{"record":{"id":"9dc7643b2c570bd7","repo":"zed-industries/zed","slug":"cannot-read-file-because-its-path-matches-the-work-9dc764","errorCode":null,"errorMessage":"Cannot read file because its path matches the worktree `private_files` setting: {}","messagePattern":"Cannot read file because its path matches the worktree `private_files` setting: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/agent/src/tools/read_file_tool.rs","lineNumber":327,"sourceCode":"                }\n\n                if global_settings.is_path_private(&project_path.path) {\n                    anyhow::bail!(\n                        \"Cannot read file because its path matches the global `private_files` setting: {}\",\n                        input.path\n                    );\n                }\n\n                let worktree_settings = WorktreeSettings::get(Some((&project_path).into()), cx);\n                if worktree_settings.is_path_excluded(&project_path.path) {\n                    anyhow::bail!(\n                        \"Cannot read file because its path matches the worktree `file_scan_exclusions` setting: {}\",\n                        input.path\n                    );\n                }\n\n                if worktree_settings.is_path_private(&project_path.path) {\n                    anyhow::bail!(\n                        \"Cannot read file because its path matches the worktree `private_files` setting: {}\",\n                        input.path\n                    );\n                }\n\n                anyhow::Ok(())\n            }).map_err(tool_content_err)?;\n\n            if fs.is_dir(&abs_path).await {\n                return Err(tool_content_err(format!(\n                    \"{} is a directory, not a file. Use the list_directory tool to explore directory contents.\",\n                    input.path\n                )));\n            }\n\n            if let Some(canonical_target) = &symlink_canonical_target {\n                let authorize = cx.update(|cx| {\n                    authorize_symlink_access(","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/zed-industries/zed/blob/bc538def4545534201bbfcac4e95ac34ea6501b6/crates/agent/src/tools/read_file_tool.rs#L309-L345","documentation":"The last settings gate of read_file: the file matches the worktree-level private files setting (`private_files`, enforced via is_path_private on worktree-scoped WorktreeSettings). It is a repository-scoped security boundary — files under it are kept out of agent context even when global settings allow them.","triggerScenarios":"read_file where global exclusions and private_files pass but the worktree's `private_files` globs match the requested path.","commonSituations":"A repo checks in .zed/settings.json marking local key files or environment dirs private; the agent attempts to read one during debugging.","solutions":["Respect the policy — do not read the private file via the agent","Narrow the worktree `private_files` glob in .zed/settings.json if it accidentally matches non-secret files","Move non-secret content out of the private-matching path"],"exampleFix":"// before — <repo>/.zed/settings.json\n\"private_files\": [\"local/**\"]\n\n// after — only the credentials dir is private\n\"private_files\": [\"local/creds/**\"]","handlingStrategy":"validation","validationCode":"let private = project.read_with(cx, |_, cx| {\n    WorktreeSettings::get(Some((&project_path).into()), cx)\n        .is_path_private(&project_path.path)\n});\nif private {\n    // repo-declared private file; refuse before calling read_file\n}","typeGuard":null,"tryCatchPattern":"On the worktree `private_files` message, stop and report the policy; never retry or bypass.","preventionTips":["Declare only genuine secret paths in worktree private_files settings","Treat any private-files error as intended behavior, not a configuration bug"],"tags":["agent","read-file","private-files","worktree-settings","security"],"backgroundTag":null,"analyzedSha":"bc538def4545534201bbfcac4e95ac34ea6501b6","analyzedAt":"2026-08-16T07:30:46.435Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}