Claude Code repeatedly destroys user environment files without confirmation

[fujikota]

Summary

Claude Code has repeatedly destroyed a user's WSL (Windows Subsystem for Linux) environment despite explicit instructions in CLAUDE.md to always confirm before write operations.

Incidents

1. Deleted WSL user account - Destroyed the entire user account including ~/.aws/ and all configuration files
2. Overwrote .bashrc with wrong version - Ran chezmoi init --apply without checking what files would be overwritten, replacing a carefully customized Ubuntu .bashrc with a Git Bash version. This happened right after the user had just recovered their .bashrc from incident Create SECURITY.md #1
3. Committed wrong files - Included unrelated files in a git commit without verifying staged contents

Root Cause

Claude Code failed to follow the user's explicit instructions:

• CLAUDE.md clearly states: "更新・作成・削除等の変更系操作は必ずユーザーに確認を取ってから実行すること" (Always confirm with user before any create/update/delete operations)
• Should have run chezmoi diff before chezmoi init --apply to show what would be overwritten
• Should have verified staged files before every git commit

Expected Behavior

• Always show the user what will be changed before executing write operations
• Never run destructive or overwriting commands without explicit confirmation
• Especially careful with home directory config files (.bashrc, .profile, .aws/, etc.)

Environment

• WSL2 (Ubuntu) on Windows
• Claude Code CLI

[yurukusa]

For protecting environment files, a PreToolUse hook can block modifications to critical paths:

INPUT=$(cat)
TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty')
CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
PROTECTED=(".bashrc" ".zshrc" ".profile" ".aws/" ".ssh/" ".gnupg/")
if [[ "$TOOL" == "Edit" || "$TOOL" == "Write" ]]; then
    for pattern in "${PROTECTED[@]}"; do
        if [[ "$FILE" == *"$pattern"* ]]; then
            echo "BLOCKED: protected environment file: $FILE" >&2
            exit 2
        fi
    done
fi
if echo "$CMD" | grep -qE 'chezmoi\s+(init|apply)|userdel|deluser|rm\s+-rf\s+(~/|~$|/home/)'; then
    echo "BLOCKED: destructive environment command" >&2
    exit 2
fi
exit 0

For automatic recovery, pair this with a snapshot hook that backs up files before any edit. If Claude overwrites .bashrc, you can restore from ~/.claude/snapshots/.
Exit code 2 = hard block. CLAUDE.md rules degrade with context; hooks don't.

[github-actions]

Found 3 possible duplicate issues:

1. [MODEL] CLAUDE.md rules for destructive operations not reliably followed #33391
2. [BUG] Claude Code commits without permission, despite repeated instructions to NOT commit #34451
3. Model ignores CLAUDE.md instructions despite reading them at session start #27032

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #33391.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.