"No, ask again next time" in the outside-working-directory Read dialog denies the current read; no allow-once option exists

Bug

When the Read tool targets a file outside the working directories, Claude Code shows a dialog whose third option is labeled as a deferral but actually denies the pending read. Transcribed verbatim from the dialog:

Read outside the working directories

 Read(/Users/<user>/.claude/memory/MEMORY.md)

Auto mode and the sandbox read outside the working directories without asking. Yes or Block settles this question; Ask again asks on the next outside read. Block: the file tools refuse reads outside the working directories in every project. Sandboxed commands are not changed on this machine (the sandbox is off, its filesystem rules are relaxed, a managed read-path lock is on, or the working directory name has glob characters). To undo, remove permissions.blockReadsOutsideWorkingDirectories from your user settings; file tools follow next session, sandboxed commands at once.

Allow reads outside the working directories?
❯ 1. Yes, keep allowing reads outside the working directories
  2. No, block reads outside the working directories from now on
  3. No, ask again next time

Esc to cancel · Tab to amend

Primary defect: option 3 does the opposite of its label for the pending action. "No, ask again next time" reads as a deferral — "don't settle the policy now, ask me later." What it actually does is deny the current read and defer the policy question. The model receives:

The user did not allow this read outside the working directories.

In one session I selected option 3 three separate times, each time expecting the read to proceed and the policy question to be deferred, and each time the read was refused. There is no option that means "allow this one read without settling the global policy."

Secondary, closely related: the dialog's own first sentence states that auto mode reads outside the working directories without asking, yet the read is blocked pending an answer. The stated default (allow) and the observed behavior (block until the policy question is settled) contradict each other inside the same dialog.

Also worth noting: in the same session, the Write tool created two new files in that same directory (~/.claude/memory/) with no dialog at all. Outside-tree writes proceed silently while outside-tree reads are gated on a global-policy decision.

Reproduction

1. Start Claude Code in auto permission mode in any project directory, with permissions.blockReadsOutsideWorkingDirectories unset.
2. Ask Claude to read a file outside the working directory (e.g. ~/.claude/memory/MEMORY.md or any file under ~).
3. When the dialog appears, choose option 3, "No, ask again next time."
4. Observe: the read is refused ("The user did not allow this read outside the working directories"). Repeat; the dialog reappears and the read is refused again. There is no path to completing the read other than option 1, which permanently settles the policy.

Expected

Either of:

• (a) Option 3 is labeled as what it does — "No, deny this read and ask again next time" — and a fourth option, "Yes, allow this read only," is offered; or
• (b) Because the dialog states the default is allow, the read proceeds and the policy question is asked out of band.

Environment

• Claude Code CLI 2.1.272
• OS: macOS
• Permission mode: auto
• permissions.blockReadsOutsideWorkingDirectories: unset
• Observed: 2026-09-22

🤖 Generated with Claude Code