rm -r on the output of a command substitution now always asks for approval

What

A command substitution is a piece of a shell command, written as $(...) or in backticks, that is replaced by another command's output when it runs. A recursive rm (-r or -R) whose target is entirely such output now always stops for your approval. The message says "Dangerous rm operation detected: the target is the output of a command substitution ($(...) or backticks) and cannot be checked before the command runs." It tells you to run the substitution first and then remove the literal paths it prints.

• Permission rules cannot auto-allow this prompt.
• Paths like ${VAR:-$(cmd)} are now unwrapped before the check.
• The check for a substitution at the end of a path now also handles /.. endings.
• Setting the CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT environment variable skips the prompt. So does a server value setting tengu_iridescent_boot to false. Nothing has been read about tengu_iridescent_boot or tengu_bash_dangerous_rm_too_complex yet.

Why

Claude Code cannot know in advance what such a command will delete. Commands like rm -rf $(find ...) now wait for you even if you have broad allow rules.