blockReadsOutsideWorkingDirectories
A Claude Code settings key, read out of the shipped bundle. No mined inventory carries it: everything below comes from what this site has written about it.
A new permissions setting blocks any file read outside your working directories, in prompts and in the sandbox.
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.257.
In the changelogs
25Releases whose published page names blockReadsOutsideWorkingDirectories.
-
v2.1.319
New permission setting
denyInsteadOfPromptingis carried through settingsClaude Code now passes along a
permissions.denyInsteadOfPromptingsetting when it is set to true, next to the read and write block settingsfound in this entry's text, named in this entry
-
v2.1.319
No-prompt permission mode and denyInsteadOfPrompting are treated differently
The mode that avoids permission prompts now marks itself as avoiding them by nature, and
denyInsteadOfPromptingnow counts as a restrictive settingfound in this entry's text
-
v2.1.315
New setting exempts chosen paths from the block on reads outside the working directory
permissions.blockReadsExemptPathslists paths that stay readable whenblockReadsOutsideWorkingDirectoriesis on, and is read only from flag settingsfound in this entry's text, named in this entry
-
v2.1.315
New setting lets a launching program exempt folders from the read block
The new
blockReadsExemptPathssetting lists folders Claude Code may still read while reads outside the working directories are blockedfound in this entry's text, named in this entry
-
v2.1.315
Restricted sandbox mode now blocks file reads outside the working directory
When the sandbox is in restricted mode, Claude Code now blocks reads of files outside your working directories
found in this entry's text, named in this entry
-
v2.1.314
New setting blocks Claude's file edits outside your working directories
A new setting, blockWritesOutsideWorkingDirectories, stops Claude's file tools writing outside your working directories in every permission mode
found in this entry's text
-
v2.1.314
Remote runs no longer receive the setting that blocks writes outside the project
Remote runs now drop blockWritesOutsideWorkingDirectories from sandbox settings, as they already did for the read-blocking setting
found in this entry's text, named in this entry
-
v2.1.299
Sandbox handles linked folders and wildcard paths differently when blocking reads
The sandbox now tracks wildcard paths and linked folders in its allow and deny lists, and drops access grants that later point into a denied area
found in this entry's text
-
v2.1.292
Attached files are checked again to be the exact path that was approved
Under
--restrictedor the read block, an attached file must open at the same path that was approved, closing a gap through links swapped mid-readfound in this entry's text
-
v2.1.290
CLAUDE.md and rules files outside allowed folders are skipped when reads are restricted
With reads restricted, Claude Code no longer loads CLAUDE.md, AGENTS.md or rules files that a deny rule covers or that sit outside your working folders
found in this entry's text, named in this entry
-
v2.1.285
Risky sandbox grants committed in a repository are now withheld
With
blockReadsOutsideWorkingDirectorieson, a repository'sallowReadandallowWritegrants are withheld if they are globs, network paths or risky symlinksfound in this entry's text, named in this entry
-
v2.1.281
Desktop managed config schema: new keys disableBypassPermissionsMode, blockReadsOutsideWorkingDirectories, egressProxyUrl, egressProxyPacUrl, usageMetricsEnabled; relaunchEnforcementHours removed
The admin config schema adds five keys, including
disableBypassPermissionsMode, and removesrelaunchEnforcementHoursfound in this entry's text, named in this entry
-
v2.1.280
Permission checks now handle unresolved symlink chains explicitly
Permission checks now explicitly deny paths whose symlink chain can't be resolved
found in this entry's text, named in this entry
-
v2.1.273
Memory-directory prefetch now respects blockReadsOutsideWorkingDirectories
Memory-file prefetching now also respects the block-outside-directory-reads setting
found in this entry's text, named in this entry
-
v2.1.273
Bash 'too complex' command handling reworked with a per-reason-kind table gating the outside-working-directory read block
Bash's 'too complex to check' read-block guard now applies via a general table covering more refusal reasons, not just one hardcoded case
named in this entry
-
v2.1.273
Auto-memory loading now skipped when reads are fenced outside the working directory
Auto-memory loading is now skipped when a permissions setting fences reads outside the working directory
named in this entry
-
v2.1.273
Background memory extraction now skips when reads are locked to the working directory
Background memory extraction now skips entirely when reads are locked to the working directory
named in this entry
-
v2.1.273
Bash commands too complex for AST analysis now get blocked outright under the read-block setting
Bash commands too complicated to analyze are now blocked outright when reads are locked to the working directory
named in this entry
-
v2.1.271
New auto-mode guard: subshells and multi-directory-change commands can't bypass the read block
With blockReadsOutsideWorkingDirectories on, Bash subshells and multi-cd commands are now refused instead of evaluated
found in this entry's text, named in this entry
-
v2.1.269
New read-block bypass guard for glob-obscured
..path segmentsA new check blocks reads that hide a '..' path segment behind a glob character to slip past directory restrictions
named in this entry
-
v2.1.269
Closed a loophole letting a glob before '..' escape the read-directory block
Claude Code now blocks a glob-before-'..' trick that could have escaped read-directory restrictions
found in this entry's text, named in this entry
-
v2.1.257
New permission setting: blockReadsOutsideWorkingDirectories
A new permissions setting blocks any file read outside your working directories, in prompts and in the sandbox.
found in this entry's text
-
v2.1.257
Relaxed filesystem policy disables the new block
Under a relaxed sandbox filesystem policy, the outside-reads block does nothing and this is now logged.
found in this entry's text, named in this entry
-
v2.1.257
Plan-mode file tools: stricter outside-working-directory read blocking
With outside reads blocked, read-only tool calls in restricted contexts are now checked against the allowlist too.
found in this entry's text, named in this entry
-
v2.1.257
Artifact database write/read tool respects the read-block setting
Artifact database reads and writes now honor the setting that confines file access to your working directories.
found in this entry's text, named in this entry
First cited
6The earliest release whose published evidence quoted blockReadsOutsideWorkingDirectories was v2.1.257, 1 Sep 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
0The miner has never read a build containing this name. It is here because a changelog entry of ours names it, which is evidence that it existed and not evidence of which releases carried it. The inventory starts at v2.1.138 and everything older than that was never mined.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.