Writes into managed settings drop-in folders are harder to slip past

Managed settings are settings an organisation's administrator enforces on Claude Code. A drop-in folder is a folder where extra managed settings files can be placed. When Claude Code checks whether a file write touches a protected location, it now also works out where these drop-in folders are.

• If a drop-in folder cannot be located, any write to a .json file is treated as a possible drop-in file.
• If a drop-in folder exists but cannot be opened, because access is denied or the path is not a folder, Claude Code compares paths by name instead.

In both cases Claude Code writes a line to its debug log.