{"version":"2.1.271","anchor":"new-auto-mode-guard-subshells-and-multi-directory-change-co","canonical_anchor":"new-auto-mode-guard-subshells-and-multi-directory-change-co","heading":"New auto-mode guard: subshells and multi-directory-change commands can't bypass the read block","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/new-auto-mode-guard-subshells-and-multi-directory-change-co","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### New auto-mode guard: subshells and multi-directory-change commands can't bypass the read block\n\nWith blockReadsOutsideWorkingDirectories on, Bash subshells and multi-cd commands are now refused instead of evaluated\n\n**What**\n\nWhen the `permissions.blockReadsOutsideWorkingDirectories` setting is turned on (which makes file tools refuse reads outside your designated working directories), Bash commands containing a subshell, or that change directory more than once, are now refused outright with a \"cannot be checked against the read block\" message. Previously these were evaluated and could potentially be auto-approved. An exception still applies under a specific worktree\/sandbox condition.\n\n**Why**\n\nSubshells and multiple directory changes make it hard to reliably tell what directory a command will actually read from, so this closes a possible way to bypass the read-location restriction.\n\n- Area: Permissions\n- Names: `blockReadsOutsideWorkingDirectories`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}