You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Bug FixesKind: in v2.1.269,
Bug FixesSection of the release
What
Claude Code can restrict file reads to specific working directories using permissions.blockReadsOutsideWorkingDirectories or an equivalent read-deny rule. A new check now detects when a path contains a .. segment (which moves up a directory) placed after a glob character, a wildcard the shell expands before Claude Code ever sees the final path, which could otherwise let such a path dodge the restriction check. When one of these directory-restriction settings is active, paths shaped this way are now denied outright with an explanation that the target couldn't be safely checked.
Why
Without this check, a cleverly crafted path using a glob pattern could potentially bypass the read restriction and access files outside the intended working directory. Denying such paths outright closes that gap.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added sinceA small documentation edit on How Claude remembers your project touched a line naming blockReadsOutsideWorkingDirectories after this was published.When you set it in a project's `.claude/settings.json` or `.claude/settings.local.json`, Claude Code honors it under the same [workspace trust rule as hooks in settings files](/docs/en/permissions#what-runs-before-you-trust-a-folder). Whil…memorysee the edit
Confirmed sinceAnthropic's documentation has since written up blockReadsOutsideWorkingDirectories, on Claude Code changelog.* Fixed Bash commands with two directory changes, a subshell, or a `cd`+`git` chain skipping the prompt under `permissions.blockReadsOutsideWorkingDirectories` in bypass and auto modechangelogsee the edit
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up blockReadsOutsideWorkingDirectories, on Claude Code changelog.
