All settings changedsettings-reference
Nearest release: v2.1.285, published 2 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 29 Sep 2026 19:33 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 29 Sep 2026 19:37 UTC.
Upstream edited
Recorded here
Lines+42added
Lines−13removed
From line
1,590
where the diff opens
First seen
21 Aug 2026
this site's first read of the page
Recorded edits149to this page, all time
#### Sandboxed commands under the block
The whole hunk
from line 1590, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 1590
15901590
15911591### `permissions.blockReadsOutsideWorkingDirectories`
15921592
1593Stop Claude from reading paths outside the session's [working directories](/docs/en/permissions#working-directories) with the Read, Grep, Glob, and LSP tools, in every permission mode including `bypassPermissions`. A Bash command that reads a matching path through a file command Claude Code recognizes, such as `cat`, prompts you even in auto mode and `bypassPermissions` mode. Requires Claude Code v2.1.257 or later.
1593Make Claude's file tools refuse reads outside your [working directories](/docs/en/permissions#working-directories) in every permission mode, including `bypassPermissions`. Claude Code denies `Read`, `Grep`, `Glob`, and `LSP` calls on those paths and tells Claude to ask you to add the directory with `/add-dir`. Files Claude Code itself needs stay readable, such as your skills, plugins, rules, agents, commands, and the `CLAUDE.md` memory file under `~/.claude/`. Requires Claude Code v2.1.257 or later.
15941594
1595Claude Code doesn't refuse shell commands the same way:
1596
1597* [Actions no mode auto-approves](/docs/en/permission-modes#actions-no-mode-auto-approves) covers when a shell command that reads such a path prompts you
1598* [Sandboxed commands under the block](#sandboxed-commands-under-the-block) covers what a sandboxed command can read
1599
15951600A Bash command the shell parser can't trace, such as one that changes directory more than once or runs a subshell, prompts you even in auto mode and `bypassPermissions` mode. The prompt appears even when the command names no path outside the working directories. This prompt doesn't apply when the command runs in the [sandbox](/docs/en/sandboxing) and the sandbox enforces the block.
15961601
15971602Claude Code also writes `true` here when you choose to block such reads on [auto mode's prompt before the first read outside the working directories](/docs/en/permission-modes#first-read-outside-the-working-directories).
15981603
1599* **Scope**: [`Any file`](#scopes). If any settings source sets `true`, the block applies, so a repository's checked-in file can turn the block on for a project but can't lift a block you set.
1604* **Scope**: [`Any file`](#scopes). A `true` in any file applies, so a repository can turn the block on for itself but can't lift yours.
16001605* **Type**: Boolean
1601 * `true`: file reads outside the working directories are blocked
1602 * `false`: the same as unset; a `true` in any other settings file still blocks
1603* **Default**: unset, so reads outside the working directories follow your permission mode and rules
1606 * `true`: Claude's file tools refuse reads outside the working directories
1607 * `false`: the same as unset; the block still applies if another file sets `true`
1608* **Default**: unset, so reads outside the working directories follow your [permission mode](/docs/en/permission-modes)
16041609
16051610```json settings.json theme={null}
16061611{
from line 1615
16101615}
16111616```
16121617
1613If only a repository's checked-in settings file adds a directory, the block still applies to reads there. When [`autoMemoryDirectory`](#automemorydirectory) comes from the project's `.claude/settings.json`, or from a `.claude/settings.local.json` [treated as repository-supplied](/docs/en/permissions#when-your-local-settings-file-needs-trust), Claude Code loads no [auto memory](/docs/en/memory#storage-location) from that directory and saves none to it. Files Claude Code itself needs stay readable, such as your skills, plugins, rules, agents, commands, and the `CLAUDE.md` memory file under `~/.claude/`.
1618Directories you add with `--add-dir`, `/add-dir`, or `additionalDirectories` in your user or managed settings count as working directories for the block. Directories added only in repository settings don't count: those in `.claude/settings.json`, and those in `.claude/settings.local.json` unless git reports that file as untracked. In a directory that isn't a git repository, or when git tracks the file, Claude Code treats `.claude/settings.local.json` as repository settings, so put directories you want to keep readable in your user settings instead.
