Inline-shell rm check asks on bash -c with a $VAR command and a {…,…} argument (no rm present)

Summary

The inline-shell rm check (added in 2.1.288, #96300) asks on a bash -c script that contains no rm, when a command whose name is a variable gets an argument containing a {…,…} brace pattern, even a quoted one. The prompt says:

This shell -c script runs rm and could not be checked

It is marked not approvable by rules or the classifier, so it also fires under --dangerously-skip-permissions, and an unattended session auto-denies it after the timeout.

Minimal repro (Claude Code 2.1.289, Linux, bash)

claude -p --dangerously-skip-permissions --output-format stream-json --verbose \
  "Call the Bash tool exactly once with this exact command, unchanged: bash -c 'AB=echo; \$AB \"{a, b}\"'"

Tool result: This command passes a shell -c script that runs rm, and Claude Code could not check the script for dangerous removals. Approve only if you have read the script.

Each row below is one Bash tool call, under --dangerously-skip-permissions:

| Command | Result |
|---|---|
| bash -c 'AB=echo; $AB "{a, b}"' | denied |
| bash -c 'AB="echo x"; $AB "{a,b}"' (multi-line form) | denied |
| bash -c 'AB="echo x"; $AB "{a}"' | runs |
| bash -c 'AB="echo x"; $AB a' | runs |
| bash -c 'echo "{m: a, b}"' | runs |
| AB="echo x"; $AB "{m: a, b}" (no -c) | runs |

The case we hit in practice is a helper variable for a CLI, with a JS object literal as its argument:

bash -c '
AB="agent-browser --session repro"
$AB eval "JSON.stringify({url: location.href, title: document.title})"
'

Expected

A script with no rm is not reported as running rm. If the check can't resolve a variable command name, the message should say so, not claim the script runs rm. A quoted brace pattern is a literal string, not brace expansion.

Why it matters

• The prompt tells the user something untrue about the script.
• It can't be approved by a rule and ignores bypass mode, so unattended or orchestrated sessions lose the call after the timeout.

Related: #99249 (same check, zsh syntax), #96300.