Read blocking outside working directories: restricted mode, exempt paths, searches and Chrome uploads
Restricted mode now blocks reads outside the working directories, searches and Chrome uploads are fenced too, and blockReadsExemptPaths lets chosen paths through
What probably matters to youSection of the release
Unclear Under some conditions the exempt list is treated as empty, and it is not clear what those conditions are.
What
Claude Code can stop its file tools from reading anything outside your working directories, which are the folders a session is allowed to work in. The setting for this is blockReadsOutsideWorkingDirectories. This release extends that read block:
Restricted mode, which you start with --restricted, now turns on the read block by itself, even when blockReadsOutsideWorkingDirectories is not set to true.
A file refused because of restricted mode gets its own error message: read not allowed under --restricted.
Claude in Chrome file uploads in bypassPermissions mode (the mode that skips permission prompts) no longer skip the permission check when the session is restricted. In restricted mode, an upload is also refused when only an allow rule permits that file.
blockReadsExemptPaths is honoured only from --settings or from settings the program that launched Claude Code passes in. It is ignored in user, project, local and managed settings.
Each exempt entry must be an absolute local path. It cannot be a filesystem root, contain a .. segment, or have spaces around it. Invalid entries are dropped with a warning, and in some conditions Claude Code treats the whole list as empty.
The exempt list is passed to both the read and the write path checks. A new check that runs before the write block can return its own message first.
Searches are now fenced as well. When the read block is on, the folder a search starts from (its search root) is checked against the same boundary, through searchRootFence.
Auto memory files, the notes Claude Code keeps for itself, stay readable under that fence, including a search that starts at the memory folder itself.
A restricted session can no longer read files outside its working directories through a missing setting, a browser upload or a search, and a program that embeds Claude Code can still open specific folders through --settings. If you used restricted mode and relied on reads outside the working directories, expect those reads to be refused now.
