Claude Code Keeps Prompting for Read(.env)? Preserve the Deny Rule

If Claude Code 2.1.259 asks for permission whenever it runs a filtered recursive grep or a command after cd, keep your Read(.env) deny rule. The prompt can be a false positive in the command analyzer, but deleting the rule, enabling bypassPermissions, or downgrading in response can trade approval fatigue for secret exposure. Search a named source directory, use Claude Code's built-in Grep tool with a file glob, and avoid cd compound commands until the analyzer is fixed.

Two reports filed against Claude Code 2.1.259 describe related but distinct cases. Issue 91778 shows grep -r prompting even when --include='*.ts' cannot match .env. Issue 91776 shows prompts after a literal cd when the following relative read should be resolvable. Neither report means every prompt is wrong: grep -r . really can read .env, so that prompt should remain.

Classify the prompt before changing anything

Use the command and prompt reason to separate a false positive from a real secret read.

Anthropic documents deny-first rule evaluation. A matching deny wins before an ask or allow rule, and a narrower allow rule cannot override it. That is why adding Bash(grep *) to an allow list does not safely repair this symptom.

1. Confirm the version and rule source

Record the version before assuming you have this regression:

claude --version

Then open Claude Code's permission viewer:

/permissions

Find the exact Read rule and the settings file that supplied it. Common forms include:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)"]
  }
}

Do not edit the rule yet. If the prompt appeared after an update to 2.1.259 and names grep, a denied file under the recursive root, or cd-compound-read, continue with the scoped workarounds below. If the command actually targets .env, the boundary is working.

2. Deny the current broad command once

When the prompt contains a root-wide recursive search, choose the one-time denial. Add a short reason if the prompt supports comments:

Keep Read(.env) enforced. Retry with the Grep tool and a source-only path

Anthropic's permission documentation says a denial comment is returned to Claude as the reason, so the agent can choose a safer call in the same turn. Do not select a permanent approval for a command whose full read set is unclear.

3. Prefer the built-in Grep tool for this search

Ask Claude to keep the search in the dedicated file tool and name both the code path and file glob:

Use the Grep tool, not Bash. Search only src and test for usageEvent.
Limit files to **/*.{js,ts,tsx}. Do not read .env, .env.*, secrets, or the
repository root recursively. Return matching file paths and line numbers only.

Claude Code documents Grep as a read-only tool and applies Read rules to built-in file tools on a best-effort basis. The important distinction is not that Grep bypasses the deny. It does not. The tool receives a structured path and file pattern instead of asking the Bash analyzer to infer what a recursive process might open.

Expected result: the source search completes without reading a denied file. If the Grep tool itself identifies a denied match or prompts, keep the denial and narrow the path again.

4. If Bash is necessary, remove the ambiguous search root

Replace a root-wide command:

rg "usageEvent" . --glob '*.js' --glob '*.ts' --glob '*.tsx'

with named directories that do not contain the secret file:

rg "usageEvent" src test scripts --glob '*.js' --glob '*.ts' --glob '*.tsx'

Confirm those directories before running the command. Do not copy this example if your project stores credentials under one of them.

For a small, reviewed file set, another fail-closed option is to ask the Grep tool for matching paths first and inspect only those paths. Avoid pipelines that rebuild a broad file list through find, xargs, or another recursive command unless you can prove the list excludes the denied path.

5. Remove cd from compound commands

Start Claude Code in the repository it should inspect:

cd /path/to/repository
claude

Then have the agent run relative reads without an embedded directory change:

sed -n '1,40p' README.md

If an agent tool exposes a working-directory field, set that field rather than composing cd ... && command. Keep directory changes and reads as separate, visible steps. This does not weaken the deny rule; it removes a command shape that the current analyzer may fail to resolve.

6. Do not use the tempting unsafe fixes

Do not remove Read(.env)

The regression concerns excess prompts, not the value of the boundary. The issue reports describe 2.1.259 as expanding coverage for file operands and compound commands that could previously escape Read deny analysis. Removing the rule can reopen the risk that broader analysis was intended to close.

