claude-code - 💡(How to fix) Fix [Feature request] Local Claude Code logs allow state reset via manual deletion [1 participants]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Claude Code stores internal logs and state-related data locally on the user's machine in a way that allows users to manually delete or modify them.

This enables unintended resetting of internal state (such as sessions, usage limits, or memory), which may bypass expected safeguards.

Issues Observed

• Users can bypass expected persistence mechanisms by deleting or modifying local files.
• Local storage appears to influence application state beyond just logging.

Potential Impact

• Bypassing usage limits
• Resetting session tracking
• Breaking memory/state consistency
• Security and integrity concerns for local state management

Concern

Critical state appears to be stored in locations that are easily accessible and modifiable by the user, which may not be intended for enforcing application-level constraints.

This behavior could lead to inconsistencies and potential misuse if not properly handled.

What Should Happen?

Expected Behavior

• Logs should be strictly non-critical and should not affect application state.

• Critical state (sessions, limits, memory) should not be resettable via manual file deletion.

• The system should detect tampering with local files and handle it safely.

• Important state should either:

  • be stored securely, or
  • be validated against a trusted source (e.g., backend or integrity checks)

Suggested Improvements

• Separate logging data from critical state data
• Add integrity checks (e.g., hashing or validation)
• Prevent unintended resets caused by local file manipulation

Error Messages/Logs

Steps to Reproduce

1. Install and launch Claude Code (latest version).

2. Start a normal session:

   • Interact with the system to generate state (e.g., prompts, usage tracking).

3. Locate local storage directory:

   • Windows: %APPDATA%/ClaudeCode/
   • Linux: ~/.config/claude-code/
   • macOS: ~/Library/Application Support/ClaudeCode/

4. Navigate to stored files:

   • Identify files such as:
     • session.json
     • usage.json
     • logs/
     • memory/state-related files

5. Modify or delete state files:

   • Example:
     • Open JSON files and reset values (e.g., usage counters → 0)
     • OR delete session-related files entirely

6. Restart Claude Code:

   • Close the application fully
   • Relaunch it

7. Observe behavior:

   • Session resets OR
   • Usage limits are bypassed OR
   • Memory/state inconsistencies occur

Claude Model

Other

Is this a regression?

Yes, this worked in a previous version

2.1.116

No response

Claude Code Version

2.1.116

Platform

Other

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

No response