Claude Code v2.1.323 · 12 Nov 2026
Blocking file reads outside your project can only be set at launch
permissions.blockFileToolReadsOutsideWorkingDirectories is now ignored when sent to a running session and counts only in --settings at launch
You'll notice Tier: how much it should matter to you
2 Useful: my rating, 1 to 5
1 Signal: worth watching, 1 to 5
Permissions Area: what it touches
Improvements Kind: in v2.1.323, 12 Nov 26
Improvements Section of the release
What
The permission permissions.blockFileToolReadsOutsideWorkingDirectories --settings
Claude Code also now records an event when a session leaves bypass-permissions mode, the mode where Claude acts without asking you first.
Why
This keeps the file-read restriction from being switched in the middle of a session. If you depend on it, pass it in --settings when you launch Claude Code.
How sure we are
One source agrees One thing we can check says the same as this entry.
Anthropic's release notes agree Fixed a case where the Write and Edit tools could write to a path covered by a Read deny rule
See this entry in the whole of v2.1.323 →
12 Nov 2026 · 888 entries, this one is #333.
77 533 64 214
Open the release →
Names in this entry
setting blockFileToolReadsOutsideWorkingDirectories A new blockFileToolReadsOutsideWorkingDirectories option appears and is removed along with similar options when permissions are prepared for remote runs
cli --settings Path to a settings JSON file or an inline JSON string. Values you set here override the same keys in your settings.json files for this session. Keys you omit keep their file-based values. The file must be a regular file no larger than 2 MiB. See settings precedence
setting permissions.blockFileToolReadsOutsideWorkingDirectories permissions.blockFileToolReadsOutsideWorkingDirectories stops Claude's file tools reading outside the folders Claude Code was launched with
Anthropic's notes
Upstream's own release notes for v2.1.323 name something this entry names, so the two are probably about the same change. Probably: the pairing is made on a shared name rather than on the words around it.
Fixed a case where the Write and Edit tools could write to a path covered by a Read
Fixed claude -p and the Agent SDK running Bash unsandboxed when --settings
Changed start-up to stop when a --settings sandbox
Changed a managed settings policyHelper --settings env
Is this right?
0 0 Feedback
What's wrong with this entry?
Hard to understand Too vague Looks wrong Not relevant to me Too long Missing the detail I wanted Duplicate of another card
Clear Learned something new I can act on this Good catch
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
← Previous · 332 of 888
Theme colors must be a whole palette and refuses names like __proto__
You'll notice Elsewhere
In v2.1.323 Improvements release-page order
Next → · 334 of 888
settings.local.json is now always added to your global gitignore
You'll notice Git
