository can now enable plugins for everyone who opens it, treat a change to its plugin defaults like a dependency change and require a code owner's review before it merges.

Practical Impact Analysis

All three stories move the same line, which is where an agent is allowed to act and who gets to decide. The Claude Code write guard is the easiest win because it is one setting, and it narrows what a session can damage without slowing normal work inside the repo. Try it in one project today and keep it if nothing you rely on breaks. The claude -p exit code fix is small, but it changes CI behavior, so look at any script that wraps it before the next failure turns a green build red. Our read: a red build is the honest result, and the old silent pass was the bug.

Codex v0.166.0 is a routine upgrade for most people, though codex doctor --network-only is worth remembering the next time a teammate says Codex hangs behind a proxy. Copilot plugin defaults matter more to maintainers and admins than to individual developers, because the real decision is who controls the plugin list, and that is easier to settle before plugins spread across repositories than after. Elsewhere, Kilo Code v7.8.25 shipped a single CLI fix that keeps the existing package manager user agent when reading npm configuration.

Tutorial

1. Start the script from the root of a test repo where you have write access.
2. Step 1 prints the current versions and the ones you have. The installs stay commented out.
3. Step 2 lists any settings file that already names the write guard. Our read: the value is true, as with the documented read twin, but the docs do not list it yet, so merge the line into the permissions block of .claude/settings.json in a test repo first and confirm a write outside the repo is refused.
4. Step 3 makes one short claude -p call and prints its exit code, and step 4 is the optional Codex network check.

# We have not run this script end to end on every platform. It prints and checks, plus one short claude -p call.
# Run it from the root of a test repo where you have write access.

# 1. Which versions are out, and which do you have? At 6:04 AM ET Fri 30 Oct npm showed
#    @anthropic-ai/claude-code latest v2.1.314 and @openai/codex latest v0.166.0.
npm view @anthropic-ai/claude-code dist-tags.latest
npm view @openai/codex dist-tags.latest
if command -v claude >/dev/null; then claude --version; else echo "no claude CLI on PATH"; fi
if command -v codex >/dev/null; then codex --version; else echo "no codex CLI on PATH"; fi
#    Optional installs only. Pinned at 6:04 AM ET Fri 30 Oct, npm registry channel:
# npm install -g @anthropic-ai/claude-code@2.1.314
# npm install -g @openai/codex@0.166.0

# 2. Is the write guard already set? Lists any settings file that names it.
grep -l "blockWritesOutsideWorkingDirectories" .claude/settings.json "$HOME/.claude/settings.json" 2>/dev/null
#    Our read: a boolean like blockReadsOutsideWorkingDirectories. Not in the docs yet, so try a test repo first.
#    Then merge into the "permissions" block of .claude/settings.json:
#    "blockWritesOutsideWorkingDirectories": true

# 3. Does a failed startup fail? On v2.1.314 or later, a working setup prints 0 and a failure prints 1.
if command -v claude >/dev/null; then
  claude -p "reply with ok"
  echo "claude -p exit code: $?"
fi

# 4. Optional, only if Codex stalls on this network:
# codex doctor --network-only
echo "Done. Nothing was installed or changed."

Sources:

• Claude Code changelog (v2.1.314)
• Claude Code settings reference
• Codex rust-v0.166.0 release
• Repository plugin defaults and enterprise plugin controls generally available
• About plugins for GitHub Copilot
• Kilo Code v7.8.25 release

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.