How to Stop Claude Code from Deleting Files with rm -rf

If you want to stop Claude Code from deleting files with rm -rf, start at the tool boundary. Claude Code can run Bash, and its rewind documentation explicitly says Bash file changes are not tracked by checkpoints. A deletion may therefore be outside the recovery path you expect from /rewind. Permission rules, hooks, snapshots and Git each address a different part of that problem.

The goal here is a practical setup you can verify, not a claim that one regular expression makes every shell command safe. Shell wrappers, scripts and other tools can change files without invoking the exact command you anticipated.

Start with Claude Code's scoped deny rule

For direct rm calls, Claude Code supports a rule such as Bash(rm *) in permissions.deny. Its permissions guide uses that example and explains that a scoped deny rule leaves Bash available while blocking matching calls. A minimal example is:

{
  "permissions": {
    "deny": ["Bash(rm *)"]
  }
}

Add the entry to your existing Claude Code settings rather than replacing other settings. A user-level setting applies to your sessions; a project setting can be shared with the project, subject to Claude Code's settings precedence and trust rules. Review which scope you intend to change before editing it.

Know the limit. Anthropic's documentation says Bash(rm *) stops a direct rm -rf build/ call but does not match /bin/rm -rf build/ or bash -c 'rm -rf build/'. Other programs can delete files without spelling rm at all. Use the rule to reduce a common mistake, not as a complete filesystem security policy.

Put inspection before the command runs

Claude Code's hook reference says PreToolUse fires before a tool call and can block it. A command hook receives JSON about the proposed call. For a Bash tool call, a guard can inspect the command, resolve its target paths, save the targets or project, and refuse catastrophic operations. Exit code 2 blocks the tool call; the same hook framework also supports structured JSON decisions.

Decide what should happen when the guard cannot parse a command or fails to run. A simple string check can miss cd, variables, command substitution, pipelines or a script that deletes files indirectly. A responsible guard either blocks uncertain commands or takes a broader snapshot before allowing them. Test how failures behave in the Claude Code version you use; do not infer safety from a hook file merely existing on disk.

Sandpiper installs Claude Code hooks for prompts and Bash calls. Its local guard analyzes potentially destructive commands, saves supported targets before execution, and refuses catastrophic paths such as the home directory or filesystem root. For commands it cannot fully resolve, it snapshots the project more broadly. It is a guard and recovery layer, not an operating-system sandbox. The app's timeline lets you inspect captured turns and restore a file, folder or turn.

Check what the snapshot actually covers

A project snapshot is useful only when it contains the file you need. Sandpiper saves supported local files in the repo before a prompt, and again before risky commands. It does not keep .git internals or ignored folders that tools can rebuild; files above 256 MB are listed but not kept. It also cannot restore a remote database, a cloud inbox or a file from before installation. If your task touches a database, use that service's own backup and change controls.

For a source file and a local .env, inspect a disposable project's snapshot once before trusting it in production work. The deleted .env guide explains why an ignored secret needs its own recovery path. Keep an external Time Machine or other machine backup as well, because an on-disk local snapshot shares the Mac with the original.

Run a safe drill, not a real loss

Use a temporary project that contains a small tracked file and an untracked test note. Install the guard and send a prompt that would attempt to remove only a disposable test path. Confirm the permission rule or guard acts as expected, then confirm the snapshot contains the note and restore it. Run the test in the same agent surface and permission mode you normally use. A hook that works in one setup may be disabled, moved or untrusted in another.

If a command is blocked, inspect the reason and give Claude a narrower instruction, such as removing one named generated file, rather than disabling the protection for the whole session. If the agent uses a different command to achieve the same deletion, that is evidence your rule covers only a syntax, not the outcome. Tighten the workflow or require review for that operation.

Keep recovery independent of prevention

Commit meaningful milestones before large tasks. A committed source file can be recovered from Git even if a guard fails. Keep a separate backup for uncommitted and ignored files. Then use an agent-turn snapshot to cover the short interval between commits. These methods overlap deliberately: a deny rule can stop an obvious command, a hook can save before a risky command, and a backup can help if the command still runs.

If deletion has already happened, installing a guard now does not recover it. Use the Claude Code deleted-files recovery guide to inspect rewind, Git and earlier backups in a safe order.

Frequently asked questions

Telman Gadimov builds Sandpiper, a free local undo app for AI coding agents, and Murmur. We make Sandpiper. Claude Code permission and hook behavior is sourced from Anthropic's official documentation. No pattern or hook is described as a universal sandbox.