[BUG] Running `claude sessions list` via Bash tool triggers recursive process fork bomb, consuming entire usage quota

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When Claude runs claude sessions list via the Bash tool to search session history, and the user has a shell function wrapping claude with --dangerously-skip-permissions:

claude() { command claude --dangerously-skip-permissions "$@"; }

The function expands the invocation to a full interactive Claude Code instance with all permissions bypassed, instead of just running the CLI subcommand. This cascaded into ~197 concurrent claude --dangerously-skip-permissions sessions list child processes that all hung simultaneously.

Within minutes:

• Load average hit 149.86 on a MacBook (16GB RAM, M-series)
• 0% CPU idle, 940 total processes, 116 in running state
• macOS became barely responsive (UI stuttering, input lag across all apps)
• Entire Claude Max usage quota was consumed by the spawned child processes
• All other running Claude Code instances ground to a halt

What Should Happen?

claude sessions list run via the Bash tool should execute as a simple CLI subcommand and return its output. It should not spawn a full interactive Claude Code session. Ideally Claude Code should:

• Use the absolute binary path when invoking itself, bypassing shell functions/aliases
• Detect when it's being run as a child of another Claude process and prevent cascading
• Have built-in protection against recursive self-invocation

Error Messages/Logs

Load Avg: 149.86, 128.35, 72.86
CPU usage: 23.0% user, 76.99% sys, 0.0% idle
Processes: 940 total, 116 running, 11 stuck, 813 sleeping

~197 instances of:
  /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list

Sample from `ps -eo pid,pcpu,pmem,etime,command`:
  2421   1.9  0.7    07:17 /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
  3048   1.1  0.7    12:08 /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
  4845   1.8  0.8    07:09 /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
 20099   4.8  1.1         /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
 23758   4.5  0.9         /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
 82045   4.1  1.0         /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
 87444   4.0  1.0         /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
 92598   3.8  1.0         /Users/jack/.local/bin/claude --dangerously-skip-permissions sessions list
# ... ~190 more

Steps to Reproduce

1. Set up a shell function: claude() { command claude --dangerously-skip-permissions "$@"; }
2. Start a Claude Code session
3. Ask Claude to find a past conversation (e.g., "find the session where we discussed X")
4. Claude runs claude sessions list via the Bash tool
5. Shell function wraps it with --dangerously-skip-permissions, spawning a full Claude Code instance
6. Child processes multiply uncontrollably (~197 observed)
7. System resources and API usage quota are consumed within minutes

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.140

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

• Session ID: efe214c7-b025-431d-8c9e-0fe522e63177
• The shell function claude() { command claude --dangerously-skip-permissions "$@"; } is defined in ~/.bash_funcs and sourced into all shells
• The Bash tool sources the user's shell profile (via shell snapshots), so the function is active inside Claude's Bash invocations
• Session transcript shows only one claude sessions list Bash call, so the multiplication happened downstream
• 37 orphaned /tmp/claude-*-cwd temp files remained after killing the processes, all timestamped at the same minute
• Session transcript available on request