[BUG] /logout + /login wipes ~/.claude/ custom files (CLAUDE.md, skills/, sessions/, plans/, settings)

Environment

• Claude Code version: 2.1.39 (first wipe), 2.1.41 (second wipe)
• Installation method: Native installer (Linux)
• OS: Ubuntu 24.04 LTS (native, not WSL)
• Platform: linux x64
• Node version: v24.3.0

Description

Switching between authentication methods using /logout + /login silently deletes user-created files from ~/.claude/. This happened twice within 24 hours — both times triggered by logging out and back in to switch between a LiteLLM/Vertex AI proxy (client work) and Claude Pro OAuth (personal use).

Wipe 1 — Custom files deleted (Feb 12, before 20:50 UTC, v2.1.39)

User tested account switching for the first time — /logout from LiteLLM proxy auth, /login to Claude Pro OAuth. Immediately after, a new session showed:

2026-02-12T20:50:21 — "Loaded 0 unique skills" ← skills/ directory gone
2026-02-12T20:50:22 — "No CLAUDE.md/rules files found" ← CLAUDE.md gone

Files deleted:

• ~/.claude/CLAUDE.md (workspace instructions)
• ~/.claude/skills/ (4 custom skills: memory-jog, memory-update, session-new-month, fgs)
• ~/.claude/memory-system.md
• ~/.claude/working-memory.md
• ~/.claude/sessions/ (monthly session logs dating back to January 2025)
• Most session .jsonl files in projects/ (from ~29 to 9)
• ~/.claude/history.jsonl entries (from ~427 to 51)

However, settings.json survived this wipe — "Found 5 hook matchers in settings" continued to appear throughout the session.

Wipe 2 — settings.json recreated as {} (Feb 13, 16:08 UTC, v2.1.41)

User ran /logout (from LiteLLM proxy) followed by /login (to Claude Pro OAuth) again. This time settings.json was also wiped:

$ stat ~/.claude/settings.json
Birth: 2026-02-13 16:08:17.809777436 +0000  ← new inode, file was recreated
Size: 3 bytes (just "{}")

settings.local.json was also reset (had 27 permission rules, reduced to 3 from current session).

Debug logs from session 777f06a9 show a policySettings change zeroed all permission rules at 16:06:04:

Programmatic settings change notification for policySettings
Settings changed from policySettings, updating app state
Replacing all allow rules for destination 'userSettings' with 0 rule(s): []
Replacing all allow rules for destination 'projectSettings' with 0 rule(s): []
Replacing all allow rules for destination 'localSettings' with 0 rule(s): []

Then at 16:08:18, settings.json was detected as changed (recreated):

Detected change to /home/alkrusz/.claude/settings.json
Settings changed from userSettings, updating app state
Replacing all allow rules for destination 'userSettings' with 0 rule(s): []

Authentication setup context

User configured two authentication methods on the same machine:

• claude-fgs — LiteLLM proxy via 1Password env injection (Vertex AI backend)
• claude — Direct Claude Pro OAuth login

The intent was to switch between client and personal work. Previous Claude session explicitly confirmed that /logout + /login only changes auth, not local files. This turned out to be incorrect.

Full debug log timeline

Feb 12 — Session e3d9ca90 starts on v2.1.39 (AFTER Wipe 1)

20:50:21 — "Loaded 0 unique skills" ← already gone
20:50:22 — "No CLAUDE.md/rules files found" ← already gone
20:50:41 — "Found 5 hook matchers in settings" ← settings.json still alive

Feb 12-13 — Session continues, hooks remain alive

21:36:13 — "Found 5 hook matchers in settings"
22:10:44 — "Found 5 hook matchers in settings"
23:12:23 — "Found 5 hook matchers in settings"
00:19:02 — "Found 5 hook matchers in settings"
01:28:32 — "Found 5 hook matchers in settings"

Multiple session reinits (via /exit + resume) within this session all confirm CLAUDE.md and skills still missing, but settings.json still intact:

22:15:33 — "No CLAUDE.md/rules files found" (reinit)
22:17:07 — "Loaded 0 unique skills" (reinit)
23:23:18 — "No CLAUDE.md/rules files found" (reinit)
23:24:55 — "Loaded 0 unique skills" (reinit)

Feb 13, 14:58 — Auto-update to v2.1.41 (inside running session)

14:58:45 — "Downloading native installer version 2.1.41"
14:58:53 — "Successfully updated to version 2.1.41"

Note: stats-cache.json has "autoUpdates": false but native installer updated anyway.

