{"version":"2.1.257","anchor":"new-permission-setting-blockreadsoutsideworkingdirectories","canonical_anchor":"new-permission-setting-blockreadsoutsideworkingdirectories","heading":"New permissions.blockReadsOutsideWorkingDirectories setting, with network-path detection for working directories","tier":"use","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/new-permission-setting-blockreadsoutsideworkingdirectories","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### New permissions.blockReadsOutsideWorkingDirectories setting, with network-path detection for working directories\n\nA new permissions setting blocks any file read outside your working directories, in prompts and in the sandbox.\n\nA new setting, `permissions.blockReadsOutsideWorkingDirectories`, is now read from settings and propagated through settings serialization\/merge. When enabled it switches directory validation to a stricter check (`kHt(n)` instead of `fS(n)`), adds `blockReadsOutsideWorkingDirectories: true` to the tool permission context, and is enforced in the sandbox filesystem policy, command-parsing\/read-permission logic, and user-facing deny\/ask messages (\"Reads outside the working directories are blocked\"). It is explicitly stripped out for remote-execution permission modes.\n\nAlongside it, validating a directory to add as a trusted working directory (`validateDirectoryForWorkspace`) now checks whether the path is a network path before doing a normal stat, returning a new `networkPath` result type instead of treating it as an ordinary directory-check failure. This rejects UNC\/network paths from being added as working directories, with guidance about drive-letter mapping on Windows.\n\n- Area: Permissions\n- Names: `permissions.blockReadsOutsideWorkingDirectories`, `\/add-dir`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5"}