PowerShell guard blocks cmd /c rd, rmdir, del and erase aimed at drive roots or the home folder

What

When Claude runs a PowerShell command that launches cmd.exe (Windows' older command prompt), for example cmd /c rd /s ..., Claude Code now checks what that inner command deletes. The check blocks the command when it would remove a protected path: a drive root, a folder directly under a drive root, or the home folder.

• It covers the delete commands rd, rmdir, del and erase started through cmd /c, cmd /k or cmd /r.
• It reads the command line the way cmd.exe would, including carets, quotes, --%, nested start and cmd calls, and folder changes made with cd or pushd earlier on the same line.
• It checks each target again after expanding cmd's %NAME% variables and PowerShell's $var variables.
• Setting the environment variable CLAUDE_CODE_DISABLE_POWERSHELL_CMD_RM_DENY turns the check off. The variable was also added to two lists of environment variables Claude Code recognises.
• The rule also stands aside when the server-delivered flag tengu_curious_lake comes back explicitly false.

Why

Claude Code already guarded against deleting these paths, but a destructive cmd /c rd /s wrapped in PowerShell could get past those protections. The new check closes that gap on Windows and applies unless someone turns it off.