[Bug] Auto mode ran `pkill -f "cat"`, which killed every GUI app on macOS ("cat" matches /Applications)

Summary

While working in auto mode, a Claude Code session (desktop app, Code tab) ran a Bash command intended to kill a single stuck cat process. Because of pkill -f substring matching, it sent SIGTERM to every GUI app in the user session (Safari, Chrome, Claude itself, Shottr, Mission Control Plus, Notification Center, FontWorker, etc.). Every path under /Applications/... contains the substring "cat" (Applications).

Command that was executed

pkill -f "cat" -n 2>/dev/null; cd <project> && grep -c "..." test/query-routing.test.ts; rm -f /tmp/x

Problems:

1. -f matches against the full command line, as a substring/regex. cat matches /Applications/, Library/Caches, com.apple.location... and more.
2. On macOS (BSD) pkill, option parsing stops at the first non-option argument, so the trailing -n ("newest only") was not treated as an option. Every match was killed, not just the newest.
3. 2>/dev/null plus chaining with ; hid any signal that something went wrong, so the agent kept working without noticing.

Evidence (unified log, macOS)

launchd: [gui/501/com.apple.FontWorker [483]] exited due to SIGTERM | sent by pkill[63091]
launchd: [gui/501/application.io.fadel.MissionControlPlus...] exited due to SIGTERM | sent by pkill[63091]
launchd: [gui/501/com.apple.cmfsyncagent [497]] exited due to SIGTERM | sent by pkill[63091]
launchd: [gui/501/application.cc.ffitch.shottr...] exited due to SIGTERM | sent by pkill[63091]
loginwindow: client process (pid 930 = Safari) ... exited

The transcript timestamp of the Bash tool call (03:29:17Z) matches the log timestamps exactly.

Expected behavior

• The auto-mode classifier / permission layer should treat broad process-killing commands (pkill -f <short pattern>, killall, pkill without -x, especially with output suppressed) as dangerous and require confirmation. Better still, the agent should be steered toward kill <PID> after pgrep -x/pgrep -lf inspection.
• The model should not use pkill -f with a short common word as the pattern.

Environment

• Claude Code 2.1.293 (Claude desktop app, Code tab), auto mode
• macOS 26.6.2 (25G83), Apple Silicon (Mac16,10)

Related

#99281, #72153, #90070, #94632. Same class of bug; this report adds a concrete macOS repro where a 3-letter pattern takes down the whole GUI session via /Applications matching, and where -n was silently ignored due to argument order.