Back to rankings

Claude Code Denies Dangerous rm and rmdir at Once in Bypass Mode on Desktop and VS Code

Claude CodeView original changelog

Claude Code 2.1.309 changes what happens when Claude tries a dangerous rm or rmdir while bypass permissions mode is on in the Desktop app or the VS Code extension. Instead of showing a prompt that waits for an answer, Claude Code now denies the command immediately and hands Claude a hint to rewrite it. The goal is that unattended sessions keep going instead of stalling on a question nobody is there to answer.

Key Takeaways

  • Dangerous rm and rmdir are now denied immediately in bypass permissions mode on the Desktop app and in VS Code, instead of raising a prompt.
  • The denial includes a rewrite hint, so Claude can choose a narrower, safer command or report what it wanted to delete.
  • The change targets unattended sessions, which previously could stall waiting for an answer nobody was there to give.
  • Critical paths such as the filesystem root, home directory and working directory remain protected, and no allow rule or allowing hook can approve a recognized removal.
  • The Desktop and VS Code behavior now matches how auto mode already treats these removals where no terminal prompt can be shown.
  • The check is not a substitute for sandboxing, since a command it fails to recognize is approved like any other Bash command in bypass mode.

What changed

Claude Code 2.1.309 changes the handling of dangerous rm and rmdir commands in bypass permissions mode when the session runs in the Desktop app or the VS Code extension. The release notes say the prompt is replaced by an immediate denial that includes a rewrite hint, "so unattended sessions keep going."

Background: critical-path removals

Claude Code protects a set of critical paths from rm and rmdir, such as the filesystem root, the home directory and the working directory. No allow rule and no PreToolUse hook that returns allow approves a removal whose target Claude Code recognizes as one of these paths, even in modes that skip other prompts. Until now, bypass mode answered such a removal with a prompt. In the terminal the prompt carries a two-minute countdown, after which the command is denied. The Desktop app and the VS Code chat panel have no terminal prompt of that kind, so a session left running could sit waiting on a question.

What users see now

In bypass permissions mode inside the Desktop app or VS Code, a recognized dangerous removal is refused straight away. Claude receives a message explaining that the command was denied and suggesting a rewrite, so it can pick a safer approach, such as removing a narrower path, or report back what it wanted to delete and leave the removal to the user. The same pattern already applied to auto mode in places where no terminal prompt can be shown. This change brings bypass mode in those two surfaces in line with it.

Who is affected

People who run long or unattended sessions in bypass mode from the Desktop app or VS Code will see fewer sessions stuck waiting for a confirmation. Anyone who relied on approving a critical-path removal through that prompt will now need to run the command themselves or adjust the plan. Terminal sessions are not described as changing in this bullet, and the documentation notes that the check is a safeguard, not a replacement for sandboxing or operating-system controls, because a command the check misses is handled like any other approved Bash command.