Claude Code 2.1.314 Adds a Switch That Stops Its File Tools Writing Outside the Project, Even in Bypass Mode

Anthropic has given Claude Code a hard fence for file writes. Version 2.1.314 of the coding agent, tagged on GitHub on October 30, 2026, adds a setting called permissions.blockWritesOutsideWorkingDirectories. Anthropic’s changelog describes it in one line: “Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode.”

The last three words carry the change. Claude Code already asks before many writes, but how much it asks depends on the permission mode a developer picks. The new setting is meant to hold no matter which mode is active, including the ones built to skip prompts.

This is a hardening option, not a vulnerability fix; the release notes tie it to no reported flaw.

One setting, three file tools

The setting covers the three built-in tools Claude uses to change files: Write creates or overwrites a file, Edit changes part of one, and NotebookEdit changes Jupyter notebook cells. With the block on, such calls aimed outside the working directories are refused rather than prompted.

Anthropic’s permissions documentation defines the working directories. By default it is the folder Claude Code was launched in. Developers can add more with the --add-dir flag at startup, the /add-dir command during a session, or an additionalDirectories list in a settings file.

Closing the gap bypass mode leaves open

Claude Code’s permission modes trade prompts for speed. In acceptEdits mode, the documentation says file edits inside the working directory and added directories are accepted automatically. In auto mode, a background classifier reviews actions instead of the user. In bypassPermissions mode, Claude Code skips permission prompts altogether, apart from a short list of actions no mode approves on its own.

Anthropic’s own docs warn that bypassPermissions should only be used “in isolated environments like containers or VMs where Claude Code can’t cause damage.” Until now, a session in that mode had no switch that stopped the file tools from writing to a dotfile in the home directory or to a neighbouring repository. The new setting lets teams keep an unprompted session while fencing its edits to the project.

The read-side block it mirrors

The name follows an existing setting. permissions.blockReadsOutsideWorkingDirectories, added in v2.1.257, makes the Read, Grep, Glob and LSP tools refuse paths outside the working directories in every mode, including bypassPermissions. Anthropic’s reference says Claude Code still lets the agent read files it needs to run, such as skills, plugins and the CLAUDE.md memory file under ~/.claude/.

For that read block, the reference states that “a true in any file applies, so a repository can turn the block on for itself but can’t lift yours.” Whether the write block combines across settings files the same way is not yet documented.

Where the shell and the sandbox fit

The changelog line names only the three file tools, not the Bash tool. For the read block, Anthropic’s reference says plainly that “Claude Code doesn’t refuse shell commands the same way”. Shell reads outside the fence prompt instead, and the sandbox enforces the block for sandboxed commands. The write-block entry says nothing about shell commands either way.

Claude Code’s Bash sandbox already limits where sandboxed commands can write. Anthropic’s sandboxing docs list the defaults as the working directory, a per-user temp directory and any added directories. Configuration files such as .claude settings, .mcp.json, shell startup files and git hooks stay write-protected even inside those folders. Teams that want both the file tools and shell commands fenced would need the sandbox on as well as the new setting.

Other permission fixes in 2.1.314

The same release carries several related changes, all from Anthropic’s changelog:

• Sandbox protections now apply to a worktree entered by claude -p --resume or --continue. Before, they did not.
• Claude’s file tools now ask before editing the local copy of an organization’s server-managed settings, as they already do for the user’s own settings files.
• forceRemoteSettingsRefresh, when set only in remote managed settings, applies again after the stored copy expires. Anthropic says the bug “let sessions start without policy when the server could not be reached.”
• With CI set, claude ultrareview and claude remote-control refuse an untrusted folder at once rather than asking about workspace trust.

A setting the reference pages have yet to describe

As of the morning of November 1 in India, the new key appears only in the changelog and the v2.1.314 release notes. Anthropic’s settings reference, permissions guide and permission-modes page still describe the read block but not the write block. The entry does not say whether the setting is off by default, which settings files can set it, or whether it reaches Bash. Teams adopting it should test it in their own permission mode before relying on it.