A new always-deny rule set, alwaysDenyRules.hostCredential, blocks tools from reading Claude's own credential and config files. It covers .claude.json, its backup variants, key files, resume markers, and the CLAUDE_CODE_HOST_CREDS_FILE path, closing off odd paths, swap files, and backups as read vectors.
Names in the bundle.claude.jsonCLAUDE_CODE_HOST_CREDS_FILE
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Use Claude Code features in the SDK touched a line naming .claude.json after this was published.
When you omit `settingSources`, `query()` reads the same filesystem settings as the Claude Code CLI: user, project, and local settings, CLAUDE.md files, and `.claude/` skills, agents, and commands. To run without these, pass `settingSource…agent-sdk/claude-code-features see the edit
Confirmed since
Anthropic's documentation has since written up .claude.json, on CLI reference.
| `claude project purge [path]` | Delete all local Claude Code state for a project: transcripts, task lists, debug logs, file-edit history, prompt history lines, and the project's entry in `~/.claude.json`. Omit `[path]` to pick from an in…cli-reference see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up .claude.json, on CLI reference.