Two TypeScript SDK releases on two consecutive nights, both turning the same screw. claude-agent-sdk 0.3.316, out on October 31, adds permissions.blockReadsExemptPaths to the Settings type: a list of paths that blockReadsOutsideWorkingDirectories lets through without turning them into working directories.
Why that distinction matters
Until now a path outside the working directories had two states: blocked, or promoted to a working directory. The second option drags a lot along with it — write access, a loaded CLAUDE.md, memory directories, indexing. If all you wanted was to read one shared config file, you ended up opening half the sandbox.
blockReadsExemptPaths separates the two. The listed paths can be read, and nothing else follows.
Who is allowed to set the list
That is the second half of the news: the exemptions are read only from --settings and from the settings the host application sends. A project settings file in the repository cannot set them. For a security setting that is the right call — a repository that ships its own read exemptions would be exactly the hole the block exists to close.
What 0.3.314 brought the night before
The October 30 release belongs to the same line of work:
permissions.blockWritesOutsideWorkingDirectorieslanded in theSettingstype — the write-side counterpart introduced by Claude Code 2.1.314.sandbox_required_unavailableis a new value forstartup_failure_reason, written when a required sandbox cannot run.prewarm()is available in alpha from the@anthropic-ai/claude-agent-sdk/coreentry point.- Fixed: a settings file left out of
settingSourceswas still supplying some settings, among them auto mode rules and saved permission consents.
The Python SDK followed on both nights (0.2.175 and 0.2.176) with nothing of its own — it just bundles the matching CLI version.
Permissions are moving into the SDK
A few months ago, sandbox behavior and the read and write blocks were the CLI’s business, configured through managed-settings.json. Now the same keys are typed in the SDK, in the order 2.1.316 ships them. If you embed agents in your own application, the permission layer arrives as a contract instead of a config file. It is boring, and that is the point.