Critical: rm -rf command deleted parent directory instead of subdirectory #10978

Summary

A rm -rf command intended to delete only a subdirectory (scripts/) instead deleted the entire parent directory contents, causing catastrophic data loss.

Environment

• Platform: macOS (Darwin 25.0.0)
• Working Directory: /Users/vinitgandhi/n/Bot10v1
• Date/Time: November 4, 2024, ~02:54 AM Singapore Time (18:54 UTC Nov 3)

What Happened

Timeline

1. 18:51:55 SGT - Created scripts subdirectory and copied files:

   mkdir -p /Users/vinitgandhi/n/Bot10v1/scripts
   cp /tmp/tally_analyzer_enhanced.sh /Users/vinitgandhi/n/Bot10v1/scripts/
   cp /tmp/tally_analyzer_sg.sh /Users/vinitgandhi/n/Bot10v1/scripts/
   cp /tmp/tally_receivables_india.sh /Users/vinitgandhi/n/Bot10v1/scripts/
   cp /tmp/tally_receivables_sg.sh /Users/vinitgandhi/n/Bot10v1/scripts/

2. 18:54:26 & 18:54:45 SGT - User requested to delete scripts from project folder (keep in /tmp/). Claude Code executed:

   rm -rf /Users/vinitgandhi/n/Bot10v1/scripts
   echo "Scripts folder deleted from project"
   ls -la /Users/vinitgandhi/n/Bot10v1/ | grep scripts

3. Result: Entire Bot10v1 directory contents were deleted, not just the scripts/ subdirectory

Evidence

Command Executed (verified in conversation logs)

rm -rf /Users/vinitgandhi/n/Bot10v1/scripts

This command is syntactically correct and should ONLY delete the scripts subdirectory.

Deletion Output Showed Wrong Target

The rm command produced permission denied errors for files in node_modules:

rm: /Users/vinitgandhi/n/Bot10v1/node_modules/pkce-challenge/LICENSE: Permission denied
rm: /Users/vinitgandhi/n/Bot10v1/node_modules/pkce-challenge/dist/index.node.d.ts: Permission denied
rm: /Users/vinitgandhi/n/Bot10v1/node_modules/jws/LICENSE: Permission denied
rm: /Users/vinitgandhi/n/Bot10v1/node_modules/zod/LICENSE: Permission denied
[... many more node_modules files ...]

This proves the rm -rf command was operating on the parent directory (Bot10v1/), not the subdirectory (Bot10v1/scripts/).

User Confirmation

• User witnessed the deletion happening in real-time
• All source code, configuration files, and unlocked files were deleted
• Only locked files in node_modules survived (due to permission errors)
• User had to restore entire project from GitHub backup

Expected Behavior

rm -rf /Users/vinitgandhi/n/Bot10v1/scripts should delete ONLY the scripts subdirectory and its contents.

Actual Behavior

The command deleted all contents of the parent directory /Users/vinitgandhi/n/Bot10v1/, attempting to recursively remove everything including node_modules and source files.

Impact

• Severity: Critical - Complete data loss
• User Impact: Had to restore entire project from Git backup
• Risk: This could happen to any user when deleting subdirectories

Possible Root Causes

1. Path resolution bug in Claude Code's Bash tool before passing to shell
2. Working directory confusion during command execution
3. Symbolic link handling issue
4. Race condition in command execution

Reproduction

Unknown if consistently reproducible, but occurred with:

1. Create subdirectory in project: mkdir -p /path/to/project/subdirectory
2. Copy files into it
3. Execute: rm -rf /path/to/project/subdirectory
4. Observe parent directory contents being deleted

Additional Notes

• No wildcards or parent directory references (..) were used in the command
• Shell history shows no other deletion commands
• Conversation logs confirm exact command executed
• The command syntax is correct - this appears to be an execution environment bug

This is a critical data loss bug that needs urgent investigation.