How to stop Claude Code from writing files outside the working directory with a permissions setting

Claude Code 2.1.314 adds a permissions.blockWritesOutsideWorkingDirectories setting. When it's on, the Write, Edit and NotebookEdit tools refuse any path outside the working directories, in every permission mode. Use it when you run in an auto-approve mode and don't want a stray write to overwrite files elsewhere.

Add it under permissions in settings.json.

{
  "permissions": {
    "blockWritesOutsideWorkingDirectories": true
  }
}

The changelog gives only the setting name and its behavior, not the value format. The true above is a guess from the name. The settings and permissions docs don't list it yet either, so check that it takes effect by asking Claude to edit a file outside the working directory. Those three tools are the ones the changelog says it blocks.