16141619
1615When the [sandbox](/docs/en/sandboxing) is on, the block also denies sandboxed commands read access to home directories and mounted-volume roots outside the working directories. A retry that needs approval to [run outside the sandbox](/docs/en/sandboxing#the-unsandboxed-retry-escape-hatch) prompts you even in `bypassPermissions` mode. Files a tool reads from your home directory, such as `~/.gitconfig`, are denied with the rest; re-open a specific path with [`sandbox.filesystem.allowRead`](#sandbox-filesystem-allowread) when a tool needs it.
1620When [`autoMemoryDirectory`](#automemorydirectory) comes from the project's `.claude/settings.json`, or from a `.claude/settings.local.json` [treated as repository-supplied](/docs/en/permissions#when-your-local-settings-file-needs-trust), Claude Code loads no [auto memory](/docs/en/memory#storage-location) from that directory and saves none to it.
16161621
1622To lift the block, remove the key from every settings file that sets it, then start a new session.
1623
1624#### Sandboxed commands under the block
1625
1626When [sandboxing](/docs/en/sandboxing) is on, the block also covers sandboxed commands. Claude Code denies them read access to your home directory and to the other roots that hold user files: `/Users`, `/home`, `/root`, `/Volumes`, `/mnt`, `/media`, `/run/media`, and `/srv`. It then re-opens the working directories, [worktrees](/docs/en/worktrees) Claude Code creates in the session, the session temp directory, and the parts of `~/.claude` that commands need, such as skills and plugins. While the block is in force, `allowRead` and `allowWrite` entries from repository settings don't count.
1627
16171628When the session's working directory is a linked [git worktree](/docs/en/worktrees), including one Claude Code entered mid-session, the repository's common `.git` directory stays readable and writable to sandboxed commands, so git keeps working there.
16181629
1630In these cases the block doesn't reach sandboxed commands, while Claude's file tools keep enforcing it:
1631
1632* Filesystem isolation is off through [`sandbox.filesystem.disabled`](#sandbox-filesystem-disabled)
1633* [`allowManagedReadPathsOnly`](#sandbox-filesystem-allowmanagedreadpathsonly) is set
1634* The path of the directory you started Claude Code in contains a glob character such as `*`, `?`, or `[`
1635
1636Under the block, Claude Code re-opens your global git configuration files to sandboxed commands so `git` keeps your identity and settings:
1637
1638* `~/.gitconfig`
1639* The `config`, `ignore`, and `attributes` files under `$XDG_CONFIG_HOME/git`, which defaults to `~/.config/git`
1640* Files your global git configuration names through `[include]`, `[includeIf]`, `core.excludesFile`, or `core.attributesFile`
1641
1642Claude Code judges each file separately. When a file lies where a sandboxed command can write, directly or through a symlink, Claude Code doesn't re-open the files it names.
1643
1644On Linux and WSL2, a configuration file that is a symlink can stay unreadable at its own path, and `git` then runs without it. `~/.git-credentials` and `$XDG_CONFIG_HOME/git/credentials` stay blocked.
1645
1646If a re-opened file holds a secret, such as an `http.extraHeader` token, add its path to [`sandbox.filesystem.denyRead`](#sandbox-filesystem-denyread). A `denyRead` entry that covers a file always takes precedence over this re-open.
1647
16191648### `permissions.defaultMode`
16201649
16211650Set the [permission mode](/docs/en/permission-modes) new sessions start in. When you leave it unset, sessions start in the [built-in default](/docs/en/permission-modes#which-mode-a-session-starts-in) for your surface.
from line 1942
19131942}
19141943```
19151944
1916Claude Code merges entries across every settings scope the session loads: user, project, local, and managed paths combine rather than replace each other, and Claude Code adds the paths from your `Edit(...)` allow permission rules. An `allowWrite` entry can't lift a [protected path](/docs/en/sandboxing#protected-paths).
