[BUG] Agent deleted source data with an ungated, redundant rm after a failed mv

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

model emitted an ungated, redundant destructive command causing data loss.
In an agent session, Claude wrote a GCS relocation script that ran gcloud storage mv <src> <dst> (silenced with >/dev/null 2>&1) and then, unconditionally, a trailing gcloud storage rm -r <src_parent>. The mv failed; the failure was swallowed; the rm ran regardless and deleted 36 generated files that had never been copied. Three compounding errors: (1) a destructive rm not gated on the prior step's success; (2) the rm was redundant — mv already deletes the source on success; (3) errors were silenced then treated as success. Requested invariant: never delete/overwrite a source until the destination is verified (copy → verify → delete), and never follow mv with rm.

What Should Happen?

Claude should treat destructive file operations as irreversible and never run them unverified. For a relocate,
use mv alone (it deletes the source only on success) — or copy → verify the destination → then delete; never
add a separate rm, never gate a delete on nothing, and never silence a copy/move and assume it worked. When a
move/copy fails, stop and surface it, leaving the source intact.

Error Messages/Logs

Steps to Reproduce

In an agent session, ask Claude to relocate files between two locations and clean up the old folder (here: move generated clips between two GCS prefixes, then remove the empty source).
Claude writes a shell loop running mv (or gcloud storage mv) with output silenced (>/dev/null 2>&1), followed by a separate, unconditional rm -r of the source.
The mv fails (any cause) — the failure is swallowed.
The trailing rm -r runs regardless and deletes the unmoved files → data loss.

Minimal deterministic demo:

mkdir -p src dst && echo data > src/file.txt
mv --bogus-flag src/file.txt dst/ >/dev/null 2>&1 # fails, silenced
rm -rf src # runs anyway -> file.txt destroyed
ls dst/file.txt # missing; the data is gone

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.177

Platform

Other

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_