Critical Data Loss Incident: repository appears deleted or renamed during/after indexing on Windows 11

Support Bug Reports
, ,
9

Thanks for such a detailed analysis. The null bytes pattern and the log timeline are exactly what engineers need.

A few important notes:

Null bytes pattern: the fact that 2 397 files were filled with \x00 when saving metadata like size and name is not a delete or move. It’s an overwrite of the contents. We’ve seen a similar pattern in another report My huge python file is corrupted by Cursor but that one was over SSH. A local Windows case at this scale is new.

Claude Code plus Cursor worktrees are two possible vectors:

  1. WorktreeCleanupCron was registered at 10:38:28. Cursor detected Claude Code worktrees like worktree-agent-a4be8c82 via the Git extension. There’s a confirmed bug Cursor's WorktreeManager force-deleted my git branch when cleaning up agent worktrees where the cleanup logic uses git branch --contains and deletes all branches that contain a commit, not only branches created by Cursor. If cleanup tried to remove Claude Code worktrees, that could have triggered cascading damage.

  2. Another known vector is Cursor overwriting .git/worktrees/*/gitdir Agent modifies git internal files outside workspace, corrupting worktree references redirecting git internal references to Cursor-managed paths. If Claude Code worktrees were active and Cursor was modifying gitdir references in parallel, that could break the .git structure.

A path with a space like Entraf Ryzen is also worth checking as an extra factor in path parsing.

Questions:

  1. Was Claude Code active and doing operations at the time of the incident around 11:52:37? If you have Claude Code logs from that session, that would really help confirm which tool executed the file operations.
  2. Does the .claude/worktrees/ directory still exist in the project? What’s inside it? Keep in mind those are also git worktrees. Without .git they won’t work either, so they probably won’t help much for file recovery.
  3. When you ran Claude Code, how many worktrees did it create? Cursor loaded 9 worktree metadata entries at 10:38:26. Were all 9 from Claude Code, or were some created by Cursor?

Recovery: since .git is gone and you already re-cloned, try Volume Shadow Copy or File History on Windows. If it was enabled, you might be able to restore earlier versions of the files from before the incident.

This looks like a new variant of the worktree cleanup issue. It’s likely the interaction between Cursor worktree management and external worktrees like Claude Code plus null bytes corruption plus a Windows path with a space. Let me know if you can share Claude Code logs.