[BUG] additionalDirectories approved in one project leak into all projects via global settings (project contamination)

[Milupa5]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

When I approve file access to paths outside the primary working directory in Project A, those paths are stored as additionalDirectories in the global settings file (~/.claude/settings.json). When I later open an unrelated Project B, those paths appear as "Additional working directories" in the environment context.

This causes subagents to search in completely unrelated project directories. For example, a subagent tasked with "explore the CV page" in my portfolio project wandered into a different project (Dave-CV) because its path happened to contain "CV" and it was listed as an additional working directory.

This has happened multiple times across sessions.

---

Claude Code VS Code extension
Windows 11
2.1.76 (Claude Code)

What Should Happen?

additionalDirectories should be scoped to the project where access was approved — stored in <project>/.claude/settings.json, not the global ~/.claude/settings.json. Opening a different project should not show directories from unrelated projects.

Error Messages/Logs

# From ~/.claude/settings.json (global, NOT project-specific):

"additionalDirectories": [
  "e:\\SynologyDrive\\PROJECTS\\Dave-CV\\src\\app\\api\\video",
  "C:\\Users\\Milan\\.claude\\plugins\\cache\\claude-plugins-official\\superpowers\\5.0.5\\commands",
  "e:\\SynologyDrive\\PROJECTS\\Dave-CV\\docs\\superpowers",
  "e:\\SynologyDrive\\PROJECTS\\Dave-CV\\.claude"
]

# These Dave-CV paths were approved during a Dave-CV session but appear
# as "Additional working directories" when working in an unrelated project (portfolio-steve).

Steps to Reproduce

1. Open Project A in VS Code with Claude Code extension
2. During a session, approve file access to a path outside the project root (e.g., approve reading a file in another project's directory)
3. The path gets added to ~/.claude/settings.json under permissions.additionalDirectories
4. Close the session. Open Project B (completely unrelated)
5. Start a new Claude Code session in Project B
6. The environment context now shows Project A's paths as "Additional working directories"
7. Subagents may search those unrelated directories, causing confusion and wasted tokens

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.76

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

No response

[yurukusa]

You can prevent cross-project directory contamination with a Notification hook that cleans up stale additionalDirectories at session start:

SETTINGS="$HOME/.claude/settings.json"
[ ! -f "$SETTINGS" ] && exit 0
CWD=$(pwd)
GIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || echo "$CWD")
DIRS=$(jq -r '.additionalDirectories // [] | .[]' "$SETTINGS" 2>/dev/null)
[ -z "$DIRS" ] && exit 0
KEEP=()
REMOVED=()
while IFS= read -r dir; do
    NORM_DIR=$(echo "$dir" | sed 's|\\|/|g')
    NORM_ROOT=$(echo "$GIT_ROOT" | sed 's|\\|/|g')
    if [[ "$NORM_DIR" == "$NORM_ROOT"* ]]; then
        KEEP+=("$dir")
    else
        REMOVED+=("$dir")
    fi
done <<< "$DIRS"
if [ ${#REMOVED[@]} -gt 0 ]; then
    NEW_DIRS=$(printf '%s\n' "${KEEP[@]}" | jq -R -s 'split("\n") | map(select(length > 0))')
    TMP=$(mktemp)
    jq --argjson dirs "$NEW_DIRS" '.additionalDirectories = $dirs' "$SETTINGS" > "$TMP"
    mv "$TMP" "$SETTINGS"
    echo "Removed ${#REMOVED[@]} cross-project directories from additionalDirectories" >&2
fi
exit 0

// ~/.claude/settings.json
{
  "hooks": {
    "Notification": [{
      "matcher": "start",
      "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/project-scope-guard.sh" }]
    }]
  }
}

At session start, the hook reads additionalDirectories from global settings, checks each path against the current git root, and removes any that don't belong to the current project. This prevents subagents from wandering into unrelated project directories.
If you'd rather not modify settings.json automatically, you can use a PreToolUse hook to block tool calls that reference paths outside the current project:

INPUT=$(cat)
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
[ -z "$FILE" ] && exit 0
GIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
if [[ "$FILE" != "$GIT_ROOT"* && "$FILE" != /tmp/* && "$FILE" != "$HOME/.claude"* ]]; then
    echo "BLOCKED: Path $FILE is outside current project ($GIT_ROOT)" >&2
    exit 2
fi
exit 0

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.