[FEATURE] Directory allowlist / default-deny support for Read/Write/Edit tools (currently only Bash has real sandboxing)

### Preflight Checklist

- [x] I have searched [existing requests](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20label%3Aenhancement) and this feature hasn't been requested yet
- [x] This is a single feature request (not multiple features)

### Problem Statement

I want to restrict Claude Code's Read/Write/Edit tools to a single project directory,
with everything else on disk off-limits by default (a "default-deny, allowlist the
project" model). The Bash tool already has exactly this: a real OS-level sandbox that
restricts writes to a fixed directory allowlist. Read/Write/Edit tools have no equivalent —
only pattern-based allow/deny rules in settings.json, where any matching Deny rule always
wins regardless of how specific a competing Allow rule is. This makes it impossible to
express "deny everything, except this one allowed subdirectory."

### Proposed Solution

Add a per-project (or global) setting, e.g. in settings.json, such as:

{
"permissions": {
"restrictFileToolsToDirectories": ["/path/to/project"]
}
}

that confines Read/Write/Edit/Glob/Grep tool access to the listed directories by
construction — analogous to the existing Bash sandbox's directory allowlist — rather
than relying on allow/deny pattern matching where broad Deny rules always defeat
narrower, nested Allow rules.

### Alternative Solutions

Tested and confirmed not to work: adding a broad Deny rule (e.g. Read(/Users//**))
together with an existing narrower Allow rule for the project subdirectory
(Read(/Users//project/**)). Result: the Deny rule blocked reads inside the project
directory too — the nested, more specific Allow did not carve out an exception.

Current workaround: enumerate specific sensitive subdirectories individually in Deny
rules (a blocklist), which is inherently incomplete (any directory not explicitly named
stays unrestricted) and requires ongoing maintenance as the filesystem changes.

The only genuinely enforced alternative found: run Claude Code inside an external OS-level
sandbox (e.g. a Docker container with only the project directory bind-mounted), which
achieves the desired isolation but outside of Claude Code's own configuration, and loses
integrations like the built-in browser tool.

### Priority

High - Significant impact on productivity

### Feature Category

Configuration and settings

### Use Case Example

I work with a large personal knowledge base (Obsidian vault, ~2500 notes) containing a
mix of business-relevant and strictly private/personal content in different subfolders.
I want Claude Code to only ever touch files inside that vault folder, with a hard
technical guarantee that it cannot read or write anything else on my Mac, regardless of
how any individual action is judged. Today this requires either manually denying every
sensitive folder by name (incomplete) or running Claude Code in a separate Docker
container just for this purpose (functional but heavyweight, loses several built-in
features).

### Additional Context

_No response_

Start with the settings.json permission configuration and the existing Bash sandbox entry point. Trace how directory access is enforced for Read, Write, Edit, Glob, and Grep, then define coverage for allowed and disallowed paths. Done means the listed directories are enforced by construction for all named file tools, without relying on conflicting pattern rules.

索引モデルが issue の本文から書いたものです。