Bash safety check says "This shell -c script runs rm" for `$VAR … -- sh -c '…'` with no rm anywhere (bypass mode)

Summary

The inline-shell rm check asks for approval on a command that passes an sh -c script as an
argument to a command whose name is a variable. Neither the script nor the rest of the command
contains rm. This happens in bypass-permissions mode too, and an unattended session
auto-denies the command after the timeout. That breaks routine tooling such as test runners that
take a command to run (runner … -- sh -c '…').

Same family as #100848 (cd … && prefix), #99630 ($VAR command with a {…,…} argument),
#99320 and #99249. This shape is not covered by any of them: the sh -c script is an argument of
a $VAR command, and the cd is inside the script.

Environment

• Claude Code 2.1.294 (CLI), Linux 7.2.6 (CachyOS), bash
• Permission mode: bypassPermissions
• Reproduced with no PreToolUse rewriting: the command in the prompt is exactly the command the

model wrote

Reproduction

Each row is one Bash tool call in an interactive session in bypass mode:

| Command | Result |
|---|---|
| echo "format!" && sh -c 'true' | runs |
| X=/bin/echo; echo "Ruling: helper (clippy lint)" >> /dev/null && $X done -- sh -c 'cd /tmp && true' 2>&1 \| tail -1 | prompt |

The prompt reads:

This shell -c script runs rm and could not be checked
⚠ Claude Code will automatically deny this request in 1:52, to avoid blocking progress on an unattended session

Do you want to proceed?
❯ 1. Yes
  2. No

The real-world case that hit it was a task runner taking its test command as arguments:

$S/task-done plans/x.md 6 6acaf47 -- sh -c '/tmp/hc-sync.sh && cd /tmp/hc-ws && cargo test -p xtask --test proofs'

Expected

Either the check inspects the sh -c script (cd /tmp && true, no rm) and lets it run, or,
if it cannot, the prompt says that it could not check the script. It should not say the script
"runs rm".

Actual

The prompt says the script "runs rm". It cannot be pre-approved, so bypass mode still blocks on
it and unattended sessions auto-deny it.

Notes

• Not bisected further. Two features of the flagged command are absent from the passing one:

the sh -c script is an argument of a $VAR command, and the script starts with cd … &&.

• Workaround: put the script in a file and pass its path instead of sh -c '…'.