Memory reads silently fail when Claude-3p workspace sandbox excludes ~/.claude directory

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?
When Claude Code (Claude-3p) is deployed with a restricted workspace configured via AppData\Local\Claude-3p\config.json, the memory system can write files to ~/.claude/projects/<project-id>/memory/ successfully, but cannot read them back. At session start, when Claude attempts to load MEMORY.md and associated memory files into context, the reads are blocked by the workspace sandbox. The session proceeds with no memory context, with no indication to the user that memory files exist but are inaccessible.

What Should Happen?
Either: (1) the memory system's read path (~/.claude/projects/.../memory/) should be automatically included in the allowed workspace since it is an internal system path required for a core feature to function, or (2) Claude-3p should surface a clear warning at session start when memory files exist on disk but cannot be read due to workspace restrictions defined in config.json.

Error Messages/Logs
Path is outside the workspace folders allowed by your administrator

Steps to Reproduce

1. Deploy Claude-3p (desktop app, Windows) with workspace folders restricted in AppData\Local\Claude-3p\config.json to a user documents directory (e.g. C:\Users\<user>\Documents\Claude) — do not include C:\Users\<user>\.claude as an additional working directory.
2. Start a session and trigger a memory write (e.g. share a preference or ask Claude to remember something). Write succeeds.
3. Start a new session — Claude attempts to read C:\Users\<user>\.claude\projects\<project-id>\memory\MEMORY.md and associated files.
4. Reads fail silently with the permissions error above.
5. Claude has no memory context despite memory files existing on disk.

Claude Model
claude-sonnet-4-6

Is this a regression?
Unknown — behavior observed on current deployment.

Claude Code Version
[insert output of claude --version here]

Platform
Claude-3p (Claude Code desktop app)

Operating System
Windows 11 Enterprise 10.0.26200

Terminal/Shell
bash (Git Bash)

Additional Information
Workaround: add C:\Users\<user>\.claude (or at minimum C:\Users\<user>\.claude\projects\<project-id>\memory\) as an additional allowed working directory in AppData\Local\Claude-3p\config.json. The broader security implication of allowing the full .claude directory vs. restricting to only the memory subfolder is worth noting — session transcripts (projects/*.jsonl) would also become readable if the full .claude path is added.

`