anthropics / anthropics/claude-code

Project memory/session storage collides across different projects due to non-ASCII path slug encoding

Aberta
#93,743 3 comentários 0 reações 0 responsáveis Ver no GitHub
area:core bug platform:windows
Linguagem predominante
Python
Estrelas
145k
Forks
23.1k
Métricas de merge de PRs
Métricas de PR pendentes

Descrição

### Summary
Claude Code derives a project storage directory (under `~/.claude/projects/`) by
converting the working-directory path into a slug. Non-ASCII characters (e.g. Korean)
appear to be collapsed into a generic `-` regardless of their actual content, so two
completely different folder names can produce the *identical* slug. When that happens,
the new project silently inherits (and can overwrite) the memory/session data of an
unrelated — even long-deleted — project.

### Steps to reproduce
1. Create folder A: `C:\Users\\Downloads\근평 웹만들기`, start a Claude Code
session there, let it save project memory (`~/.claude/projects//memory/*.md`).
2. Delete folder A entirely from disk.
3. Create an unrelated new folder B: `C:\Users\\Downloads\비계량지표평가`,
start a Claude Code session there.
4. Observe: Claude Code loads memory files that were written for folder A's project
(a Supabase-based HR evaluation web app) inside folder B's session (an unrelated
HWP/PDF parsing tool), because both paths encoded to the same slug
`C--Users--Downloads--------` (dash count happened to match).

### Expected behavior
- The slug/identifier for a project's storage directory should be unique per real path
(e.g. via a hash of the full path, or percent-encoding non-ASCII bytes instead of
collapsing them to a fixed placeholder).
- Ideally, storage for a path that no longer exists on disk should not be silently
reused by an unrelated new path.

### Actual behavior
- Multiple distinct Korean-named folders under the same parent produced slugs that
differ only in dash *count*, and in this case two different names collided on the
same count, merging their project memories.
- The stale project's storage was never cleaned up after its source folder was deleted,
and was silently "revived" by the new project.

### Impact
- Cross-project data leakage: one project's persistent memory/context appears in an
unrelated project's session, which is confusing and could expose unrelated
business/technical details across projects.

### Environment
- OS: Windows 11 Pro (10.0.26200)
- Shell: Git Bash / PowerShell
- Claude Code (desktop app, Code tab)

Guia de contribuição

Nenhum guia de contribuição indexado para este repositório

Direção de pesquisa

Start by locating the code that converts working-directory paths into storage directories under ~/.claude/projects/, then reproduce the two Windows examples. Done means distinct real paths receive distinct identifiers and storage from a deleted path is not silently reused by an unrelated project; verify the behavior with the reported Korean folder names.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Stack de tecnologia
bash, powershell
Domínio
backend, security
Tipo de issue
Bug
Dificuldade
4/5
Tempo estimado
3-5 dias
Status de atividade
Ativa
Clareza
Razoavelmente clara
Facilidade para iniciantes
55/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.