permissions.blockReadsOutsideWorkingDirectories
A Claude Code settings key, read out of the shipped bundle. No mined inventory carries it: everything below comes from what this site has written about it.
Make the file tools refuse reads outside the working directories in every permission mode
Anthropic's own wording. Read off All settings, captured 2026-11-06.
In the changelogs
11Releases whose published page names permissions.blockReadsOutsideWorkingDirectories.
-
v2.1.314
File uploads now respect the setting that blocks reads outside working folders
A file passed for upload is now refused with an error when
permissions.blockReadsOutsideWorkingDirectoriesblocks reading itfound in this entry's text, named in this entry
-
v2.1.275
New closed-set
decision_reason_codefield on permission decisionsNew decision_reason_code field distinguishes specific reasons behind a permission decision
found in this entry's text
-
v2.1.273
Bash 'too complex' command handling reworked with a per-reason-kind table gating the outside-working-directory read block
Bash's 'too complex to check' read-block guard now applies via a general table covering more refusal reasons, not just one hardcoded case
found in this entry's text
-
v2.1.273
Background memory extraction now skips when reads are locked to the working directory
Background memory extraction now skips entirely when reads are locked to the working directory
found in this entry's text
-
v2.1.273
Bash commands too complex for AST analysis now get blocked outright under the read-block setting
Bash commands too complicated to analyze are now blocked outright when reads are locked to the working directory
found in this entry's text
-
v2.1.271
New auto-mode guard: subshells and multi-directory-change commands can't bypass the read block
With blockReadsOutsideWorkingDirectories on, Bash subshells and multi-cd commands are now refused instead of evaluated
found in this entry's text
-
v2.1.269
New read-block bypass guard for glob-obscured
..path segmentsA new check blocks reads that hide a '..' path segment behind a glob character to slip past directory restrictions
found in this entry's text
-
v2.1.269
Sandboxed-command deny message and blockOutsideReads flow renamed/reworked
Internal rework of the sandbox 'reads outside working directory' deny dialog, same message and behavior
found in this entry's text
-
v2.1.257
New permission setting: blockReadsOutsideWorkingDirectories
A new permissions setting blocks any file read outside your working directories, in prompts and in the sandbox.
found in this entry's text, named in this entry
-
v2.1.257
New settings key to confine file reads to trusted working directories
Reads outside your working directories can be made to fail closed, with a prompt option that persists the setting.
found in this entry's text, named in this entry
-
v2.1.257
New read-block ask message for command-substitution/redirection targets
Outside-directory paths found in command substitutions and redirections now raise their own ask prompt instead of being blocked silently.
found in this entry's text, named in this entry
First cited
7The earliest release whose published evidence quoted permissions.blockReadsOutsideWorkingDirectories was v2.1.257, 1 Sep 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
1 further span in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
0The miner has never read a build containing this name. It is here because a changelog entry of ours names it, which is evidence that it existed and not evidence of which releases carried it. The inventory starts at v2.1.138 and everything older than that was never mined.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.