Stricter check on dangerous rm commands, and results name the rule that matched

What

Before Claude runs a shell command that deletes files with rm, Claude Code checks whether it could be dangerous. A risky command needs your approval first. This check was reworked.

• The result of a dangerous-removal check now includes removalRule, the rule that matched.
• File redirect targets, the files a command writes into with >, are now collected and checked again.
• Text inside backticks, a way to run one command inside another, is also collected and checked again. One check is named backtick_body_overrun.
• The command text is checked a second time in a nested pass, marked rereading.
• When the check cannot finish, it now falls back to one shared ask-for-approval result, nestedSpansOverrun, instead of failing with an error. The message reads "not ruled out - some nested commands or function substitutions could not be analyzed".
• An outer safety net catches any other error and returns the same ask.
• Asks caused by a variable that could expand to nothing are tagged removalRule: "emptyExpansion".
• A new usage report records the cause and the permission mode for each ask.

Before, the check only handled ${HOME} spans.

Why

Some rm commands that used to run without a prompt now ask for approval first. This is most likely when the command is built from redirects, backticks or substitutions. The removalRule field makes it possible to show which rule triggered the prompt.