━━ environment

block-read-outside-cwd

Block file reads outside the session working directory

enforce● PreToolUse● opt-in● 72 pack installs

━━ when it runs

PreToolUsebefore the tool call runs. a denial here means the command never executes at all.

watchesnarrowed to Read, Glob, Grep, Bash tools

this pack enforces: a match returns a real denial rather than being recorded and discarded. what the denial then does depends on the event above.

this one is opt-in. taking the pack without flags leaves it off until you tick it, so install it by name if you want only this.