Redesigned Filesystem Permissions Model

What: The filesystem permissions configuration has been completely redesigned with a simplified, asymmetric approach: reads use denylist-only mode, writes use allowlist-only mode.

Old model (v1.0.119):

{
  "permissions": {
    "filesystem": {
      "read": {
        "allowAllExcept": ["/etc/", "/private/"]
      },
      "write": {
        "denyAllExcept": ["/home/user/project/"]
      }
    }
  }
}

New model (v1.0.120):

{
  "permissions": {
    "filesystem": {
      "read": {
        "denyOnly": ["/etc/passwd", "/private/keys/"]
      },
      "write": {
        "allowOnly": ["/home/user/project/"],
        "includeDefaults": true,
        "denyWithinAllow": ["./.claude/"]
      }
    }
  }
}

Key differences:

• Read permissions: Only denyOnly mode (assumes open by default, deny specific paths)
• Write permissions: Only allowOnly mode (assumes closed by default, allow specific paths)
• Lost feature: Can no longer do restrictive read permissions (denyAllExcept for reads is removed)
• New feature: denyWithinAllow allows exceptions within allowed write paths
• Breaking change: Existing v1.0.119 configurations are incompatible