AI coding · fixes ·

Claude Code deleted my files: recover them, then guard against a repeat

As of 24 October 2026. Tool behaviour changes between versions, so check the linked docs for your version.

This guide pairs with Ship-Ready AI Rules, and if you want the next step, read Gemini API key reported as leaked? Rotate, cap, find the leak.

"Claude Code deleted my files": how to recover them and make a repeat less likely

If you're searching "Claude Code deleted my files" (or Codex, or Cursor), stop the session first, then work down the list below. The quickest options come first, and each step says what it can and can't bring back.

Quick fix: stop the session, then recover in this order

Press Esc to interrupt the agent and don't let it "fix" anything yet. Scroll back and find the exact command it ran and the folder it ran in.

1. Rewind (Claude Code checkpoints)

"Run /rewind, or press Esc twice when the prompt input is empty, to open the rewind menu", then choose Restore code (Checkpointing docs). This restores edits Claude made with its own file editing tools. If the snapshots are older than the retention period, rewinding "can fail with No files were restored".

It often can't help with deletions: "A file that only Bash commands changed isn't tracked and stays as it is. To revert it, use version control, such as Git." So a file removed by rm through the shell won't come back this way unless Claude had already edited it with its file tools in that conversation.

2. git

If the folder is a git repository, check what git still knows. We ran these in a scratch repo:

$ git status --short
 D keep.txt
$ git restore keep.txt

That brings back a tracked file as it was in the index (your last commit plus anything you staged). If a git reset --hard or branch change moved you away from your work, git reflog lists where HEAD has been so you can find the commit from before the agent ran.

Work that was staged but never committed may still be in git's object store. In our scratch repo, after staging two files and running git reset --hard:

$ git fsck --lost-found
dangling blob 61780798228d17af2d34fce4cfbdf35556832472
dangling blob 19d9cc8584ac2c7dcf57d2680375e80f099dc481

The contents land in .git/lost-found/other/, one file per blob, without their original names. What git can't recover: changes that were never committed or staged, and files in .gitignore such as .env.

3. Editor history, trash, and backups

Shell deletions usually skip the system trash, but check it anyway. Then try your editor's local history, cloud-drive version history, and your OS backups (Time Machine, File History, or your own snapshots), restoring to a time before the agent ran.

Why rewind didn't bring them back

Claude Code's docs list these limits (Checkpointing: Limitations):

  • Bash command changes not tracked, except for files Claude had already edited with its file tools.
  • Subagent edits not restored, apart from a foreground forked skill.
  • External changes not tracked, such as your own edits or other sessions.
  • Symlinked and hard-linked paths not restored.
  • Not a replacement for version control. "Checkpoints are designed for quick, session-level recovery."

Codex and Cursor

The git, editor history, and backup steps above work the same whatever tool deleted the file, because they don't depend on the agent. The checkpoint details in this post are Claude Code's. Codex and Cursor have their own undo and approval features, so check their current docs for what those cover before you rely on them.

Reduce the risk: deny rules, hooks, and git guards

Permission deny rules

Claude Code's permissions let you add deny rules, and "a scoped rule like Bash(rm *) leaves the tool available and blocks matching calls" (Configure permissions). Rules are checked "deny, then ask, then allow". The docs are clear about the limit: Bash(rm *) stops rm -rf build/ but doesn't stop /bin/rm -rf build/ or bash -c 'rm -rf build/', so a deny rule "isn't a security boundary around the program". For enforcement that doesn't depend on the command text, the docs point to sandboxing.

{
  "permissions": {
    "deny": [
      "Bash(rm *)",
      "Bash(git clean *)",
      "Bash(git reset --hard *)"
    ]
  }
}

Treat this as an example to adapt, not a complete list. As the docs explain, other spellings of the same command get past text rules.

A PreToolUse hook

"To inspect the full command text with your own logic before it runs, use a PreToolUse hook." A hook that exits with code 2 "stops the tool call before permission rules are evaluated" (Configure permissions).

Commit or branch before each agent task

The cheapest protection is a commit (or a fresh branch or worktree) before you hand the agent a task, so git has something to restore. Checkpoints are "not a replacement for version control".

Deleted files are one risk. For the security mistakes agents tend to make in app code, see 7 Security Bugs AI Agents Write in Next.js + Supabase Apps.

FAQ

Can Claude Code rewind undo rm?

Usually not. Files changed only by Bash commands aren't tracked by checkpoints, per the docs. Use git or backups.

Does Claude Code back up files?

It keeps checkpoint snapshots of its own file edits for recent prompts and deletes them in a retention sweep, by default about 30 days after the session last saved one. That's not a backup of your project.

Why is rewind not working?

The change was probably made by a shell command, a subagent, or outside the session, or the snapshots were already cleaned up. The docs list each case.

Can Codex delete files outside the project?

That depends on Codex's sandbox and approval settings in your version. Check OpenAI's Codex docs for the mode you use.

How do I stop an AI agent running rm -rf?

Combine a deny rule, a PreToolUse hook, and sandboxing, and commit before each task. The docs say text-based rules can be bypassed by other spellings, so none of these is complete on its own.

Is git enough protection?

Only for what you've committed or staged. Ignored files like .env and uncommitted work need backups too.

Guard your repo and secrets

Disclosure: this is our own paid product.

Our Guardrails Pack ($24 plus VAT where applicable) adds hooks for Claude Code, the Codex CLI, and Cursor, three Claude Code permission presets that deny listed commands, and git pre-commit and pre-push guards designed to reject staged .env files, live keys, and force pushes or deletes on main. Its guard hook is designed to deny supabase db push, production deploys, Stripe live mode, force pushes, and .env reads. The rules are pattern-based, so rephrased or encoded commands can get past them, and it's not a backup. The product page lists every limit. For agent rules aimed at Next.js, Supabase, and Stripe apps, see AI Rules and our Cursor rules guide.

Sources checked 24 Oct 2026: code.claude.com/docs/en/checkpointing and code.claude.com/docs/en/permissions. Git commands run in a scratch repo with git 2.47.3.

Claude and Claude Code are trademarks of Anthropic PBC. Codex is a trademark of OpenAI. Cursor is a trademark of Anysphere Inc. Git is a trademark of Software Freedom Conservancy. Stack & Ship is not affiliated with or endorsed by them.

Related posts