Group of 2 You'll notice
Persistent agent memory can be set read-only for a session, and memory files are no longer read through symlinks or special files
What
- The persistent memory system-prompt builder gained a
readOnlyoption; when set, the prompt tells the model "This memory is read-only this session — you cannot save new memories to it" and omits the save/organize instructions and the memory type list entirely. - Reading an agent's memory file now checks that the entry point is a regular file, not a symlink or other special file, before reading it. If that check fails, the memory content is treated as empty and the session is told the memory is read-only for that turn, with instructions not to create or write files in its folder.
Why
This prevents memory files from being read through a symlink, which could otherwise be used to trick Claude into reading unintended files, and gives Claude Code a clear way to tell the model when it should not attempt to write new memories.