[BUG] Nested-memory (`CLAUDE.md`) auto-injection is presented to the model as a user-supplied attachment

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

• Claude Code — desktop app (entrypoint: claude-desktop)
• Version: 2.1.170
• OS: macOS (Darwin 25.5.0)

Summary

When the agent reads or edits a file inside a subdirectory that has its own
CLAUDE.md, Claude Code auto-injects that nested CLAUDE.md into the
conversation as a transcript entry of type: "attachment" with
attachment.type: "nested_memory". The harness wraps it with a
system-reminder worded as:

"This user message contained one or more image, file, or document attachments. The attachment contents have been included as user messages located immediately before this message."

That wording is identical to what a genuine user-supplied attachment
produces, so the model interprets the auto-injected nested CLAUDE.md as a
file the user attached. In my session the model then asked the user "where
is the attachment / what do you want me to look at?" — the user had attached
nothing and was understandably confused. The actual last user prompt at that
point was just "ok".

Steps to reproduce

1. Open a project with nested CLAUDE.md files (a parent dir and a child

subdir each having their own CLAUDE.md).

1. In the desktop app, have the agent read/edit a file inside the child subdir.
2. A transcript entry appears: type: "attachment",

attachment.type: "nested_memory", pointing at the child CLAUDE.md.

1. The model receives a system-reminder describing it as a user-supplied

"image, file, or document attachment."

What Should Happen?

Expected

Auto-injected nested-memory should be labeled to the model as automatic
project context (a nested CLAUDE.md load), clearly distinct from
user-supplied attachments. The model should not believe the user shared a file.

Actual

The nested-memory injection is indistinguishable (to the model) from a user
attachment, causing the model to hallucinate that the user shared something
and to ask about a non-existent attachment.

Evidence (sanitized JSONL excerpt)

{"type":"attachment","attachment":{"type":"nested_memory","path":".../<vault>/CLAUDE.md","content":{"type":"Project","content":"# ...CLAUDE.md contents (~25k chars)..."}},"entrypoint":"claude-desktop","version":"2.1.170","sessionId":"<redacted>"}
{"type":"last-prompt","lastPrompt":"ok","sessionId":"<redacted>"}

### Impact
UX: model asks about phantom attachments; confusing, erodes trust.
Trust boundary: conflating automatically-injected project memory with
user-supplied content blurs the line between trusted system context and
user/external input. Keeping distinct labels matters for both clarity and
prompt-injection hygiene.

### Error Messages/Logs

```shell

Steps to Reproduce

1. Open a project with nested CLAUDE.md files (a parent dir and a child

subdir each having their own CLAUDE.md).

1. In the desktop app, have the agent read/edit a file inside the child subdir.
2. A transcript entry appears: type: "attachment",

attachment.type: "nested_memory", pointing at the child CLAUDE.md.

1. The model receives a system-reminder describing it as a user-supplied

"image, file, or document attachment."

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.170

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

_No response_