{"version":"1.0.120","anchor":"redesigned-filesystem-permissions-model","canonical_anchor":"redesigned-filesystem-permissions-model","heading":"Redesigned Filesystem Permissions Model","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/1.0.120\/e\/redesigned-filesystem-permissions-model","release_url":"https:\/\/changelogs.core-directive.com\/v\/1.0.120","markdown":"### Redesigned Filesystem Permissions Model\n\n**What:** The filesystem permissions configuration has been completely redesigned with a simplified, asymmetric approach: reads use denylist-only mode, writes use allowlist-only mode.\n\n**Old model (v1.0.119):**\n\n`{ \"permissions\": { \"filesystem\": { \"read\": { \"allowAllExcept\": [\"\/etc\/\", \"\/private\/\"] }, \"write\": { \"denyAllExcept\": [\"\/home\/user\/project\/\"] } } } }` **New model (v1.0.120):**\n\n`{ \"permissions\": { \"filesystem\": { \"read\": { \"denyOnly\": [\"\/etc\/passwd\", \"\/private\/keys\/\"] }, \"write\": { \"allowOnly\": [\"\/home\/user\/project\/\"], \"includeDefaults\": true, \"denyWithinAllow\": [\".\/.claude\/\"] } } } }` **Key differences:**\n\n- **Read permissions**: Only `denyOnly` mode (assumes open by default, deny specific paths)\n- **Write permissions**: Only `allowOnly` mode (assumes closed by default, allow specific paths)\n- **Lost feature**: Can no longer do restrictive read permissions (`denyAllExcept` for reads is removed)\n- **New feature**: `denyWithinAllow` allows exceptions within allowed write paths\n- **Breaking change**: Existing v1.0.119 configurations are incompatible\n\n**Evidence**\n\nNew schemas at lines 354053-354067 (`ew9` and `Aq9`), old schemas removed from lines 354007-354030 (`y10` and `k10`), new implementation at lines 374904-374938 (`ob6()` and `tb6()`)"}