Function escaping_write_refusal 

pub fn escaping_write_refusal(
    tool_name: &str,
    arguments: &Value,
    workdir: &Path,
) -> Option<String>

Refuse a shell call whose redirect writes outside the working directory, or None when every literal target it names stays inside.

clamp_by_effect answers “which policy governs this write” and is a separate question from “is this path allowed at all”. Folding them together would hide the second one behind the first’s name, so they stay apart.

Refusal, not a prompt. write_file does not prompt for a path outside the workdir, it refuses, and this is the same write. Prompting would also be unusable where it matters: the case this closes needs write_file to have resolved to Allow, which in practice means --yolo, and ToolPolicy::Ask blocks until answered - an unattended run would park in WaitingInput holding its slot rather than being protected.

The message names the offending path so the model can retry inside the workspace instead of guessing which part of its line was refused.

Reads the target through crate::shell_keys, which knows whether the platform’s shell treats \ as an escape - so > C:\Users\me\out.txt on Windows is judged as the path cmd.exe will actually open, rather than the C:Usersmeout.txt a POSIX reading produces. That mismatch shipped once and CI caught it denying a write inside the workspace.