Inline-shell rm check flags a command with no -c shell script and no rm (bash script.sh + python3 -c in a loop, bypass mode)

Summary

The inline-shell rm check asks for approval, even in bypass-permissions mode, on a polling loop
that contains no sh -c / bash -c script and no rm. The prompt still says
"This shell -c script runs rm and could not be checked". The command only runs a script file with
bash, pipes its output into python3 -c, echoes, and matches the result with case.

Same family as #99249, #99320, #99630, #100848 and #100850, but every one of those has a real
-c shell script in it. This shape has none.

Environment

• Claude Code 2.1.293 (bundled with the Claude desktop app), macOS
• Permission mode: bypassPermissions
• Seen in the desktop app's Code tab, and reproduced headless with

claude -p --input-format stream-json --output-format stream-json --permission-prompt-tool stdio --permission-mode bypassPermissions,
where the can_use_tool request carries
decision_reason: "This shell -c script runs rm and could not be checked",
decision_reason_type: "safetyCheck", classifier_approvable: false

• Deterministic: the same command asks on every run

Reproduction

./status.sh is any small script (for example echo {}). Each row is one Bash tool call:

| Command | Result |
|---|---|
| for i in $(seq 1 1); do S=$(bash ./status.sh 2>/dev/null); R=$(echo "$S" \| python3 -c "import sys; print(sys.stdin.read())" 2>/dev/null); echo "$(date +%T) $R"; case "$R" in *done*\|*failed*) break;; esac; done | prompt |
| same, without the case … esac | runs |
| same, without the echo "$(date +%T) $R" | runs |
| same, without the for loop | runs |
| for i in 1; do S=$(bash ./status.sh); R=$(echo "$S" \| python3 -c "print(1)"); done | runs |

Impact

The real case was a loop polling a deploy script's status (bash deploy/<script>.sh status) and
parsing it with python3 -c. In the desktop app the prompt froze a background agent until someone
answered it; one such prompt waited many hours. Since nothing in the command removes files, the
expected behavior is no prompt, or at least a reason that does not claim a -c script runs rm.