Recent working folders (.claude.json "projects") are shared across all accounts on the same OS profile

Summary

The list of recent working folders shown in Claude Code is stored in ~/.claude.json under the projects key, which is keyed to the OS user profile, not to the logged-in Claude account. As a result, when more than one Claude account is used on the same machine (same OS profile), each account can see the recent working folders of the other.

Environment

• Platform: Windows 11 Pro
• Config file: C:\Users\<user>\.claude.json

Steps to reproduce

1. On one OS user profile, log in to Claude Code with account A and open some projects (e.g. client/personal folders).
2. Log out and log in with account B (e.g. work account) on the same OS profile.
3. Open the recent-folders picker.

Expected: Only folders associated with the currently logged-in account are shown.

Actual: Folders from account A appear while logged in as account B (and vice versa), because both accounts read the same projects map in ~/.claude.json. Only oauthAccount changes on login; projects is shared.

Why this matters

Folder paths can reveal sensitive information — client names, project codenames, employer-internal repos. Someone using a personal account and a client/employer account on the same computer leaks one context's folder names into the other. There is also no per-folder "forget" action in the CLI; the only remedies today are hand-editing ~/.claude.json or using a separate OS user profile per account.

Suggested fix

• Scope the projects recent-folders list per oauthAccount, or at minimum filter the recent-folders picker by the currently active account.
• Optionally, add a command to remove a single folder from recent history without hand-editing ~/.claude.json.