1945Claude Code merges `allowWrite` entries and the paths from your `Edit(...)` allow permission rules across every settings scope the session loads, leaving out the ones from repository settings while [`permissions.blockReadsOutsideWorkingDirectories`](#sandboxed-commands-under-the-block) is on. An `allowWrite` entry can't lift a [protected path](/docs/en/sandboxing#protected-paths).
19171946
19181947### `sandbox.filesystem.denyWrite`
19191948
from line 2007
19782007}
19792008```
19802009
1981Claude Code resolves a `.` entry to the project root in project settings and to `~/.claude` in user settings. Claude Code merges entries across every settings file the session loads unless [`allowManagedReadPathsOnly`](#sandbox-filesystem-allowmanagedreadpathsonly) is set.
2010Claude Code resolves a `.` entry to the project root in project settings and to `~/.claude` in user settings. Claude Code merges entries across every settings file the session loads unless [`allowManagedReadPathsOnly`](#sandbox-filesystem-allowmanagedreadpathsonly) is set, and leaves out entries from repository settings while [`permissions.blockReadsOutsideWorkingDirectories`](#sandboxed-commands-under-the-block) is on.
19822011
19832012### `sandbox.filesystem.allowManagedReadPathsOnly`
19842013
from line 4175
41464175
41474176* **Scope**: [`Any file`](#scopes). A `true` in managed settings can't be overridden by `false` elsewhere.
41484177* **Type**: Boolean
4149 * `true`: Claude Code replaces each inline shell command with `[shell command execution disabled by policy]` instead of running it
4150 * `false`: inline shell runs
4151* **Default**: unset, so inline shell runs
4152
4153```json settings.json theme={null}
4154{
4155 "disableSkillShellExecution": true
4156}
4157```
4158
4159Bundled skills and skills deployed through managed settings are unaffected.
4160
4161### `skillOverrides`
4162
4163Hide or collapse a [skill](/docs/en/skills#override-skill-visibility-from-settings) without editing its `SKILL.md`. Claude Code applies the value under each skill's name to the skill list Claude sees and to your `/` autocomplete.
4164
4165* **Scope**: [`Any file`](#scopes). The `/skills` menu writes to `.claude/settings.local.json`.
4166* **Type**: object mapping skill name to one of:
4167 * `"on"`: Claude sees the skill and you can type `/name`
4168 * `"name-only"`: Claude sees the skill by name without its description
4169 * `"user-invocable-only"`: Claude doesn't see the skill, but you can still type `/name`
4170 * `"off"`: Claude doesn't see the skill and `/name` is hidden from autocomplete
4171* **Default**: unset, so every skill is `"on"`
4172
4173This example lists `legacy-context` to Claude by name only and hides `deploy` from Claude and from `/` autocomplete:
4174
4175```json settings.json theme={null}
4176{
4177 "skillOverrides": {
4178 "legacy-context": "name-only",
4179 "deploy": "off"
4180 }
4181}
4182```
4183
4184Overrides don't apply to plugin skills, which you manage through `/plugin`.
4185
4186In managed settings and files passed with `--settings`, a key on a bundled skill's alias, such as `checkup` for `/doctor`, also applies to the skill; see [how alias keys combine with keys on the skill's own name](/docs/en/skills#override-skill-visibility-from-settings).
4187
4188### `syncClaudeAiSkills`
4189
4190Turn off the download of the [skills enabled for your claude.ai account](/docs/en/skills#how-synced-skills-behave). Claude Code downloads them into `~/.claude/skills/synced/` in [terminal sessions where you sign in with your claude.ai account](/docs/en/skills#where-synced-skills-load), interactive or non-interactive, and in Cowork and cloud sessions. Set `false` to stop that download and stop loading the skills it already synced. Claude Code honors only `false`: `true` is the same as unset and doesn't turn syncing on where it's otherwise off.
4191
4192* **Scope**: [`User, local, or managed`](#scopes), and files passed with `--settings`. A repository can't turn it off for you.
4193* **Type**: Boolean
4194 * `false`: Claude Code stops downloading synced skills and stops loading the ones already in `~/.claude/skills/synced/`. In user or managed settings, it also mov
4178 * `true`: Claude Code replaces each inline shell command with `[shell command execution disabled
No line in this hunk matches that.