[BUG] CRITICAL Permissions problem! Claude executed `rm -rf` without asking!

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude executed rm -rf without asking, even though I never gave him permission to do so.

Fortunately nothing was lost, as this was part of the plan and that folder was meant to be deleted (as it was created by Claude by accident) - though - this could be correct folder as Claude gets often confused about where he is when there are multiple folders with the same name.

<img width="482" height="57" alt="Image" src="https://github.com/user-attachments/assets/1a01713c-5d7a-40a6-b793-90028931f709" />

<img width="453" height="204" alt="Image" src="https://github.com/user-attachments/assets/42b4a74f-5da3-48ef-beb5-b43271935de4" />

<img width="459" height="212" alt="Image" src="https://github.com/user-attachments/assets/55625309-594b-4fa6-a622-8a781909ec51" />

<img width="448" height="204" alt="Image" src="https://github.com/user-attachments/assets/0596dc03-b3b8-4412-959d-9943bb913ec9" />

<img width="447" height="205" alt="Image" src="https://github.com/user-attachments/assets/71393d8a-f345-4e25-b48a-c440d0ab2415" />

<img width="445" height="203" alt="Image" src="https://github.com/user-attachments/assets/25f1a201-be77-420c-a865-718fa29feb2a" />

<img width="444" height="205" alt="Image" src="https://github.com/user-attachments/assets/480264e2-92f2-4c75-8b23-caabc0a34d9d" />

What Should Happen?

Claude should ask for such dangerous commands!

Error Messages/Logs

Steps to Reproduce

Hard to say... usually Claude just asked, never had this issue before.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Don't know

Claude Code Version

2.0.31

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

I am very cautious with giving permissions. I usually give only read permissions globally, and anything else is selected by me. I never gave permission for running rm, and that rm execution was first in that conversation, so there was no even question about "Allow for whole session" in the first place.