-
Notifications
You must be signed in to change notification settings - Fork 8.2k
Open
Labels
Needs-TriageThe issue is new and needs to be triaged by a work group.The issue is new and needs to be triaged by a work group.
Description
Prerequisites
- Write a descriptive title.
- Make sure you are able to repro it on the latest released version
- Search the existing issues.
- Refer to the FAQ.
- Refer to Differences between Windows PowerShell 5.1 and PowerShell.
Steps to reproduce
PowerShell followed NTFS junctions inside node_modules and recursively deleted the REAL target directories — not just the junction links. This caused a catastrophic cascade deletion that went far outside the intended target directory.
Actual damage caused:
- Standard Windows user profile folders DELETED: Documents, Downloads, Music, Pictures, Videos, Favorites, etc.
-
- Main repository source code DELETED (had to be re-cloned from GitHub)
-
-
- 2 unpushed commits PERMANENTLY LOST (Variant C implementation + commit-msg hook fix)
-
-
-
-
- Uncommitted working changes PERMANENTLY LOST
-
-
-
-
-
-
- Secondary project (WAOK-LEGACY) PARTIALLY DELETED
-
-
-
-
-
-
-
-
- Windows Recycle Bin completely BYPASSED — no recovery from there
IMPORTANT CONTEXT: This was triggered by Claude Code CLI (Anthropic's AI coding assistant) while attempting to remove git worktrees that had pnpm node_modules. Claude Code executedRemove-Item -Recurse -Forceon the worktree directories without being aware of the PowerShell + NTFS junction bug. The AI assistant had no warning mechanism for this known dangerous combination. This is a real-world incident that resulted in permanent data loss for a developer on February 26, 2026.
- Windows Recycle Bin completely BYPASSED — no recovery from there
-
-
-
-
Expected behavior
Remove-Item -Recurse -Force should delete ONLY the contents of the specified directory (./variant-a or ./variant-b). When encountering NTFS junctions inside node_modules, PowerShell should remove the junction point (the link itself) WITHOUT following it into the target directory. This is the standard behavior for symbolic link removal on Unix systems and the documented correct behavior per Microsoft's own documentation.Actual behavior
Remove-Item -Recurse -Force traversed NTFS junctions inside node_modules and deleted the REAL destination directories on disk — not just the links. Result: catastrophic recursive deletion outside the target folder. Windows user profile folders (Documents, Downloads, Music, Pictures, Videos, etc.) were permanently deleted. Recycle Bin was bypassed entirely. This was triggered by Claude Code CLI executing `Remove-Item -Recurse -Force` on a git worktree with pnpm node_modules.Error details
Environment data
aOS: Windows 10/11
PowerShell: 7.x (Core) — also reproducible on Windows PowerShell 5.1
Node package manager: pnpm (uses NTFS junctions and hard links instead of copying files)
Filesystem: NTFS
Git worktrees: yes (git worktree add)
Tool that triggered the deletion: Claude Code CLI (Anthropic) running Remove-Item -Recurse -Force
Note: $PSVersionTable output not available as the environment was affected by the incident. The bug is confirmed in existing open issues #16664 and #19714 for PS 7.2-7.3.Visuals
No response
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
Needs-TriageThe issue is new and needs to be triaged by a work group.The issue is new and needs to be triaged by a work group.
Type
Projects
Status
No status