{"version":"2.1.323","anchor":"rm-safety-check-reworked-redirect-targets-backtick-bodies","canonical_anchor":"rm-safety-check-reworked-redirect-targets-backtick-bodies","heading":"Stricter check on dangerous rm commands, and results name the rule that matched","tier":"notice","area":"Permissions","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/rm-safety-check-reworked-redirect-targets-backtick-bodies","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Stricter check on dangerous rm commands, and results name the rule that matched\n\nClaude Code's check on risky rm commands now inspects redirects, backticks and nested commands, asks when unsure, and names the rule that fired\n\n**Unclear.** Whether the new redirect, backtick and second-pass checks apply to everyone or only behind a remote switch is not known.\n\n**What**\n\nBefore Claude runs a shell command that deletes files with `rm`, Claude Code checks whether it could be dangerous. A risky command needs your approval first. This check was reworked.\n\n- The result of a dangerous-removal check now includes `removalRule`, the rule that matched.\n\n- File redirect targets, the files a command writes into with `>`, are now collected and checked again.\n\n- Text inside backticks, a way to run one command inside another, is also collected and checked again. One check is named `backtick_body_overrun`.\n\n- The command text is checked a second time in a nested pass, marked `rereading`.\n\n- When the check cannot finish, it now falls back to one shared ask-for-approval result, `nestedSpansOverrun`, instead of failing with an error. The message reads \"not ruled out - some nested commands or function substitutions could not be analyzed\".\n\n- An outer safety net catches any other error and returns the same ask.\n\n- Asks caused by a variable that could expand to nothing are tagged `removalRule: \"emptyExpansion\"`.\n\n- A new usage report records the cause and the permission mode for each ask.\n\nBefore, the check only handled `${HOME}` spans.\n\n**Why**\n\nSome `rm` commands that used to run without a prompt now ask for approval first. This is most likely when the command is built from redirects, backticks or substitutions. The `removalRule` field makes it possible to show which rule triggered the prompt.\n\n- Flag `tengu_iridescent_boot`: Not enough to say (read for one account on one subscription tier against v2.1.323; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}