{"version":"2.1.315","anchor":"new-permissionsblockreadsexemptpaths-read-only-from-flag-s","canonical_anchor":"new-permissionsblockreadsexemptpaths-read-only-from-flag-s","heading":"Read blocking outside working directories: restricted mode, exempt paths, searches and Chrome uploads","tier":"use","area":"Permissions","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315\/e\/new-permissionsblockreadsexemptpaths-read-only-from-flag-s","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315","markdown":"### Read blocking outside working directories: restricted mode, exempt paths, searches and Chrome uploads\n\nRestricted mode now blocks reads outside the working directories, searches and Chrome uploads are fenced too, and blockReadsExemptPaths lets chosen paths through\n\n**Unclear.** Under some conditions the exempt list is treated as empty, and it is not clear what those conditions are.\n\n**What**\n\nClaude Code can stop its file tools from reading anything outside your working directories, which are the folders a session is allowed to work in. The setting for this is `blockReadsOutsideWorkingDirectories`. This release extends that read block:\n\n- Restricted mode, which you start with `--restricted`, now turns on the read block by itself, even when `blockReadsOutsideWorkingDirectories` is not set to true.\n\n- A file refused because of restricted mode gets its own error message: `read not allowed under --restricted`.\n\n- Claude in Chrome file uploads in `bypassPermissions` mode (the mode that skips permission prompts) no longer skip the permission check when the session is restricted. In restricted mode, an upload is also refused when only an allow rule permits that file.\n\n- A new setting, `permissions.blockReadsExemptPaths` (also written `blockReadsExemptPaths`), lists extra paths the read block lets through beside the working directories.\n\n- `blockReadsExemptPaths` is honoured only from `--settings` or from settings the program that launched Claude Code passes in. It is ignored in user, project, local and managed settings.\n\n- Each exempt entry must be an absolute local path. It cannot be a filesystem root, contain a `..` segment, or have spaces around it. Invalid entries are dropped with a warning, and in some conditions Claude Code treats the whole list as empty.\n\n- The exempt list is passed to both the read and the write path checks. A new check that runs before the write block can return its own message first.\n\n- Searches are now fenced as well. When the read block is on, the folder a search starts from (its search root) is checked against the same boundary, through `searchRootFence`.\n\n- Auto memory files, the notes Claude Code keeps for itself, stay readable under that fence, including a search that starts at the memory folder itself.\n\n- The description of `blockWritesOutsideWorkingDirectories` no longer mentions `CLAUDE_COWORK_MEMORY_PATH_OVERRIDE`.\n\n**Why**\n\nA restricted session can no longer read files outside its working directories through a missing setting, a browser upload or a search, and a program that embeds Claude Code can still open specific folders through `--settings`. If you used restricted mode and relied on reads outside the working directories, expect those reads to be refused now.\n\n- Area: Permissions\n- Names: `permissions.blockReadsExemptPaths`, `blockReadsOutsideWorkingDirectories`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: both\n- Heads-up: yes"}