[BUG] Claude Code recursively deleted all files in ~/Downloads and ~/Desktop (plus reset ~/Library settings) during a pnpm/lint cleanup — destructive command never written to session log

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

While Claude Code was working on fixing a failing pnpm-based "check lint" workflow — a cleanup-type task (resetting node_modules / pnpm state) — it executed a recursive delete that escaped the project working directory and permanently deleted files across my home directory. Files were removed rm-style (permanently), NOT moved to Trash.

PERMANENTLY DELETED — all file types, not just source code:

• Entire contents of ~/Downloads (documents, installers, archives, images — everything)
• Entire contents of my ~/Desktop project folders (source code AND all other files: docs, assets, configs, data, notes)
• Parts of ~/Library (app settings were reset; macOS re-ran first-login setup on next boot and Touch ID had to be re-enrolled)

This was indiscriminate — every regular file it reached was removed regardless of type.

SURVIVED (the key signature):

• All dot-entries: ~/.Trash (old contents still intact), ~/.claude, project .idea/ folders, .DS_Store, .zsh_history, .zshrc
• Application bundles in /Applications (though their per-user settings were reset)

The surviving dot-entries strongly indicate a glob-based recursive delete (e.g. rm -rf <path>/*), which skips dotfiles in zsh by default — the same signature as #30700.

CRITICAL — the destructive command is not in the session log: there is NO destructive command anywhere in the Claude Code transcripts (~/.claude/projects/). They show only read-only operations (Read, ls, find, git show) and Claude subsequently searching for the already-missing files. This matches the known logging gap in #10077 (tool_result captured, tool_use command NOT captured), so the absence of an rm in the transcript is not evidence it didn't run — it's the documented symptom.

What Should Happen?

Destructive commands (rm -rf, glob deletes, git clean -fdx, node_modules/pnpm cleanup) should never operate outside the session's working directory without explicit user confirmation. Absolute paths and tilde/glob expansion should be sanitized and boundary-checked before execution. Every Bash tool_use command should be logged BEFORE execution (write-ahead logging), so a crash can't erase the audit trail — directly addressing the gap in #10077.

Error Messages/Logs

No error was surfaced to me at the time; the destructive command was never logged. Forensic evidence from a preserved macOS unified-log archive (available on request):

- Three corespotlightd "unlink" waves at 20:38:09, 20:39:05, 20:40:18, ending at the ~/Downloads mtime of 20:40:49 — a progressive recursive delete, not one instant wipe.
- A node process (PID 10104) alive and throwing CoreFoundation teardown/invalidation errors at 20:39:38 and 20:40:08 — dead center in the deletion window (agent crashed mid-operation, as in #30700).
- Folder inode birth-times unchanged; only contents removed, leaving empty directory shells.
- No rm/destructive command in ~/.zsh_history, and none in the Claude Code transcripts.

Steps to Reproduce

1. Open Claude Code in a pnpm project (workspace/monorepo).
2. Ask it to fix a failing lint/CI workflow, which leads it toward cleanup (removing node_modules / resetting pnpm state).
3. During cleanup, a recursive delete escapes the project scope and reaches parent/home directories.

I cannot provide the exact triggering command because it was never written to the session log (see #10077). The command shape is inferred from the aftermath, not recovered verbatim.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.178

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Related existing issues (same class / mechanism):

• #29249 — pnpm worktree cleanup recursive delete escaped scope and wiped entire user profile folders
• #30700 — Claude Code deleted entire ~/Desktop, session crashed, no session log, dotfile-glob survival signature
• #10077 — recursive home-directory delete; log captured tool output but not the command
• #4331 — Claude Code ran rm -rf on a directory it should not have

Environment: macOS (Apple Silicon), FileVault enabled. pnpm monorepo, fixing a "check lint" GitHub Actions workflow. Editors running concurrently: Claude Code CLI, VS Code Claude extension, IntelliJ terminal.

Impact: total loss of the contents of ~/Downloads and ~/Desktop (all file types), plus a reset of user settings. No remote push or backup existed at the time, so most of it is unrecoverable.