deny always wins over allow in Claude Code — the Read(../**) deny rule
was silently blocking the explicitly allowed host paths. When mappings
exist, drop the ../** traversal guard and use explicit Read(./**) allow
instead of blanket Read.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
