[BUG] Security: Can delete files outside working directory using absolute paths

⏺ Environment

• Platform (select one):
• Anthropic API
• Claude CLI version: 1.0.44
• Operating System: macOS 24.6.0 (Darwin)
• Terminal: Not specified

Bug Description

Claude Code can delete files outside the allowed working directory by using absolute paths or tilde expansion (~/), creating a serious
security vulnerability. While cd commands to parent directories are properly blocked, file operations like rm, cat, etc. can access and
modify files anywhere on the system.

Steps to Reproduce

1. Start Claude Code in a project directory (e.g., /Users/username/project)
2. Run a command like rm -f ~/important-file.txt or rm -f /etc/some-config
3. The file deletion succeeds despite being outside the working directory
4. Verify that cd ~ is properly blocked with error: "cd to '/Users/username' was blocked"

Expected Behavior

ALL file operations should be restricted to the working directory and its subdirectories, including:

• File deletion (rm)
• File reading (cat, less, etc.)
• File writing (echo >, cp, etc.)
• Any command using absolute paths or tilde expansion that reference outside the working directory

Actual Behavior

• cd commands to parent directories are blocked ✓
• File operations with absolute paths are NOT blocked ✗
• Commands like rm -f ~/file successfully delete files outside the project
• This allows unintended access to the entire file system

Additional Context

This was discovered when attempting to clean up pnpm workspace files. The command rm -f ~/pnpm-workspace.yaml ~/pnpm-lock.yaml successfully
deleted files from the user's home directory, despite the expectation that Claude Code would be sandboxed to the project directory.

This is a critical security issue as it allows Claude Code to modify or delete any file the user has permissions for, potentially including
system files, SSH keys, or other sensitive data.