Feb 13, 15:00 — Post-update, hooks still alive

15:00:57 — "Found 5 hook matchers in settings" ← settings survived the update
16:02:29 — "Found 5 hook matchers in settings" ← last sighting

Feb 13, 16:03 — New session 705d9cb0 (v2.1.41), AFTER Wipe 2

16:03:54 — "Loaded 0 unique skills"
16:03:58 — "No CLAUDE.md/rules files found"
16:03:58 — "Found 0 hook matchers in settings" ← settings.json NOW EMPTY

Feb 13, 16:05–16:08 — Logout/Login cycle completes Wipe 2

16:05:59 — policySettings change zeros all permission destinations
16:08:17 — settings.json recreated as {} (confirmed via stat Birth time)

What was lost (confirmed from backup at ~/Desktop/linux-migration/.claude/)

• CLAUDE.md (698 bytes) — workspace config with skill references and auto-loaded context
• skills/memory-jog/, skills/memory-update/, skills/session-new-month/, skills/fgs/
• working-memory.md — active project context with detailed work state
• memory-system.md — documentation of custom memory system
• sessions/ — monthly session logs (2025-01, 2026-02)
• 20+ session .jsonl files (29 → 9)
• ~376 history entries (427 → 51)
• settings.local.json content (27 → 3 permission rules)
• settings.json hook matchers (5 → 0)
• plans/ contents (implementation plans, not recoverable)
• Work done between Feb 10-13 after the backup (memory system improvement plan, updated working memory, new pensieve docs)

Steps to reproduce

1. Set up Claude Code with custom files in ~/.claude/ (CLAUDE.md, skills/, .md files, settings with hooks/permissions)
2. Authenticate with one method (e.g., API key via env vars for LiteLLM proxy)
3. Run /logout
4. Run /login and authenticate with a different method (e.g., Claude Pro OAuth)
5. Observe that custom files in ~/.claude/ are deleted

Expected behavior

/logout and /login should only modify authentication state (.credentials.json). User-created files (CLAUDE.md, skills/, sessions/, plans/, custom .md files, settings) should be left untouched.

Actual behavior

/logout + /login deletes user-created files from ~/.claude/. The deletion is silent — no warnings, no backup, no confirmation. Two separate wipes occurred within 24 hours, each triggered by the same logout/login pattern.

Impact

• Complete loss of custom memory system (CLAUDE.md, 4 skills, working memory, session logs spanning months)
• Loss of implementation plans created during sessions (not recoverable)
• Loss of ~80% of session history (29 → 9 files, 427 → 51 entries)
• Loss of all permission rules in settings.json and settings.local.json
• No backup created by the logout/login process
• No warning shown to the user
• Account switching workflow is broken — users who need to switch between org/personal accounts cannot do so safely
• User was explicitly told by Claude (in a previous session) that /logout + /login only changes auth — this was incorrect

Related issues

• #9581 — All session data in ~/.claude lost after logout/login (possibly related to npm update/reinstall)
• #5754 — On UPDATE it deleted all settings.local.json files
• #1676 — Persistent Logout & Configuration Loss

Suggested fixes

1. /logout and /login must not touch anything except auth credentials — no file deletion, no settings reset
2. Create automatic backups before any operation that modifies ~/.claude/ structure
3. Separate user data from runtime data — user files (CLAUDE.md, skills/, sessions/, plans/) should be protected from auth/update operations
4. Respect autoUpdates: false — the native installer updated despite this setting being false
5. Support multi-account switching natively — if account switching is a supported workflow, it should be safe by design (e.g., per-account auth config that doesn't touch shared user data)