Claude Code's rm -rf Followed an NTFS Junction Out of a Scaffolded Project and Wiped a Windows User Profile

Описание и применение

Автоматический агент удалил папку проекта, но из‑за обхода NTFS‑ссылки удалил весь профиль пользователя Windows.

Задача

An automated agent executed a recursive delete that traversed an NTFS junction, erasing the entire user profile.

Результат

The recursive delete followed an NTFS junction into the user's home directory, wiping all files and folders within the profile.

Рабочий процесс

• Run pnpm dlx degit payloadcms/payload/templates/website aldaba-v2 to scaffold the project.
• Resolve a workspace:* dependency issue by deleting the scaffolded folder.
• Execute rm -rf /c/Users/guido/aldaba-v2 in Git Bash with --dangerously-skip-permissions enabled.

Доказательства

Git Bash's rm -rf follows an NTFS junction into its real target instead of deleting the link itself — a gap already closed in PowerShell Core 6+ but never backported to the Git-for-Windows tooling Claude Code's Bash tool shells out to.

Источник

The reporter's estimate: roughly 165.66GB across 1,593,350 files and 276,382 folders destroyed, including personal files, AppData, and active data for a business.

Источник

The issue carries bug, data-loss, and has repro labels, and the reporter linked two earlier, similar junction-traversal deletion reports (#29249, #29023) as related.

Источник