New file-tool read block that only the launching program can set

What

Claude Code has a new setting, permissions.blockFileToolReadsOutsideWorkingDirectories. It stops the file tools reading outside the working directories, the folders the session was told to work in. The file tools are how Claude reads and edits files.

• With the setting on, a permission check that used to approve a read automatically now refuses to, when a further condition holds. The findings do not show what that condition tests.
• A blocked read shows: "Reads outside the working directories are blocked (permissions.blockFileToolReadsOutsideWorkingDirectories)."
• This setting, along with blockReadsExemptPaths and workingDirectoriesAsGiven, is now ignored in settings files and managed settings. Only the program that starts Claude Code can set them, through --settings. A warning says so.
• The warning suggests settings files use permissions.blockReadsOutsideWorkingDirectories instead, which also covers shell commands.
• A second warning appears if something other than the launching program changed the related environment during a session.

Why

If you put these keys in a settings file or managed settings, they will not take effect. Use permissions.blockReadsOutsideWorkingDirectories there instead. Programs that embed Claude Code, such as SDK hosts, need to pass these keys through --settings.