When blockReadsOutsideWorkingDirectories is enabled, read-only tool calls in restricted contexts are now additionally checked against the working-directory allowlist, with path-suffix normalization applied before the check. This closes a gap where such reads could previously slip through.
Names in the bundleblockReadsOutsideWorkingDirectories
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on How Claude remembers your project touched a line naming blockReadsOutsideWorkingDirectories after this was published.
When you set it in a project's `.claude/settings.json` or `.claude/settings.local.json`, Claude Code honors it under the same [workspace trust rule as hooks in settings files](/docs/en/permissions#what-runs-before-you-trust-a-folder). Whil…memory see the edit
Confirmed since
Anthropic's documentation has since written up blockReadsOutsideWorkingDirectories, on Claude Code changelog.
* Fixed Bash commands with two directory changes, a subshell, or a `cd`+`git` chain skipping the prompt under `permissions.blockReadsOutsideWorkingDirectories` in bypass and auto modechangelog see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up blockReadsOutsideWorkingDirectories, on Claude Code changelog.