Approval for reads outside working directories

permissions.blockReadsOutsideWorkingDirectories

Stop Claude from reading paths outside the session's working directories with the Read, Grep, Glob, and LSP tools, in every permission mode including bypassPermissions. A Bash command that reads a matching path through a file command Claude Code recognizes, such as cat, prompts you even in auto mode and bypassPermissions mode. Requires Claude Code v2.1.257 or later.

A Bash command the shell parser can't trace, such as one that changes directory more than once or runs a subshell, prompts you even in auto mode and bypassPermissions mode. The prompt appears even when the command names no path outside the working directories. This prompt doesn't apply when the command runs in the sandbox and the sandbox enforces the block.

Claude Code also writes true here when you choose to block such reads on auto mode's prompt before the first read outside the working directories.

• Scope: Any file. If any settings source sets true, the block applies, so a repository's checked-in file can turn the block on for a project but can't lift a block you set.
• Type: Boolean
  • true: file reads outside the working directories are blocked
  • false: the same as unset; a true in any other settings file still blocks
• Default: unset, so reads outside the working directories follow your permission mode and rules

{
  "permissions": {
    "blockReadsOutsideWorkingDirectories": true
  }
}

If only a repository's checked-in settings file adds a directory, the block still applies to reads there. When autoMemoryDirectory comes from the project's .claude/settings.json, or from a .claude/settings.local.json treated as repository-supplied, Claude Code loads no auto memory from that directory and saves none to it. Files Claude Code itself needs stay readable, such as your skills, plugins, rules, agents, commands, and the CLAUDE.md memory file under ~/.claude/.

When the sandbox is on, the block also denies sandboxed commands read access to home directories and mounted-volume roots outside the working directories. A retry that needs approval to run outside the sandbox prompts you even in bypassPermissions mode. Files a tool reads from your home directory, such as ~/.gitconfig, are denied with the rest; re-open a specific path with sandbox.filesystem.allowRead when a tool needs it.

When the session's working directory is a linked git worktree, including one Claude Code entered mid-session, the repository's common .git directory stays readable and writable to sandboxed commands, so git keeps working there.

The first read outside the working directories

While permissions.blockReadsOutsideWorkingDirectories is off, file reads run without a prompt in auto mode, including reads outside the working directories. The first time Claude uses the Read, Grep, or Glob tool on a path outside them, Claude Code asks you whether to keep allowing those reads.

The prompt doesn't appear in non-interactive -p runs or background sessions; reads there run as before.

Whatever you answer, Claude keeps working:

• Keep allowing: the read runs, later reads outside the working directories run as before, and Claude Code records your answer so the prompt doesn't appear again
• Block from now on: the read is refused, and Claude Code sets permissions.blockReadsOutsideWorkingDirectories to true in your user settings, which makes the file tools refuse such reads in every later session and every permission mode. To let Claude read such a path later, add its directory with /add-dir or remove the setting.
• Ask again next time: the read is refused, and the next read outside the working directories prompts again