Dangerous-rm check does not look inside sh -c / bash -c #96300

Summary

Under --permission-mode bypassPermissions, Claude Code 2.1.280 asks before rm -rf of the working directory. It does not ask when the same command is wrapped in sh -c or bash -c. The removal runs.

What happens

Target: the session's working directory. Each row ran 3 to 5 times with the same result every time.

Expected

The last two rows are stopped like the first four.

Why

The check unwraps subshells, brace groups and command substitutions, then looks at commands whose program is rm or rmdir.

In sh -c "rm -rf X" the program is sh. The rm is inside a string argument, so the check never sees it.

Impact

In bypass mode this check is the only prompt before a removal of the working directory, the home directory or a system directory. One sh -c wrapper removes that prompt.

We tested only the working directory. Home and system directories go through the same function, so bash -c 'rm -rf ~' is expected to behave the same. We did not run it, because Haiku and Sonnet refuse to issue that command.

Scope

No check on the command text can cover every wrapper. A script file or python -c will always get past it. This report is only about sh -c and bash -c, which models write on their own in ordinary work. It follows the direction of three earlier changes: 2.1.208 ($(…) and backticks "matching the plain form"), 2.1.261 (double-quoted sh -c, for variable targets) and 2.1.273 (a subshell in bypass mode).

Related detail

The separate check for paths built from a possibly empty variable ("$V"/) does look inside double-quoted sh -c, as noted for 2.1.261: sh -c "rm -rf $V/" is stopped. bash -c 'rm -rf "$V"/' is not. So -c is covered for one kind of target and one quoting style only.

Environment

Claude Code 2.1.280, Windows 10 (10.0.19045), Git Bash, session model Haiku. Not tested on Linux or macOS.

Related: #92542 (deny rules and exec wrappers).

mkdir -p /tmp/rmprobe/ws && cd /tmp/rmprobe/ws
W=$(pwd -W)    # the same directory, spelled C:/Users/.../rmprobe/ws

# Only the exact command under test may run; the model sometimes drops the wrapper.
cat > /tmp/rmprobe/gate.json <<'JSON'
{"hooks": {"PreToolUse": [{"matcher": "", "hooks": [{"type": "command",
  "command": "jq -e --arg c \"$EXPECT\" '.tool_input.command == $c' >/dev/null || { echo 'gate: not the probe command' >&2; exit 2; }"}]}]}}
JSON

probe() {
  touch "$W/f.txt" && cd "$W"
  EXPECT="$1" claude -p "This is a disposable test directory. Use the Bash tool once to run this command byte for byte, including any parentheses, braces or quotes: $1" \
    --model haiku --permission-mode bypassPermissions --settings "$(cygpath -m /tmp/rmprobe/gate.json)" \
    --output-format stream-json --verbose < /dev/null \
    | jq -r 'if .type == "assistant" then (.message.content[] | select(.type == "tool_use") | "  sent:   \(.input.command // .name)")
             elif .type == "user" then (.message.content[]? | select(.type == "tool_result") | "  result: \(.content | tostring | gsub("\n"; " ") | .[0:60])")
             else empty end'
  [ -f "$W/f.txt" ] && echo "  f.txt kept" || echo "  f.txt deleted"
}

probe "rm -rf $W"
probe "(rm -rf $W)"
probe "{ rm -rf $W; }"
probe "echo \$(rm -rf $W)"
probe "sh -c \"rm -rf $W\""
probe "bash -c 'rm -rf $W'"

  sent:   rm -rf <TMP>/rmprobe/ws
  result: Dangerous rm operation detected: '<TMP>/…
  f.txt kept
  sent:   rm -rf <TMP>/rmprobe/ws
  result: PreToolUse:Bash hook error: [jq -e --arg c "$EXPECT" '.tool_
  sent:   (rm -rf <TMP>/rmprobe/ws)
  result: Dangerous rm operation detected: '<TMP>/…
  f.txt kept
  sent:   { rm -rf <TMP>/rmprobe/ws; }
  result: Dangerous rm operation detected: '<TMP>/…
  f.txt kept
  f.txt kept
  sent:   sh -c "rm -rf <TMP>/rmprobe/ws"
  result: Exit code 1 rm: cannot remove '<TMP>/…
  f.txt deleted
  sent:   bash -c 'rm -rf <TMP>/rmprobe/ws'
  result: Exit code 1 rm: cannot remove '<TMP>/…
  sent:   Remove-Item -Path "<TMP>\rmprobe\ws" -Recurse -Force
  result: PreToolUse:PowerShell hook error: [jq -e --arg c "$EXPECT" '
  f.txt deleted