Do not add a broad allow rule

Deny rules take precedence over allow rules. A broad Bash allow can also approve command variants you did not review. It is neither a reliable fix nor a safe exception.

Do not switch to bypassPermissions

The issue reports note that deny rules can still trigger under modes intended to reduce prompts. More importantly, bypass mode is not a diagnostic tool for a repository containing real credentials. Preserve the boundary and change the command shape.

Do not pin an older build as the default answer

An older build may avoid the new prompt while also missing the strengthened deny coverage. If you must compare versions, use a disposable fixture with fake secrets and restore the current supported version afterward. Do not test a suspected bypass against production credentials.

7. Move external credentials out of the repository

This bug is easier to contain when the agent never needs provider keys from local files. Aident Vault keeps an integration credential behind a connected account and lets Claude Code discover the current Action contract without copying the secret into the prompt or repository.

Start with the canonical setup and verify the current connection state:

Follow https://aident.ai/SETUP.md

aident account auth status
aident vault vault --action status
aident capabilities search \
  --query "the external service and job I need" \
  --targetEnv staging

Inspect the exact Action returned by discovery, preflight its exact input, and execute only within your approved risk and cost boundary. This does not replace filesystem protection. It removes a common reason for putting reusable provider secrets in .env where an agent session can encounter them.

For the broader permission model, continue to Claude Code Auto Mode: Stop Permission Prompts Safely. For the credential boundary, read How to Give AI Agents API Access Without Exposing Keys. If Claude ignores your requested tool shape, use Claude Code Not Following CLAUDE.md? Enforce the Guardrail.

A reusable recovery prompt

Claude Code 2.1.259 is prompting because a Read(.env) deny rule intersects
with a recursive search or cd compound. Keep every deny rule. Do not use
bypassPermissions, add a broad allow, approve a repository-root recursive
read, or downgrade. First show the exact command and classify whether it can
actually read a denied path. If the search is safe in intent, retry with the
built-in Grep tool, explicit source directories, and an extension glob. If a
shell command is still needed, run from the repository working directory and
remove cd from the compound. Stop if the narrowed path can still contain a
denied file

Set up Aident to keep external credentials out of local agent files.

Questions people ask

Why does grep --include='*.ts' still mention .env?

Claude Code issue 91778 reports that 2.1.259's recursive-read analysis considers the directory contents without fully honoring include filters. Treat that as reported current behavior, not proof that every grep prompt is false.

Can I allow only this grep command?

A narrower command path is safer than a broad allow, but an allow rule cannot override a matching deny rule. Use a structured Grep call or directories that exclude the denied file.

Is Read(.env) enough to protect secrets?

It is one layer. Anthropic recommends pairing permissions with sandboxing for OS-level filesystem and network enforcement. Also keep reusable external credentials in a credential boundary rather than repository files.

When can I remove the workaround?

After a Claude Code release notes a fix for filtered recursive reads or literal cd resolution, repeat the original command against a disposable fixture. Keep the deny rule during and after the test.

Conclusion

A repeated Read(.env) prompt after Claude Code 2.1.259 can be an analyzer false positive, but the safe response is to make the read set explicit. Keep the deny rule, decline the broad command, use the Grep tool or named source directories, and remove cd from compound reads. That restores useful repository search without treating secret access as harmless.

Sources

• Anthropic: Configure permissions in Claude Code

• Anthropic: Sandboxing in Claude Code

• Claude Code issue #91778: filtered recursive grep triggers Read(.env)

• Claude Code issue #91776: literal cd compound prompts

• Aident Loadout setup

• Live Aident Loadout catalog, Vault status, and connected integration contracts inspected September 3, 2026.

Refresh this guide when Anthropic resolves issues 91778 or 91776, changes Bash read analysis or deny-rule precedence, or Aident changes Vault and Action discovery contracts.