Skip to content

Remove-Item -Recurse -Force follows NTFS junctions in node_modules (pnpm), deleting real files outside the target directory — catastrophic data loss #26913

@panchito05

Description

@panchito05

Prerequisites

Steps to reproduce

PowerShell followed NTFS junctions inside node_modules and recursively deleted the REAL target directories — not just the junction links. This caused a catastrophic cascade deletion that went far outside the intended target directory.

Actual damage caused:

  • Standard Windows user profile folders DELETED: Documents, Downloads, Music, Pictures, Videos, Favorites, etc.
    • Main repository source code DELETED (had to be re-cloned from GitHub)
      • 2 unpushed commits PERMANENTLY LOST (Variant C implementation + commit-msg hook fix)
        • Uncommitted working changes PERMANENTLY LOST
          • Secondary project (WAOK-LEGACY) PARTIALLY DELETED
            • Windows Recycle Bin completely BYPASSED — no recovery from there
              IMPORTANT CONTEXT: This was triggered by Claude Code CLI (Anthropic's AI coding assistant) while attempting to remove git worktrees that had pnpm node_modules. Claude Code executed Remove-Item -Recurse -Force on the worktree directories without being aware of the PowerShell + NTFS junction bug. The AI assistant had no warning mechanism for this known dangerous combination. This is a real-world incident that resulted in permanent data loss for a developer on February 26, 2026.

Expected behavior

Remove-Item -Recurse -Force should delete ONLY the contents of the specified directory (./variant-a or ./variant-b). When encountering NTFS junctions inside node_modules, PowerShell should remove the junction point (the link itself) WITHOUT following it into the target directory. This is the standard behavior for symbolic link removal on Unix systems and the documented correct behavior per Microsoft's own documentation.

Actual behavior

Remove-Item -Recurse -Force traversed NTFS junctions inside node_modules and deleted the REAL destination directories on disk — not just the links. Result: catastrophic recursive deletion outside the target folder. Windows user profile folders (Documents, Downloads, Music, Pictures, Videos, etc.) were permanently deleted. Recycle Bin was bypassed entirely. This was triggered by Claude Code CLI executing `Remove-Item -Recurse -Force` on a git worktree with pnpm node_modules.

Error details

Environment data

aOS: Windows 10/11
PowerShell: 7.x (Core) — also reproducible on Windows PowerShell 5.1
Node package manager: pnpm (uses NTFS junctions and hard links instead of copying files)
Filesystem: NTFS
Git worktrees: yes (git worktree add)
Tool that triggered the deletion: Claude Code CLI (Anthropic) running Remove-Item -Recurse -Force

Note: $PSVersionTable output not available as the environment was affected by the incident. The bug is confirmed in existing open issues #16664 and #19714 for PS 7.2-7.3.

Visuals

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Needs-TriageThe issue is new and needs to be triaged by a work group.

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions