With blockReadsOutsideWorkingDirectories on, Bash subshells and multi-cd commands are now refused instead of evaluated
When the permissions.blockReadsOutsideWorkingDirectories setting is turned on (which makes file tools refuse reads outside your designated working directories), Bash commands containing a subshell, or that change directory more than once, are now refused outright with a "cannot be checked against the read block" message. Previously these were evaluated and could potentially be auto-approved. An exception still applies under a specific worktree/sandbox condition.
Subshells and multiple directory changes make it hard to reliably tell what directory a command will actually read from, so this closes a possible way to bypass the read-location restriction.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
When you set it in a project's `.claude/settings.json` or `.claude/settings.local.json`, Claude Code honors it under the same [workspace trust rule as hooks in settings files](/docs/en/permissions#what-runs-before-you-trust-a-folder). Whil…memory see the edit
* Fixed Bash commands the permission checker cannot fully analyze skipping the prompt under `permissions.blockReadsOutsideWorkingDirectories`, and a subshell hiding a dangerous `rm` in bypass modechangelog see the edit
Anthropic's documentation has since written up blockReadsOutsideWorkingDirectories, on Claude Code changelog.
Fixed Bash commands with two directory changes, a subshell, or a cd+git chain skipping the prompt under…