[BUG] Regression in 2.1.259: managed-settings discovery on WSL fails fatally when /mnt/c is inaccessible (works in 2.1.258)

Workaround, written by GPT 6 Astra:

'use strict';

/*
 * Claude Code 2.1.277 WSL policy-discovery workaround.
 *
 * Fr() probes Windows managed-settings.json and managed-settings.d to discover
 * wslInheritsWindowsSettings. EACCES becomes a fatal admin-policy error even
 * when inheritance was never enabled and the entire Windows mount is private
 * to another user. Both probes must be handled; fixing just stat is not enough.
 *
 * Usage:
 *   BUN_OPTIONS="--preload=/absolute/path/claude-wsl-policy-preload.cjs" claude
 *
 * This native executable supports Bun preloads. Its direct openat syscalls
 * bypass ordinary libc LD_PRELOAD hooks, so patch the actual fs API instead.
 * No global environment, mount permissions, or installed binary is modified.
 *
 * Use only where Windows policy inheritance is not required: an inaccessible
 * Windows policy cannot be inspected to establish whether it was intended.
 * Linux policy and accessible Windows policy keep their normal semantics.
 */
const fs = require('node:fs');
const { constants: { errno } } = require('node:os');
const { syncBuiltinESMExports } = require('node:module');

const mount = '/mnt/c';
const policyFile = '/mnt/c/Program Files/ClaudeCode/managed-settings.json';
const policyDirectory = '/mnt/c/Program Files/ClaudeCode/managed-settings.d';
const accessSync = fs.accessSync;

function isInaccessibleDiscovery(path, error) {
  if (error?.code !== 'EACCES' ||
      (path !== policyFile && path !== policyDirectory)) {
    return false;
  }
  // Check at the time of failure, not once at preload time. Never hide a
  // file-specific permission error on an otherwise traversable Windows mount.
  try {
    accessSync(mount, fs.constants.X_OK);
    return false;
  } catch (mountError) {
    return mountError?.code === 'EACCES';
  }
}

// These are the synchronous APIs used by the installed discovery implementation.
// Keep all overloads/options, receivers, successful results, and other errors.
for (const name of ['statSync', 'readFileSync', 'readdirSync']) {
  const original = fs[name];
  fs[name] = function () {
    try {
      return Reflect.apply(original, this, arguments);
    } catch (error) {
      const path = arguments[0];
      if (!isInaccessibleDiscovery(path, error)) throw error;
      throw Object.assign(new Error(
        `ENOENT: no such file or directory, ${error.syscall} '${path}'`,
        { cause: error },
      ), {
        code: 'ENOENT',
        errno: -errno.ENOENT,
        syscall: error.syscall,
        path,
      });
    }
  };
}

// Node named imports must see the same methods as require('fs'). Bun also
// exposes this API, so the module can be regression-tested with either runtime.
syncBuiltinESMExports();

Still present on 2.1.275.

Setup:

I have a slightly different setup with the same end result: Instead of masking the mount, I run Claude Code as a dedicated unprivileged Unix account with no traverse permission on /mnt. The fact the same error occurs suggests the trigger is any EACCES on that traversal rather than anything specific to the automount mask.

I have no C:\Program Files\ClaudeCode in Windows, and no Settings value under HKLM\SOFTWARE\Policies\ClaudeCode or HKCU\SOFTWARE\Policies\ClaudeCode.

On the same WSL2 machine using a standard account with access to /mnt, running claude produces no warning at all, presumably because claude sees the path is absent entirely and correctly continues.

Partial workaround:

Creating a non-empty /etc/claude-code/managed-settings.json downgrades the fatal exit to a prompt each time claude is started. Any setting seems to work - I tested with {"spinnerTipsEnabled": true}, {"cleanupPeriodDays": 30}, and {"permissions": {"deny": ["Read(//mnt/**)"]}}. Notably, {} does NOT work, so it does need a valid key.

Here's the error on startup with /etc/claude-code/managed-settings.json populated with {"spinnerTipsEnabled": true}:

Settings Error

  /mnt/c/Program Files/ClaudeCode/managed-settings.d
  └ Managed settings drop-in directory could not be read: EACCES: permission denied, scandir '/mnt/c/Program Files/ClaudeCode/managed-settings.d'
  /mnt/c/Program Files/ClaudeCode/managed-settings.json
  └ Settings file could not be read: EACCES: permission denied, stat '/mnt/c/Program Files/ClaudeCode/managed-settings.json'

  Files with errors are skipped entirely, not just the invalid settings.

    1. Fix with Claude
    2. Exit and fix manually
    3. Continue without these settings

Choosing 3 starts the session. But Claude still treats it as an error even when a local admin source supplies a policy, so this happens on each start.

Version: 2.1.275
Login: claude.ai subscription.
Platform: WSL2, Debian, Claude Code installed inside the distribution via the Linux installer

Same issue for me. Downgrading to 2.1.258 fixed it. Only difference for me was that I had Claude Code installed on Windows itself.