New setting: if CLAUDE_CONFIG_DIR, HOME, CLAUDE_CODE_REMOTE_MEMORY_DIR or similar environment variables change while Claude Code is running without --settings declaring them, the file tools are refused Claude Code's own files and every added folder, and the error names the variables. Read denials now say this setting blocks the read, and leave out the /add-dir hint.
Status fields: session info gains four internal fields, outsideFileToolReadsBlocked, outsideFileToolWritesBlocked, outsideBlocksCountLaunchFoldersOnly and launchEnvLeftOwnFilesInPlace. They report whether permissions.blockFileToolReadsOutsideWorkingDirectories, permissions.blockReadsOutsideWorkingDirectories or permissions.blockWritesOutsideWorkingDirectories is in force. The sandbox's read rules now also take the new setting into account.
ExitWorktree refusals: it refuses to leave when permissions.blockFileToolReadsOutsideWorkingDirectories is set and the folder it would return to is outside the launch folders. It refuses remove when permissions.blockWritesOutsideWorkingDirectories is set and the worktree is outside the launch folders or was made by a WorktreeCreate hook. The message begins "The session stays in the worktree:".
ExitWorktree safety: the call stops if the worktree session changed while it ran, and keep and remove now share one restore routine.
ExitWorktree recovery: when the original folder is gone, the session returns to the launch folder if possible, and the result gains returnedToLaunchDir and tookToLaunch. The permission anchor (the folder permissions are measured from) now stays put with the message "the anchor check refused". Before, it stayed put when it strictly contained the live launch anchor.
ExitWorktree hint: a new when-to-use note says to use it only when you ask to leave a worktree that an earlier tool put the session in, and "do not call it on your own initiative". The tool's stock description, captured under this release, is unchanged at 1,923 characters.
Why
In a locked-down setup, Claude can no longer use ExitWorktree to land outside the folders it was launched with, and a tampered environment makes file reads fail closed. If the original folder was deleted, the session goes back to where it started, and Claude should stop leaving worktrees unless you ask.
