[BUG] Attached folder silently dropped due to phantom server-side protected root

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

The Claude desktop app (Cowork mode) refuses to mount C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault, citing an overlapping "protected host location" at C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault\\Scheduled.

That directory has never existed on any machine associated with this account. No local configuration file contains the entry. The folder is nonetheless dropped at session start, silently, while the UI continues to display it as attached.

There are three distinct defects here:

1. A protected root is registered against a path that does not exist and has no corresponding scheduled task.
2. The drop is silent — no error surfaces to the user; the composer chip still shows the folder as connected.
3. The app reports host filesystem paths (AppData\\Roaming\\Claude\\...) that do not exist on the host.

Environment

|Field|Value|
|-|-|
|App version|1.34493.1|
|CCD version|2.1.237|
|Platform|win32 x64, Electron, Node 24.18.1|
|Machine|PC (Windows)|
|Second machine|macbook (macOS), same vault via OneDrive|
|Log file|%LOCALAPPDATA%\\Claude\\Logs\\main.log|

Observed behavior

1\. Silent drop at session start

Three occurrences across the retained log window, one per session that attached the vault root:

2026-08-21 13:43:30 \[warn] \[Lifecycle] Dropping folder overlapping protected root
  from session local\_98d3f024-36cf-4a93-adab-888f58a54599:
  C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault
  (root: C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault\\Scheduled)

2026-08-29 15:49:08 \[warn] \[Lifecycle] Dropping folder overlapping protected root
  from session local\_58452899-ed2d-40cf-8c3a-918eef4d9dce: ...

2026-08-31 13:31:51 \[warn] \[Lifecycle] Dropping folder overlapping protected root
  from session local\_a00f2565-eabe-4c70-ac69-7fc865f7024c: ...

The session begins, the folder is dropped roughly one second later, and the agent starts with no filesystem access and no indication that anything was removed.

2\. Two policy checks disagree, and the UI follows the wrong one

2026-08-31 13:31:33 \[info] LocalAgentModeSessions.isFolderTrusted:
  C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault -> true
2026-08-31 13:32:18 \[info] LocalAgentModeSessions.addFolderToSession:
  sessionId=local\_a00f2565..., path=C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault

The trust check passes and the folder renders in the composer as attached. The protected-root check then rejects it. The UI reflects the first result, the filesystem reflects the second, so the folder appears connected and is not.

3\. Explicit mount requests are refused

2026-08-31 13:33:58 \[info] \[canUseTool] Denying request\_cowork\_directory pre-prompt:
  protected host location {
    sessionId: 'local\_a00f2565-eabe-4c70-ac69-7fc865f7024c',
    requested: 'C:\\\\Users\\\\nick\_\\\\OneDrive\\\\Documents\\\\obsidianvault',
    resolved:  'C:\\\\Users\\\\nick\_\\\\OneDrive\\\\Documents\\\\obsidianvault',
    deniedRoot:'C:\\\\Users\\\\nick\_\\\\OneDrive\\\\Documents\\\\obsidianvault\\\\Scheduled'
  }

Also observed, same cause:

2026-08-31 13:27:31 \[info] \[canUseTool:HostLoop] Glob → block
  (PreToolUse: C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault)

4\. The protected path does not exist

On PC:

PS> Get-ChildItem "C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault" -Force |
      Where-Object Name -like "\*Sched\*"
PS>   # no output

Same result on macbook. Requesting the path directly returns:

Path "C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault\\Scheduled"
doesn't exist or isn't accessible.

So the guard blocks a parent directory on account of a child that is not present on either machine.

5\. No scheduled task corresponds to it

list\_scheduled\_tasks returns No scheduled tasks found. Across the entire log the protected root is only ever consulted — never registered, never created. Its origin predates the retained window (earliest occurrence 2026-08-21).

6\. Reported host paths do not exist

The session reports its working directory as:

C:\\Users\\nick\_\\AppData\\Roaming\\Claude\\local-agent-mode-sessions\\...\\outputs

and main.log contains 234 references to C:\\Users\\nick\_\\AppData\\Roaming\\Claude. On disk:

PS> whoami
PC\\nick\_
PS> $env:APPDATA
C:\\Users\\nick\_\\AppData\\Roaming
PS> Test-Path "C:\\Users\\nick\_\\AppData\\Roaming\\Claude"
False
PS> Test-Path "C:\\Users\\nick\_\\AppData\\Roaming\\Claude\\local-agent-mode-sessions"
False
PS> Get-ChildItem "C:\\Users\\nick\_\\AppData\\Roaming" -Force | Where-Object Name -like "\*Claude\*"
d-----   7/16/2026  6:15 PM   Claude Code

A Write tool call to a path under that tree returned success. Test-Path on the parent remained False afterward, so the write did not reach the host. The only real footprint of the desktop app on this machine is %LOCALAPPDATA%\\Claude\\Logs.

This matters beyond cosmetics: an agent told it has written a deliverable to the user's disk has not, and cannot tell.

Elimination trail — the entry is not stored locally

|Location|Result|
|-|-|
|%APPDATA%\\Claude\\|Does not exist|
|%LOCALAPPDATA%\\Claude\\|Contains Logs only|
|%APPDATA%\\Claude Code\\|No reference to obsidianvault|
|%USERPROFILE%\\.claude.json|Only unrelated scheduledDelayMillis telemetry key|
|%USERPROFILE%\\.claude\\settings.json|No reference to obsidianvault in any escaping|
|%USERPROFILE%\\.claude\\daemon.status.json|No reference to obsidianvault in any escaping|
|%USERPROFILE%\\.claude\\ (recursive, excl. transcripts)|No match for obsidianvault\\Scheduled|

Only CLAUDE.md, history.jsonl, and session transcripts mention the vault, and none of those drive mount policy.

Conclusion: the protected root is account-level and server-pushed. Consistent with other config in the log arriving marked source: server, and with identical behavior on a machine where the directory has never existed. No local edit can clear it.

Impact

Every session against this vault since at least 2026-08-21 has started without the filesystem access it appeared to have. The failure is invisible from the UI, and the only user-side remedy is renaming the vault root so the stored absolute path stops matching — which orphans Claude Code project history keyed on the old path.

Suggested fixes

1. Do not register or enforce protected roots for directories that do not exist.
2. Surface folder drops to the user; never fail silently.
3. Make isFolderTrusted and the protected-root check agree before the UI renders a folder as attached.
4. Provide a way to inspect and clear account-level protected roots.
5. Reconcile reported host paths with the actual install location, and fail loudly when a host write cannot be performed.

Workaround

Subdirectories of the vault mount normally, since they do not contain the phantom path. Confirmed working: \\Caretaker, \\Calendar, \\Homelab, \\Homelab\\3D Printing.

What Should Happen?

Expected vs actual

Expected: the vault mounts. Failing that, the user sees an error explaining why.

Actual: the folder is silently discarded, the UI shows it as attached, and the agent starts blind. Diagnosis required reading main.log directly.

Error Messages/Logs

Steps to Reproduce

1. Attach C:\\Users\\nick\_\\OneDrive\\Documents\\obsidianvault as the session folder.
2. Start a Cowork session.
3. Observe the folder chip displayed in the composer.
4. Ask the agent to list the folder — it has no access.
5. Grep main.log for Dropping folder overlapping protected root.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown

Claude Code Version

Claude 1.40609.0 (f65e38) 2026-08-27T16:19:51.000Z

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_